Most people assume that surveillance is either allowed or not. The reality is more precise, and the precision is what protects everyone involved. In Canada, the collection and use of personal information by private organizations is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA). Understanding, in plain terms, what PIPEDA permits and forbids is useful whether you are considering an investigation, subject to one, or simply want to know where the lines fall. This page is general information, not legal advice.
The default rule: consent
PIPEDA’s starting point is that an organization needs an individual’s knowledge and consent to collect their personal information. That is the default, and it is why surveillance cannot be a free-for-all. An investigator does not have a blanket exemption from privacy law simply by virtue of being an investigator.
The narrow exception that makes investigations possible
Investigations work because PIPEDA contains a specific, limited exception. Personal information may be collected without consent where it is reasonable to expect that seeking consent would compromise the availability or accuracy of the information, and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of a law of Canada or a province. In plain terms: you cannot ask a person’s permission to document conduct they are concealing, and the law recognizes that. But the exception is not open-ended. It applies to a genuine, articulable purpose, a specific breach or contravention that has occurred, is occurring, or is about to occur, not to generalized curiosity about someone’s life.
This is why a professional will ask, at the outset, what the actual issue is. The legitimate purpose is not a formality. It is the legal footing on which the entire investigation stands. Without it, the collection is not lawful, and unlawfully collected information is a liability rather than an asset.
What the exception does not cover
The exception permits lawful collection for a legitimate investigative purpose. It does not permit everything an investigator might technically be able to do. It does not authorize trespass. It does not authorize intruding into spaces where a person has a reasonable expectation of privacy, such as the inside of a home. It does not authorize intercepting private communications, which is a separate matter governed by the Criminal Code and covered in Recording conversations in Ontario. And it does not authorize sharing the resulting information freely; disclosure has its own limits, and information gathered for an investigation does not become fair game for any purpose.
Ontario also recognizes a common-law privacy tort, intrusion upon seclusion, which provides a further reason that intrusive methods are not merely unwise but actionable. The combined effect is that lawful surveillance is observation of what is genuinely observable, for a genuine purpose, and nothing more.
Why the limits are in your interest
It is tempting to see privacy limits as obstacles to getting answers. They are the opposite. Evidence gathered within the limits is evidence you can use, in court, before a tribunal, or in a decision you have to defend. Evidence gathered outside them can be excluded, can be turned against the person who commissioned it, and can create liability that dwarfs whatever the investigation was meant to resolve. The lawful path is also the useful path.
An investigator who understands PIPEDA is not a cautious investigator. They are an effective one, because they produce work that survives the scrutiny it will eventually face.
Not legal advice
This page is general information about Canadian privacy law and is not legal advice. PIPEDA’s application depends on the specific facts; consult a lawyer for a specific situation, or the Office of the Privacy Commissioner of Canada for guidance on the Act.