Landlords and Tenants: Guidance on PIPA

Note: Read below for the rest of the guidance or click here to download a PDF.

Introduction to PIPA

The Personal Information Protection Act (PIPA), Alberta’s private sector privacy law, sets the rules that landlords are required to follow when handling the personal information of tenants (tenants also refers to prospective tenants).

PIPA recognizes the legitimate need for landlords to collect, use and disclose personal information for reasonable business purposes, and establishes the rules that must be followed. “Reasonable” in PIPA is defined as “what a reasonable person would consider appropriate in the circumstances” (section 2), which must be assessed objectively (Order P2010-19). It is an important principle in PIPA. Landlords must also collect, use or disclose only the amount and type of personal information reasonably required to fulfil their purpose.

PIPA applies to any residential property owner who is renting out all or part of their property, including property management businesses or an individual acting in a commercial capacity, i.e., renting for profit (section 1(i)).

At the same time, PIPA gives tenants the right to request access to the personal information that the landlord has about the tenant, the right to request access to information about how their own personal information has been used or disclosed, and the right to request correction to their own personal information (sections 24 and 25).

PIPA defines personal information as “information about an identifiable individual” (section 1(1)(k)). An individual’s name, date of birth, phone number, address, physical characteristics, biometrics, income, social insurance number (SIN), employment and financial history, gender, photograph, and driver’s license number are all examples of personal information.

This guide answers some of the most common questions that the Office of the Information and Privacy Commissioner of Alberta (OIPC) receives regarding the collection, use, disclosure and protection of tenants’ personal information by landlords, and tenants’ right to request access to personal information. The OIPC would like to acknowledge the assistance of two Government of Alberta ministries, Technology and Innovation and Service Alberta and Red Tape Reduction, which were sent a draft version of the guidance and then provided helpful input.

Note This guide is intended for private sector residential landlords under PIPA, including individuals operating in a commercial capacity. Some landlords, such as social housing management bodies, are governed by the Freedom of Information and Protection of Privacy Act (FOIP). This guide is not intended for public bodies.

 

What are a landlord’s responsibilities under PIPA?

Landlords’ responsibilities under PIPA relate to how landlords collect, use, disclose and protect the personal information of tenants, including the following:

• Adopting policies and procedures to comply with PIPA (sections 5 and 6). For example, an organization under PIPA must identify an individual who is responsible for ensuring the landlord’s compliance with PIPA so that tenants know who to contact with questions. (For assistance, see guidance on Privacy Management Programs.)
• Collecting tenants’ personal information with consent, and having a reasonable purpose for the collection, use and disclosure of personal information (sections 7, 11, 16 and 19). Even where PIPA does not require landlords to obtain an individual’s consent, landlords must still have a reasonable purpose for collecting, using or disclosing personal information, and must collect, use or disclose only the amount and type of personal information reasonably required to fulfil that purpose.
• Notifying tenants of their purpose for the collection before or at the time of collecting the information from the tenant (section 13). Once personal information is collected, any subsequent use and disclosure of the personal information by the landlord must be consistent with the purpose for the collection, with few exceptions.
• Protecting the personal information by implementing safeguards to prevent unauthorized access, loss, destruction, copying or modification (section 34). In case of a privacy breach, the landlord may be required to notify affected individuals and report the breach to the OIPC (sections 34.1 and 37.1; PIPA Regulation, sections 19 & 19.1). A privacy breach means an incident involving the loss of or unauthorized access to or disclosure of personal information. Landlords are required to notify any individual(s) affected by a breach and report the breach to the OIPC where a reasonable person (objectively assessed) would consider that that there is a real risk of significant harm to the individual(s) affected by the breach.
• Responding to a tenant’s request for access to or correction of their own personal information, or a tenant’s request for access to information about how their personal information has been used or disclosed (sections 25 and 26).

Landlords also have obligations under PIPA with respect to the collection, use and disclosure of personal employee information. Under PIPA, an employee is employed by the organization or provides a service for the organization, including an apprentice, volunteer, cooperative student, or an individual (not a company) acting as a contractor or agent for the organization. Landlords’ responsibilities under PIPA with respect to personal employee information are not the focus of this document.

Consent and Collection Notices

When does a landlord need to obtain a tenant’s consent? Does a landlord need to notify the tenant about the collection, use or disclosure of their personal information?

Generally, landlords need to obtain tenants’ consent in order to collect, use or disclose the tenant’s personal information (section 7). Before or at the time of collection, landlords must also inform tenants about the purposes for which the information is collected, and provide contact information for any questions about the collection (section 13(1)).

