Consent at the Point of Collection: What to Say, and When

The duty, and where it actually bites

Three Acts say the same thing in slightly different words: tell people what you are collecting and why, at the moment you collect it.

PIPEDA clause 4.2 requires the purposes to be identified "at or before the time the information is collected". BC PIPA s.10(1) requires the organization, on or before collecting, to disclose the purposes. Alberta PIPA s.13(1) requires notification, in writing or orally, of the purposes and of who can answer questions.

The point everyone misses is the timing. A privacy policy published on your website is a different duty, under PIPEDA clause 4.8, and it is about openness. It does not discharge this one, because this one is about what the person in front of you knows while they are handing something over.

So the question is not "do we have a privacy policy". It is: at every point a person gives you information, does something tell them why.

---

Alberta asks for one more thing

This is the single most useful line in the guide for a business operating in Alberta.

Alberta PIPA s.13(1)(b) requires the notice to give "the name or position name or title of a person who is able to answer on behalf of the organization the individual's questions about the collection".

Neither the federal Act nor BC PIPA requires that at the point of collection. The practical consequence is one line of text:

We collect this to book and manage your appointment. Questions about how we handle it go to the Practice Manager at [email].

A business in more than one province should write to the Alberta rule everywhere. It is shorter than maintaining two versions of a form.

---

Where the notice goes

Work through the places a person gives you something. Each one needs its own answer, and most need one sentence rather than a paragraph.

Forms, on paper or on a screen. A line under the fields, not a link. If it needs a click to read, it is a policy, not a notice.

The counter or the phone. Oral notice is allowed in both provinces and under the federal Act. What matters is that staff actually say it, which makes it a training matter rather than a drafting one.

A booking or ordering system you bought. Most allow a custom line at the point of capture, and most ship with it blank.

Anything that collects without a person noticing. Cameras, a location feature on a work vehicle, website analytics, a call recording notice. These are the ones where the notice is the only thing the person will ever see.

Collecting about staff. In Alberta and BC this runs on a separate track, and it is covered below.

---

Express or implied, and when it matters

Implied consent is real and it carries a lot of ordinary business. Somebody hands you a delivery address so you can deliver to it; no tick box is needed or sensible.

The joint guidance from the federal, Alberta and BC commissioners on meaningful consent sets out when that stops being enough. Use express consent where the information is sensitive, where the use is outside what the person would reasonably expect, or where there is a meaningful risk of harm. Health information is the clearest case.

Two traps worth naming.

Consent as a condition of service. Alberta PIPA s.7(2) says an organization shall not, as a condition of supplying a product or service, require consent beyond what is necessary to provide it. Bundling a marketing opt-in into a purchase is the common version.

A purpose you thought of later. PIPEDA clause 4.2.4 requires a new purpose to be identified before you use the information for it, and consent for that new purpose unless the law requires the use. Clause 4.5.1 requires it to be documented. Using the customer list you built for orders to send marketing is the everyday example, and CASL sits on top of that one as well.

---

Staff information runs on its own track

Both provincial Acts let an employer collect, use and disclose employee personal information without consent, where it is reasonable for managing the employment relationship. Both then require the person to be told first.

That second half is where businesses stop reading, and it is the half that makes the first half lawful.

BC PIPA s.13(3), s.16(3) and s.19(3) require notification of the collection, use or disclosure and the purposes, before it happens. The duty is owed to the individual, which reaches job applicants and people who have left.

Alberta PIPA s.15(1)(c) and s.18(1)(c) require reasonable notification to a current employee before collecting or using, and the notice is drafted as a condition of the exemption rather than a free-standing duty.

The federal Act reaches employee information only for a federal work or undertaking, so for most businesses this is a provincial question.

Written once in an offer letter or a staff handbook, dated, it covers the ordinary cases. Monitoring is the one people forget: cameras, vehicle tracking and anything logging what staff do are all collection, and all need the notice first.

---

Withdrawing consent

The duty most often missed at the other end of the relationship.

All three Acts require you to tell somebody what withdrawing will mean for them. PIPEDA clause 4.3.8 says the organization shall inform the individual of the implications of the withdrawal. Alberta PIPA s.9(2) and BC PIPA s.9(2) require the likely consequences.

Alberta alone allows you to skip it. Section 9(3) excuses the notice where the consequence would be reasonably obvious to the person. BC and the federal Act have no such exception, so a business in more than one place should simply always say.

The duty starts when they ask, not before, and the tone is factual rather than discouraging. You may explain a consequence. You may not use it to talk somebody out of it.

---

Related guides

• Building a privacy program: what to do first. Where this step sits in the order
• How to Write a Privacy Policy. The separate duty this one is often confused with
• Personal Information Inventory. The list of places that each need a notice
• Legitimate Interest Under Bill C-36. The exception that is coming, and what it would change