What is personal information?

Canada's federal private-sector privacy law, PIPEDA, defines personal information as "information about an identifiable individual". It leaves out the name, title, business address or business phone number of an employee of an organization. The definition is deliberately broad, so it isn't a fixed list.

How the test works

The Office of the Privacy Commissioner of Canada says information is about an identifiable individual where there is a serious possibility that someone could be identified from it, alone or combined with other information. A name is the obvious case. Less obvious ones count too: IP addresses, photographs and GPS vehicle tracking data have been treated as personal information where a person can be identified from them.

What else the definition covers

• It doesn't have to be written down. Oral conversations and real-time video surveillance can count.
• Being publicly available doesn't remove the protection. Information can still be personal information even if it's publicly available within the meaning of the regulations.
• Information about a company is generally not personal information, though a sole proprietor's details may be, case by case.

Why it matters to you

This is the data that data brokers and people-search sites collect and sell: your name, address, phone number, email and the links between them. Because the law treats it as yours even when it's public, you can ask organizations what they hold about you and how they use it.

Personal information vs. PII

"PII" is the term used in the US, defined differently by different agencies. "Personal information" is the term used in Canadian law. They overlap heavily, but the legal tests differ, so check the law that applies where you live.