Personal information should always be collected directly from the tenant and not from another source, unless the tenant consents to collection from that source.

Once landlords collect personal information, they can only use and disclose it for the original purpose(s) expressed to their tenants. If landlords want to use or disclose the information for a new, unstated purpose, they will require a new consent from the tenant for that purpose.

There are a few instances where consent is not required for the collection, use or disclosure of personal information (sections 14, 17 and 20). Although there are circumstances where consent is not required, there is nothing in PIPA preventing landlords from notifying tenants as a courtesy.

How can a landlord obtain consent?

To obtain consent, landlords must tell tenants why they are collecting tenants’ personal information before or at the time it is collected (section 13(1)).

Consent should generally be expressed either in writing or verbally. Written consent allows both the landlord and tenant to have a record of the consent, along with the purpose(s) for collection, use or disclosure of personal information.

Landlords must generally obtain express consent when:

• the information being collected, used or disclosed is sensitive; and/or
• the collection, use or disclosure is outside the reasonable expectations of the individual.

Consent can also be implied in strictly defined circumstances (section 8(2)). A tenant is deemed to consent to the collection, use or disclosure of personal information if the information is voluntarily provided to the landlord for a particular purpose, and where it is reasonable that a person would voluntarily provide that information.

PIPA also recognizes opt-out consent (section 8(3)).

Are there circumstances when a landlord does not require the tenant’s consent to collect, use or disclose personal information?

There are limited circumstances where landlords do not require a tenant’s consent to collect, use or disclose personal information.

For example, if another law, such as the Residential Tenancies Act, requires the collection, consent under PIPA is not required. Other examples include disclosing personal information pursuant to a warrant or subpoena, or for a law enforcement investigation.

PIPA may also authorize the collection, use or disclosure without consent of certain information that is “publicly available”. What is “publicly available” is defined in the PIPA Regulation, section 7. Refer to this section for more information. Social media is not a publicly available source under PIPA.

Remember, even where PIPA does not require a landlord to obtain an individual’s consent, landlords must still have a reasonable purpose for collecting, using or disclosing personal information, and must collect, use or disclose only the amount and type of personal information reasonably required to fulfil that purpose.

Can a tenant refuse to give consent to a landlord to collect, use or disclose personal information?

Tenants may refuse to provide information or give consent to a landlord when the information is not reasonably required to manage the landlord-tenant relationship.

Tenants must provide certain information that is reasonably required for the landlord-tenant relationship, and a tenant’s failure to provide that information can affect a tenant’s eligibility to rent property.

Landlords cannot, as a condition of renting or providing any service to a tenant, ask for consent to collect, use or disclose personal information beyond what is necessary to provide tenancy or any service (section 7(2)). For example, landlords would not need to know a tenant’s educational background.

Can a tenant withdraw consent for a landlord to collect, use or disclose personal information?

Tenants may withdraw or vary consent given to a landlord at any time by providing notice to the landlord of the consent withdrawal or variation. If this happens, landlords must explain to tenants the consequences of withdrawing or varying consent, unless it would be reasonably obvious. A consequence may include not offering tenancy to a tenant.

The landlord must then cease to collect, use or disclose the personal information, or abide by the variation of consent. Withdrawal or variance of consent must not affect the performance of a legal obligation that the landlord has (section 9(1) to 9(5)).

Collecting Personal Information

What personal information can a landlord request from a tenant?

Landlords may request from tenants only the personal information reasonably required to make a decision about whether to rent property to the individual (section 11). This personal information may include reasonable proof that a tenant is capable of paying rent or references from other landlords. Landlords would also need contact information in order to notify the tenant about the landlord’s decision on the tenancy application.

Landlords must also be prepared to provide an explanation as to why the information is required (section 13). A notice of collection must be provided before or at the time personal information is collected. Providing notice can help landlords consider what personal information they need to collect to establish tenancy, and helps tenants understand why that information is needed.

Generally, if landlords do not need the information, they should not collect it, and if tenants are not sure why a landlord needs their personal information, they should ask why. Remember that in the event that information might be required later, it can be collected at the time it is actually necessary.

Landlords who take privacy obligations seriously build trust with tenants.

Can a landlord request to see a tenant’s government-issued identification (ID)?

Landlords can request to see a tenant’s ID to verify an individual’s identity, which is typically done when entering into a lease agreement.

Can a landlord retain a copy of a tenant’s government-issued identification (ID), including by photocopying or recording the ID number?

It may not be reasonable for landlords to copy or retain an individual’s ID information. Landlords should consider what information is reasonably required for tenancy and exactly how retaining certain types of personal information will serve a business purpose. Typically, landlords should view the ID to verify identity and then return it to the tenant. Landlords must record only the types of personal information that are reasonably required. For example, landlords should be able to properly identify a tenant when there is an emergency, damage is caused to the property, or the lease is not honoured by the tenant.

