myLaminin and PIPEDA Compliance

myLaminin, the clinical trial and research data management platform, worked directly with Canada's privacy regulator to understand its obligations under PIPEDA. This page explains what the law covers and where myLaminin stands.

What is PIPEDA?

The Personal Information Protection and Electronic Documents Act (PIPEDA) is a Canadian federal law. It regulates how private-sector organizations collect, use and disclose personal information in the course of their for-profit, commercial activities. It also applies to the personal information of employees of federally regulated businesses.

PIPEDA sets national standards for privacy practices in the private sector. In essence, it gives businesses a framework for handling personal information responsibly, respecting the rights of individuals while enabling organizations to carry out their commercial activities.

Key aspects of PIPEDA

Scope

PIPEDA applies to private-sector organizations that conduct business across Canada, or in a province that does not have a privacy law deemed substantially similar to PIPEDA.

Consent

PIPEDA recognizes two forms of consent:
Express consent: the individual actively agrees.
Implied consent: the individual does not refuse after being offered the opportunity to do so.

Data breaches

Organizations must notify the Office of the Privacy Commissioner of Canada (OPC) and affected individuals if they become aware of a data breach that poses a significant risk of harm.

Penalties

Fines can range up to $100,000 for serious violations.

Purpose

The law aims to protect the privacy of individuals with respect to their personal information, while acknowledging that organizations need to collect, use or disclose information for reasonable purposes.

Fair information principles

PIPEDA sets out 10 fair information principles that organizations must follow:
Accountability
Identifying purposes
Consent
Limiting collection
Limiting use, disclosure and retention
Accuracy
Safeguards
Openness
Individual access
Challenging compliance

The OPC investigates complaints about non-compliance.

Relationship to other laws

Provincial privacy laws may apply instead of PIPEDA in certain circumstances, especially where they are deemed substantially similar.

myLaminin's compliance with PIPEDA

myLaminin actively worked with the OPC to understand its obligations and responsibilities in supporting researchers and research institutions to secure their research data, facilitate global collaboration and comply with regulatory standards.

myLaminin has implemented the OPC's recommendations and is substantially PIPEDA compliant, with a few required notifications that are on our roadmap.

Why this matters for research teams

Research projects often collect personal information about participants, collaborators and staff. Depending on who holds the data and where, PIPEDA or a substantially similar provincial law may govern how that information is handled.

Researchers and research institutions remain accountable for the personal information they collect. Working with a platform that has engaged the regulator directly, and acted on its recommendations, helps you meet your own obligations with confidence.