Can a company share my personal information with third parties without telling me?

What the Law Says

Canada’s main federal privacy law for the private sector — the Personal Information Protection and Electronic Documents Act (PIPEDA) — sets strict rules about when and how organizations can share your personal information with third parties.

Organizations must follow the 10 privacy principles in Schedule 1 of PIPEDA — known as the CSA Model Code for the Protection of Personal Information. These include accountability, identifying purposes, consent, limiting collection, and disclosure restrictions.

Consent is central: under section 6.1, consent is only valid if it is reasonable to expect that you understand the nature, purpose, and consequences of the disclosure. This means vague or buried language in a long privacy policy is not enough — the organization must make the sharing clear and meaningful.

Section 5 reinforces this by requiring organizations to comply fully with all obligations in Schedule 1. That includes Principle 4.3 (‘Consent’), which states that ‘the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.’ Sharing with third parties almost always requires express consent.

Statutory Text

Organizations must comply with the obligations set out in Schedule 1 (the CSA Model Code for the Protection of Personal Information).

— Personal Information Protection and Electronic Documents Act, s. 5 — Compliance with obligations

Statutory Text

Consent is only valid if it is reasonable to expect the individual to understand the nature, purpose and consequences of the collection, use or disclosure.

— Personal Information Protection and Electronic Documents Act, s. 6.1 — Valid consent

What to Do

Sources