Example As part of the rental application process, a landlord needs to confirm the identity of a tenant. The landlord asks permission to photocopy the tenant’s driver’s license for this purpose and retain it for the duration of the tenancy. While the landlord explained the purpose for collection and obtained consent, it might not be reasonable to collect this information. Simply viewing the license is likely sufficient for this purpose. A driver’s license contains information not reasonably necessary as part of a rental application (eye colour, weight and height) and may be an over-collection of personal information.

 

Can a landlord ask a tenant for references?

Landlords may collect personal information about a tenant’s references, but only with the tenant’s consent.

Any personal information exchanged between landlords about prospective or past tenants must be limited to information related to the individual’s suitability as a tenant, such as complaints during the tenancy, damage to property and rent payment history, but not personal characteristics or appearances.

If a tenant refuses to provide references, and this affects the landlord’s ability to make a decision about granting tenancy, it would be reasonable for the landlord to decline the application.

Can a landlord request a credit report on a tenant?

Landlords can request a credit report on a tenant if the landlord has concerns about non-payment of rent.

Before ordering the credit report, landlords are required to obtain tenants’ consent to do so according to both the Consumer Protection Act and PIPA. Alternatively, a landlord and tenant may also agree to the tenant obtaining their own credit report and providing a copy of it to the landlord.

Can a landlord collect a tenant’s social insurance number (SIN)?

Landlords should avoid collecting a prospective tenant’s or a tenant’s SIN because a SIN has no connection to determine suitability of a tenant and is not indicative that a person is working or has the means to pay rent (OIPC Order P2012-11).

A common reason given by landlords when collecting a tenant’s SIN is for a credit check, but a SIN is not essential for conducting credit checks. The tenant’s full name and date of birth will also produce a credit report in nearly all cases.

Unless landlords can demonstrate that a SIN is required by law, a tenant cannot be denied tenancy for refusing to provide a SIN.

Example A landlord struggling with non-paying tenants decides to ask all tenants for consent to obtain credit reports. The landlord asks for a SIN for this purpose, and notifies tenants about the purpose for collecting SINs. A tenant objects and says they only give their SIN to organizations where required by law. The landlord and tenant agree that the tenant will give their date of birth and middle name to the landlord to order the credit report. The landlord advises the tenant that more than one person with the same full name and date of birth could still appear on the credit report. The tenant says that if this occurs then they will obtain their own credit report and provide it to the landlord.

 

Can a landlord collect personal information of a tenant without consent through internet searches?

Generally, landlords must obtain consent from a tenant before collecting personal information about them.

Landlords are generally discouraged from using general internet searches to conduct tenant background checks given the privacy issues that may arise through inadvertent collection of personal information. For example:

• Landlords have no ability to control the amount of personal information collected via internet searches which may result in collecting too much or irrelevant personal information (sections 11(1) and 11(2)).
• Landlords may inadvertently collect third party personal information without consent.
• It is difficult to assess the accuracy of information through some internet searches.

What personal information can a landlord request from a tenant?

After landlords accept a tenant’s application, it may be reasonable for landlords to request more detailed information for the landlord-tenant relationship. Personal information requested by landlords must always be reasonably connected to tenancy, and landlords must notify tenants about the purpose for collecting more detailed personal information (sections 11 and 13).

For example, landlords may need a record of tenant vehicle plate numbers to ensure that unauthorized vehicles are not parked in tenants’ stalls. A health care number, however, is not connected to tenancy and would not be reasonably required.

If, after being notified about the purpose of collection, a tenant remains concerned about the type of information being requested, an alternative form of satisfying the landlord’s purpose for the collection should be considered.

Landlords must provide tenants with clear contact information so tenants can ask the landlord questions about any collection of personal information (section 13(1)(b)).

Generally, if landlords do not need the information, they should not collect it, and if tenants are not sure why a landlord needs their personal information, they should ask why.

Can a landlord ask a tenant for emergency contact information?

Landlords may collect emergency contact information from tenants, with the tenant’s consent. The landlord must only use this information for the stated purpose. Tenants are advised to ensure they ask their contacts if they can provide information to the landlord.

Can a landlord require financial information from a tenant?

A landlord can collect financial information from tenants in order to process rent payments, but must only collect the amount of personal information reasonably required to process the payments.

There are numerous ways for a landlord to collect rent payment that may require landlords to collect banking information or other personal information to process the payment.

