Pipeda

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), when a private entity starts collecting information on you, it has to tell you why and how they're using it, Caraway said.

A parliamentary committee has recommended parties have to comply with PIPEDA, but the government has only said it will study changing the law.

PIPEDA also requires organizations to keep records for two years on all security breaches involving personal information.