PIPEDA — Personal Information Protection and Electronic Documents Act

PIPEDA Principle 5 — retention and destruction

Principle 5 of Schedule 1 to PIPEDA requires organisations to retain personal information only as long as necessary to fulfil the identified purposes, and to destroy or render anonymous personal information when those purposes are fulfilled. For retired enterprise IT containing personal data, this translates to: (1) identification of personal-data-bearing assets at retirement; (2) sanitisation method appropriate to the medium and the data sensitivity; (3) documentation that demonstrates the personal information has been destroyed; (4) retention of that documentation. Maxicom certificates evidence each step.

PIPEDA Principle 7 — safeguards in transit

Principle 7 requires safeguards appropriate to the sensitivity of the information, including security against loss, theft, or unauthorised access during transfer. For ITAD specifically, this means chain-of-custody discipline during pickup and transit. Maxicom protocol: signed manifest at every transfer, GPS-tracked vehicles, tamper-evident sealed containers on top-classified loads, no unsigned hand-off windows.

OPC enforcement and breach reporting

The Office of the Privacy Commissioner can investigate complaints, conduct audits, and recommend remediation. Mandatory breach reporting under PIPEDA (since November 2018) requires reporting breaches that pose a "real risk of significant harm" to affected individuals. ITAD-related breaches in scope: theft of data-bearing media in transit, unauthorised disclosure from retired assets. Maxicom's incident-response playbook supports the customer's OPC reporting workflow.

PIPEDA reform and Bill C-27

Bill C-27 (the Digital Charter Implementation Act 2022, working through Parliament as of 2026) would replace PIPEDA with the Consumer Privacy Protection Act (CPPA) and create a new Personal Information and Data Protection Tribunal. The CPPA strengthens consent, establishes new individual rights, and significantly increases penalties (up to 5% of global revenue or $25M, whichever is higher). For ITAD, the operational obligations remain similar but the cost of failure rises. Maxicom certificates are designed to remain admissible under both PIPEDA and the future CPPA framework.

Provincial privacy laws — substantially similar

Quebec (Loi 25, formerly Bill 64), Alberta (PIPA), and British Columbia (PIPA) have substantially-similar private-sector privacy laws that displace PIPEDA for activities within those provinces. Quebec Law 25 is the strictest of the three. Maxicom certificates are written to satisfy PIPEDA + the relevant provincial law simultaneously.