If a tenant does not consent to providing the personal information required for a particular payment method, an alternative form of satisfying the landlord’s need to collect rent payment should be considered.

Can a landlord ask to see a copy of a tenant’s insurance?

It may be reasonable to request proof of tenant’s insurance if, for example, the landlord must satisfy their own insurance requirement that their tenants have insurance. Landlords must have a purpose for requesting this information and explain it to the tenant (sections 11 and 13).

The Office of the Privacy Commissioner of Canada has found that an insurance company’s purpose for requiring a landlord to collect tenants’ insurance information from tenants was reasonable and that it was the landlord’s obligation to obtain tenants’ consent to the collection and disclosure (OPC PIPEDA Case Summary #2006-343).

Can a landlord ask for a tenant’s roommate’s personal information if the roommate is not on the lease?

Landlords may request the names of people living in their property, even though only the tenant(s) on the lease might be responsible for payment of rent and damages. Tenants should get consent of renters or provide them with notice that their information will be passed on to the landlord.

Can a landlord request a tenant’s criminal record?

It may not be reasonable for landlords to request a tenant’s criminal record. Landlords cannot, as a condition of renting or providing any service to a tenant, ask for consent to collect personal information beyond what is necessary to provide tenancy (section 7(2)).

Landlords may only collect information about an individual’s criminal history for purposes that a reasonable person (objectively assessed) would consider appropriate in the circumstances and only for the purposes that they disclose to the tenant. If a situation arises where a landlord seeks to collect personal information about an individual’s criminal record, the landlord should be ready to justify why a reasonable person would consider it appropriate in the circumstances.

Can a landlord take pictures of the interior of a tenant’s rental unit?

There may be circumstances where landlords are permitted to take pictures of the interior of a tenant’s rental unit, such as for insurance purposes or when advertising the property for rent.

A collection of personal information can occur if the photographs the landlord takes contain images of the tenant(s) or other individuals or if they reveal something of a personal nature about the people residing there (Order P2007-004). As a result, taking photos of a tenant’s interior requires notice and consent, unless one of PIPA’s exceptions for collection without consent applies.

Landlords can prevent inadvertent collection of personal information by asking tenants to remove any pictures, documents or other items containing personal information before photographing the unit. Care should be taken by landlords not to take photos indiscriminately.

Landlords may also need to take photographs to capture images of the exterior of buildings, such as for building maintenance purposes. Notice should also be provided when exterior photographs are being taken so that tenants can take precautions to not have personal information collected. This may include closing blinds or ensuring children are not playing outside at the time the photographs will be taken, for example.

Using Personal Information

How can a landlord use the personal information collected from a tenant?

Landlords may only use tenants’ personal information for the purposes the tenant was notified about when the tenant consented to the collection of their personal information (section 16).

If the landlord wants to use the information for another purpose, the landlord must first seek the consent of the tenant. The new purpose must still be reasonable for the landlord-tenant relationship.

Example A landlord obtained consent from several building tenants to collect and use their email addresses in order to send monthly newsletters about tenancy matters. The landlord later used those same email addresses to send marketing emails promoting a different business the landlord operates. Using the tenants’ contact information for marketing purposes is not consistent with the purpose for collection and is not in compliance with PIPA.

 

Example A landlord wants to put the names of tenants on lobby mailboxes and buzzer panels. The landlord asks tenants for their consent since this represents a use and disclosure of names for a new purpose. For future tenants, the landlord places a checkbox on lease agreements for new tenants to indicate whether they want their names posted on lobby mailboxes and buzzer panels. The landlord simply prints “occupant” for those who have opted out. This landlord acted in compliance with PIPA.

 

Are there circumstances where a landlord does not need consent to use a tenant’s personal information, including to collect unpaid rent?

There are certain circumstances where landlords would not need consent (section 17). These circumstances include when:

• it is clearly in the interests of the tenant and timely consent cannot be obtained or the individual would not reasonably be expected to withhold consent;
• another statute or regulation requires the use of a tenant’s personal information;
• the use is reasonable for an investigation or legal proceeding;
• it is an emergency that threatens the life, health or security of an individual or the public;
• it is to collect a debt owed to the landlord.

Even in such cases, the way in which the tenant’s personal information is used must still be reasonable. For example, landlords generally cannot use personal information and issue public notices to collect a debt where there are other actions that the landlord can take that are better suited to obtaining the payment owed (Order P2022-01).

Disclosing Personal Information

How can a landlord disclose the personal information collected from a tenant?

Landlords may only disclose tenants’ personal information for the purposes the tenant was notified about when the tenant consented to the collection of their personal information (section 19). The disclosure must also be for reasonable purposes.

