Privacy Challenges for Condominium Corporations and Condominium Managers presented to the Association of Condominium Managers of Alberta by Carmen Mann, Portfolio Officer Office of the Information and Privacy Commissioner November 19, 2010 Calgary, AB

Applicable Legislation (Alberta)  Personal Information Protection Act (PIPA)  Privacy obligations of private sector organizations, including both condominium corporations and condominium management companies  Condominium Property Act  Rights and responsibilities of condominium corporations, condominium boards and owners

General Privacy Principles  Reasonable purpose for collection, use or disclosure (“CUD”)  Consent to CUD  Exceptions to consent  Legislative authority  Access to personal information  Correction of personal information  Safeguarding  Privacy Officer and Privacy Policy  *NEW* Notifying Commissioner of incidents

Service Providers – s. 5 s. 5 provides: (2) For the purposes of this Act, where an organization engages the services of a person, whether as an agent, by contract or otherwise, the organization is, with respect to those services, responsible for that person’s compliance with this Act. (6) Nothing in subsection (2) is to be construed so as to relieve any person from that person’s responsibilities or obligations under this Act.

OIPC Statistics Complaints/Requests for Review Property Management Companies (includes Landlords) Estimated total to date (since 2004): 85 Condominium Corporations Estimated total to date (since 2004): 25

OIPC Orders  Order P  Disclosure without consent: President of Condo Board overheard by Complainant discussing Complainant’s personal information with a resident and another person.  Order P  Disclosure without consent: Personal information of Complainant alleged to have been included in AGM minutes.  Order P  Access request: Applicant wanted Condo Corp to give him a copy of the complaint it received about him.

Common Complaints  Safeguarding complaints – s. 34   AGM sign in sheets  New keys  Disclosures at AGM and in Meeting Minutes

Access Requests  Access to Personal Information – s. 24  Photographs  Complaints  Access to Non-Personal Information – s. 20  Other owner contact information  Parking/storage space information  Condominium financial information  Resolutions

Section 20 and the CPA 20 An organization may disclose personal information about an individual without the consent of the individual but only if one or more of the following are applicable: (b)The disclosure of the information is authorized or required by (i) a statute of Alberta or of Canada (ii) a regulation of Alberta or a regulation of Canada (iii) a bylaw of a local government body, or (iv) a legislative instrument of a professional regulatory body

Breach Reporting (s. 34.1(1)) Section 34.1(1) provides: 34.1(1) An organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure.

Resources  Alberta:  Frequently Asked Questions For Condominium Corporations:  BC:  Privacy Guidelines for Strata Corporations & Strata Agents:* *NOTE THOUGH THE BC PIPA IS NOT IDENTICAL TO THE AB PIPA

Contact Information  Office of the Information and Privacy Commissioner  Fax: (403)  Toll Free:  Website -  Access and Privacy Branch, AB Government Services  Website -  Information Line (780) 644-PIPA (7472)

Questions?