For customers or staff in Canada, has each person consented to this new use, or will the data be anonymised to the Canadian standard before it leaves? For Quebec, is the privacy impact assessment done and the written agreement ready?
The data is anonymised to the regulator's standard (no serious possibility of re-identification, alone or with other available information) with the test written down, or each person consented to this licence; for Quebec, the impact assessment is done and the agreement with the buyer reflects it.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: stated
“When personal information that has been collected is to be used for a purpose not previously identified, the new purpose shall be identified prior to use. Unless the new purpose is required by law, the consent of the individual is required before information can be used for that purpose.”
PIPEDA Schedule 1, clause 4.2.4: a purpose not previously identified needs the individual's consent, checked 18 Oct 2026
OPC, PIPEDA Findings #2026-001 (Loblaw, PC Optimum): the standard for anonymized information, checked 18 Oct 2026
Quebec private sector Act, section 17: privacy impact assessment before communicating information outside Quebec, checked 18 Oct 2026
- PIPEDA Schedule 1, clause 4.2.4: a purpose not previously identified needs the individual's consent (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Schedule 1, cl. 4.2.4)
- PIPEDA Schedule 1, clause 4.5: no use or disclosure for other purposes without consent (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Schedule 1, cl. 4.5)
- PIPEDA section 5(3): only purposes a reasonable person would consider appropriate (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 5(3))
- PIPEDA section 7.2(4): the business transaction exception excludes the sale or lease of personal information itself (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7.2(4))
- PIPEDA section 7(3)(f): disclosure without consent for statistical or scholarly research (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7(3)(f))
- PIPEDA sections 2 and 4(1): commercial activity, and staff data only for federal works (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 2 (commercial activity), s. 4(1))
It is shown on its own, not counted into a figure.