If the landlord wants to disclose the information for another purpose, the landlord must first seek the consent of the tenant. The new purpose must still be reasonable. Landlords must disclose only the amount and type of personal information that is reasonably required to fulfil the purpose.

Generally, landlords require tenants’ consent to disclose their personal information to a third party. The landlord must be satisfied that the disclosure is lawful, the tenant’s consent has been obtained, and the third party requesting the tenant’s personal information has a reasonable need for it prior to disclosure.

Landlords should record instances where disclosure has occurred as tenants have a right to ask who their information has been disclosed to.

Example A landlord keeps a log sheet in each tenant’s file. On the log sheets, the landlord records each time any personal information was disclosed to a third party, with and without consent of the tenant. The landlord records what information was disclosed, who the information was disclosed to, when it was disclosed, and why it was disclosed (that is, the landlord’s authority under PIPA to disclose). When one of the landlord’s tenants submits a request to access their own personal information, the landlord attaches a copy of the tenant’s log sheet in response to the request for access. The landlord keeps tenants’ files in a locked office file cabinet and securely destroys the information once it is no longer needed.

Are there circumstances where a landlord does not need consent to disclose a tenant’s personal information?

PIPA specifies certain circumstances where landlords would not need a tenant’s consent to disclose the tenant’s personal information (section 20). These circumstances include when:

• it is clearly in the interests of the tenant and timely consent cannot be obtained or the individual would not reasonably be expected to withhold consent;
• disclosure is required by another Alberta or federal law;
• disclosure is to a public body who must lawfully collect it;
• an emergency threatens the life, health or security of an individual or the public;
• it is being disclosed to next of kin in the event of death;
• disclosure is necessary for the landlord to collect a debt owed by the tenant.

Even in these circumstances, disclose only the amount and type of personal information that is reasonably required to fulfil the purpose.

Can a landlord disclose a tenant’s personal information to a debt collection agency?

It depends.

With respect to disclosing a tenant’s personal information to a debt collection agency when the collection agency is collecting a debt on behalf of another organization, landlords must have a tenant’s consent. Even with consent, landlords should ensure that only the personal information necessary to collect the debt is provided to the debt collection agency.

With respect to disclosing a tenant’s personal information to a debt collection agency for the landlord’s own purpose of collecting a debt from a tenant with outstanding payments, it may be reasonable for landlords to provide to the debt collection agency only the personal information necessary to collect the debt (section 20(i)) (P2007-IR-002).

Can a landlord disclose personal information of a tenant without consent to law enforcement?

PIPA authorizes landlords to disclose personal information without consent to law enforcement in Canada for the purposes of an investigation (section 20(f)). PIPA also authorizes disclosure of personal information without consent when disclosing the personal information to comply with a subpoena, warrant or court order (section 20(e)).

If a law enforcement agency makes a request for a tenant’s personal information, the landlord should request that the agency put the request in writing and include its statutory authority to require the personal information. This includes, for example, law enforcement requests for access to video surveillance footage.

Can a landlord disclose a tenant’s personal information to another tenant without consent?

Landlords would likely not be able to disclose personal information about one tenant to another as consent would be required, and landlords must collect, use and disclose personal information only for reasonable business purposes.

There may be circumstances, such as in a serious emergency that threatens the life, health or security of an individual or the public, where disclosure of one tenant’s personal information to another tenant without consent would be permissible (section 20(g)).

Landlords should make every effort to protect the privacy of their tenants and prevent disclosure of their personal information.

Example A tenant’s neighbour plays loud music most nights. The tenant contacts the landlord to make a complaint. In speaking to the neighbour about this matter, the landlord improperly discloses who made the complaint. Providing the identity of the complainant is not necessary or reasonable in this situation. The landlord can speak to the neighbour about the complaint without disclosing the identity of the complainant.

 

Can a landlord post a notice with personal information of a tenant on a door or elsewhere in a residential property?

Landlords can post a notice with personal information only if other attempts to deliver the notice failed. The Residential Tenancies Act requires the landlord to first attempt to deliver the notice personally, by registered mail, or by certified mail (section 57(1) of the Residential Tenancies Act).

The OIPC has reviewed a situation where a landlord has posted eviction notices or notices of payments that are past due on public bulletin boards in a shared space or by posting a notice outward facing on a tenant’s door (Order P2022-01). Generally, landlords need the consent of tenants to disclose personal information in these ways. Specifically, with respect to posting an eviction notice outward facing on a tenant’s door, the disclosure of personal information for such purposes is not reasonable (Order P2016-06). Instead, landlords may fold such a notice in half, or post it to the door inward facing. While section 72(2)(b) of the Condominium Property Act may authorize such a disclosure, PIPA does not.

