The federal Personal Information Protection and Electronic Documents Act
("PIPEDA") sets out a number of rules for protecting personal information - defined as "information about an identifiable individual", but excluding employee contact information. These rules are applicable to all organizations that collect, use or disclose personal information in the course of commercial activities, except those operating within the provinces of Quebec
, and Alberta
, where organizations are subject to substantially similar provincial laws. These laws require, among other things, that organizations obtain the consent of individuals to any collection, use or disclosure of their personal information, except in specific circumstances such as law enforcement or emergencies.