Example A landlord has a tenant who is behind on payments. Several reminders and notices to pay have been sent by the landlord to the tenant. After several failed attempts to recover the payments, the landlord posts a notice on a bulletin board inside the entrance of the condo complex that is viewable to everyone coming in the door. The notice says that the tenant is behind on their payments. The posting of this notice to collect a debt owed would not be permitted under PIPA (Order P2022-01).

 

Can a landlord post a tenant’s name next to a buzzer or on a mailbox?

If a landlord has a tenant’s consent to post their name on mailboxes or next to buzzers, then it is reasonable to do so (Order P2012-11). Alternatively, the landlord may give tenants notice of their intention to post this information and ask them to opt out if they do not want their names used in this way.

Landlords should not disclose tenants’ phone numbers or other contact information without obtaining their consent.

Social Media

Can a landlord collect personal information of a tenant without consent through social media?

Generally, landlords must obtain consent from a tenant before collecting personal information about them, including from social media sites. Landlords must consider whether the information they require could not be obtained from a more traditional source, such as reference checks.

Landlords viewing personal information about a tenant on social media would be considered a collection of personal information and, as such, must be done in compliance with PIPA. (See section on Collection of Personal Information).

It is a misconception that information on social media is “publicly available”. Social media information is not publicly available information under PIPA (PIPA Regulation, section 7).

Several privacy issues arise when collecting personal information through social media, even with consent. Examples include the following.

• Landlords have no ability to control the amount of personal information collected via internet searches which may result in collecting too much or irrelevant personal information (sections 11(1) and 11(2)).
• Landlords may inadvertently collect third party personal information without consent.
• It is difficult to assess the accuracy of information through some internet searches.

Tenant Screening Service Providers

Can a landlord use a tenant screening service provider to collect or disclose information about a tenant?

Landlords should exercise caution when collecting or disclosing information via a third party service provider. A landlord cannot collect personal information about a tenant using a third party service when the landlord would not be authorized to collect this personal information under PIPA. Additionally, it may not be clear to the landlord from which sources a third party provider collected the information and whether the tenant consented to collection from those sources. There may also be concerns about how accurate the information is or about the collection of irrelevant or excessive amounts of information.

The landlord will be responsible for compliance with PIPA by the third party service provider. Therefore, the landlord will want to ensure the third party is meeting their obligations under PIPA, including the requirement to obtain consent from the tenant for any collection, use or disclosure of their personal information and to ensure there is a reasonable purpose for the collection, use and disclosure of this information.

Tenant screening service companies offer various services to landlords, such as credit and background checks, social media scans, and income and employment verification on tenants.  The services offered vary by agency.

Can a landlord put a tenant on a “bad tenant” list or access such a list?

Landlords should avoid disclosing information about tenants to “bad tenant” lists which may be available on social media or via other means. Landlords should also avoid accessing or using such a list to make a decision about a tenant.

The use of tenant “blacklists” to share information about tenants raise several privacy concerns under PIPA.

Among those concerns are the following.

• Landlords generally must obtain a tenant’s consent to collect, use or disclose a tenant’s personal information via social media, including for the purpose of a “bad tenant” list. Even with consent, it may be difficult to establish that the purpose is reasonable.
• Landlords must be able to verify the accuracy or currency of personal information about the tenant, which is especially challenging in an unregulated database or on a social media site.
• Tenants have a right to request access to their own personal information and to request to have their personal information corrected, and the existence of such lists is often unknown to tenants, limiting tenants’ ability to exercise their privacy rights.

The Office of the Privacy Commissioner of Canada has found under the federal private sector privacy law that landlords do not have the right to disclose information such as poor payment history to a “bad tenants” list (OPC PIPEDA Report of Findings #2016-002). The OIPC has found in a separate matter that an organization required an individual’s consent prior to posting the individual’s information in a database that was made available to third parties, and that the organization did not establish that the collection, use and disclosure of the individual’s personal information was only for reasonable purposes (Order P2013-01).

Video Surveillance

Can a landlord install video surveillance in a building?

Landlords can install video surveillance in the common areas of buildings only for reasonable purposes. For example, landlords may install video surveillance to deter vandalism or promote safety and security in buildings.

Landlords must provide adequate notice to tenants and visitors that the premises are monitored by video surveillance and include the purpose for the surveillance system (section 13). This is most often done by posting signs indicating that there is video surveillance being used on the premises.

Personal information must only be collected, used or disclosed for the stated purpose, such as to deter vandalism or promote safety and security (section 8(4)). Similarly, video footage should be secured and access limited to authorized individuals (Order P2012-11 and Order P2016-02). Footage should only be retained as long as reasonably required for the stated purpose.

When implementing a video surveillance system, landlords should develop a policy setting out how footage will be used, who has access, the purposes for which it may be used and disclosed, and how long recordings will be retained. The policy should also be made available to tenants, upon request. (See Video Surveillance in the Private Sector guidance. Note that this guidance also applies to video surveillance used by landlords for residential properties).

Example A landlord experiences a number of thefts and attempted break-ins. The landlord decides to install security cameras in public locations around the building. The landlord obtains a video system and drafts a policy. The system records over itself every 7 days. The recordings are stored in a cloud service hosted by a third party service provider. Access to recordings is limited to the landlord and certain staff; recordings are only examined if a security incident is suspected. If required, the recording is only disclosed to police. The landlord distributes a notice to his tenants outlining the various aspects of the video surveillance system. The landlord also posts signs around the building explaining there is video surveillance for security reasons, and the landlord’s contact information is provided on the signs in case of any questions.

Accuracy and Retention of Personal Information

Is a landlord required to ensure the accuracy of a tenant’s personal information?

Landlords must make reasonable efforts to ensure that the personal information they collect, use or disclose about a tenant is accurate (section 33). For example, landlords must provide accurate debt information about a tenant to a collection agency in order to collect on a debt owed to the landlord (Investigation Report P2007-IR-02).

Tenants should also ensure they update any information required by landlords to manage the tenancy, such as changes to contact information.

How long should a landlord keep or retain a tenant’s personal information?

Landlords should keep the information only for as long as it is reasonably required for legal or business purposes (section 35).

Once a tenant moves out, any information that the landlord no longer has a reasonable need for should be securely destroyed and rendered non-identifying. There would be no need to keep documents such as tenants’ credit reports or tenancy applications once the tenant moves out, whereas records of rent payment may require a longer retention period for business tax purposes.

Good retention and disposal policies reduce the amount of personal information that landlords have to safeguard, which decreases the risk of a privacy breach.

Securing Personal Information

What are a landlord’s requirements for safeguarding a tenant’s personal information?

Landlords must make reasonable efforts to secure personal information to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal of personal information, or similar risks (section 34).

For paper records, landlords should ensure that information is locked in a filing cabinet or otherwise safely secured. For electronic documents, there should be strict access controls, such as encryption for secure storage and complex passwords. Personal information must not be accessible to unauthorized third parties, such as cleaning staff or administrative staff who have no need to access the personal information at issue. (See the OIPC’s self-assessment tool for securing personal information under PIPA.)

What should a landlord do if there is a breach of a tenant’s personal information?

If there is a breach of a tenant’s personal information, the landlord should follow four key steps in responding to privacy breaches:

1. Contain the breach.
2. Evaluate the risks associated with the breach.
3. Notify affected individuals and report the breach to the OIPC, if required.
4. Take steps to prevent similar incidents from occurring in the future.

A breach means a loss of, unauthorized access to, or unauthorized disclosure of personal information. A breach can be caused by external sources, such as hacking into a computer, or internal, such as sending an email containing personal information to the wrong person.

Under PIPA, if a landlord experiences a loss of, unauthorized access to or disclosure of personal information where a reasonable person (assessed objectively) would consider that that there is a real risk of significant harm to the individual(s) affected, the landlord is required to notify the affected individual(s) about the breach and report the breach to the OIPC (section 34.1; PIPA Regulation sections 19 & 19.1).

The following are landlord-tenant examples of breaches of personal information where it has been found that there was a real risk of significant harm to the affected individuals.

• A property management company forwarded a tenant’s personal information to a third party contractor via email resulting in an unauthorized disclosure of personal information (Breach Notification Decision P2017-ND-066).
• A data security breach where there was unauthorized access to an organization’s systems by a malicious third party (Breach Notification Decision P2021-ND-295).

Alberta Human Rights Act

Can a landlord collect or use personal information protected under the Alberta Human Rights Act?

A landlord collecting and using personal information that is protected under the Alberta Human Rights Act (AHRA) is usually not a purpose that a reasonable person would consider appropriate in the circumstances and the collection and use would not be authorized under PIPA.

AHRA protects individuals from discrimination in certain areas based on specific personal characteristics known as “protected grounds”. Section 5 of AHRA prohibits discrimination in tenancy on the basis of race, religious beliefs, colour, gender, gender identity, gender expression, physical disability, mental disability, age (with specified exceptions), ancestry, place of origin, marital status, source of income, family status or sexual orientation.

For more information, see the Alberta Human Rights Commission website, in particular the section on Residential and Commercial Tenancy.

Tenant Rights

Does a tenant have a right to request access or correction to their personal information from a landlord? How long does the landlord have to respond to the request?

A tenant has a right to:

• Request access to their own personal information that is held by landlords (section 24(1)(a)). When requesting access to their own personal information, a tenant may request a copy of the records or examine the record on site (section 26(2)).
• Request access to information about the landlord’s use or disclosure of their own personal information (section 24(1)(b)).
• Request correction of an error or omission in their own personal information that is held by landlords (section 25).

The access or correction request must be in writing. However, a disability may be accommodated through other means. The landlord must respond to a tenant’s request to access or correct personal information within 45 days. The response to the request must be provided to the tenant within 45 days. If the landlord asks the tenant questions to help the landlord conduct a search for records, the landlord still must respond within that 45-day period (but the time limit can be extended).

When responding to a tenant’s request to access their own personal information, is a landlord required to give the tenant everything they have about the tenant? Are there any exceptions?

There are some exceptions to accessing personal information.

First, landlords must ensure that the request is for the tenant’s own personal information. Personal information is limited to information “about” an individual and has a personal dimension. Examples of information that may be related to a landlord-tenant relationship but would not generally be considered personal information under PIPA include:

• receipts and invoices for repairs or cleaning services;
• warranty claims on a property; and
• blueprints or architectural drawings of a unit.

Second, once the landlord determines that the tenant has requested access only to their own personal information, then exceptions to disclosure must be considered.

Landlords may refuse to provide access to personal information for reasons including when it is protected by legal privilege, is confidential or proprietary, was collected by the landlord for an investigation or a judicial or quasi-judicial legal proceeding, or for other factors listed in section 24(2).

Landlords must refuse to provide access to personal information that would threaten someone’s life or security, would reveal someone else’s personal information, or would reveal the identity of someone who gave a confidential opinion (section 24(3)).

When an exception to access applies to the personal information, landlords should make reasonable efforts to redact, sever or “blackout” the information (sections 24(1.1)). If a landlord is going to sever information before providing a response to a tenant, the landlord must cite the exception or section of PIPA to describe the reason for redacting the information. In other words, tell the tenant why the information has been removed and what section of PIPA applies to the removal of that information (section 29(1)).

If a tenant is dissatisfied with the response to their access request, they may request a review by the OIPC. The OIPC reviews the response to see, for example, if the exceptions to access were properly applied by the landlord.

If a landlord receives a complaint letter about a tenant, can the tenant ask to see the complaint?

Tenants may request access to the complaint letter by following the access provisions of PIPA (sections 24(1), 26(1)). However, the landlord must redact or sever the name of the complainant from the letter before providing a copy to the tenant (section 24(3)(c)). The landlord must also sever any other personal information that does not belong to the tenant requesting the letter, and any other information that could help to identify the complainant or another third party.

If after redacting or severing personal information, it would still be apparent who the complainant is, the landlord should not provide the letter to the tenant (section 24(3)(c)). Access must also be denied if it would result in safety or security concerns (section 24(3)(a)). Access may be granted, however, if the complainant has consented to the disclosure of their complaint to the tenant who is the subject of the complaint.

Can a landlord charge a fee to a tenant who is requesting access to their own personal information?

Landlords have the ability to charge a fee if someone requests access to their personal information (section 32). The fee should be reasonable and aligned with the costs incurred, such as photocopying and the time spent responding to the request.

If a landlord requires a fee from the tenant to process an access request, the landlord must give a written estimate of the cost before responding (section 32(3)). A tenant can request that the OIPC review the fee estimate.

Fees may only be charged to a tenant who requests access to their own personal information.

Can a tenant make a privacy complaint against a landlord?

A tenant who has a concern that the landlord may not have authority to collect, use or disclose personal information, or is failing to adequately protect it, should try to resolve the matter with the landlord. If the matter is not resolved, the tenant may make a privacy complaint to the OIPC.

December 2023

 

Disclaimer

This guidance is intended to assist organizations and the public in understanding access and privacy legislation in Alberta. This document is not intended as, nor is it a substitute for, legal advice, and is not binding on the Information and Privacy Commissioner of Alberta. Responsibility for compliance with the law (and any applicable professional or trade standards or requirements) remains with each organization, custodian or public body. All examples used are provided as illustrations only. The official versions of the Freedom of Information and Protection of Privacy Act, Health Information Act and Personal Information Protection Act and their associated regulations should be consulted for the exact wording and for all purposes of interpreting and applying the legislation. The Acts are available on the website of Alberta King’s Printer.