Alberta PIPA and document control software for Calgary energy firms: what to check

What to take away

Why a document control tool is a privacy tool

An energy company's document control system manages drawings, procedures, permits, contracts and revision history. Most of that content is technical. Around it sits personal information: names and phone numbers on contractor sign-in sheets, certificates and training records for field staff, incident and near-miss reports that name people, and landowner correspondence.

Alberta.ca describes PIPA as the province's private-sector privacy law. It covers provincially regulated private-sector organizations and businesses, and in some cases non-profit organizations. Public bodies fall under separate access and privacy statutes. A Calgary firm that is itself federally regulated, such as a pipeline operator under federal jurisdiction, is a different case, and counsel should confirm which law applies. The site's overview of PIPEDA and the Ontario, BC and Alberta rules for software buyers compares the regimes side by side.

The Office of the Privacy Commissioner of Canada says that where a substantially similar provincial law applies, that law applies instead of PIPEDA, and the exemption covers collection, use or disclosure occurring within the province. Document control vendors often host outside Alberta, so flows that cross a provincial or national border are worth raising with counsel rather than assuming one statute covers everything.

Check 1: What personal information will the system hold?

Start with an inventory. List the document types you plan to load and mark those containing personal information. Typical items in an energy setting:

PIPA allows collecting, using and disclosing personal employee information without consent for reasonable purposes tied to establishing, managing or ending an employment relationship, but current employees must receive reasonable notice stating the purposes. Information about other people, such as landowners, generally needs consent, which can be verbal, written, electronic or implied, unless an exception applies. Use is limited to the purposes stated in the notice.

If a new feature, such as automated tagging or analytics on the document archive, uses information for a purpose not in the notice, treat it as a new use and review it before you switch it on.

Check 2: Where is the data hosted, and who supports it?

Alberta.ca guidance on protecting personal information says that where a service provider outside Canada collects personal information, or information is transferred to one, the organization's policies must name the country where processing occurs or may occur and the purposes the provider is authorized for. The organization must also notify individuals, in writing or orally, about how to access the relevant policies and who can answer questions about the provider.

For document control software this means asking the vendor, in writing:

Put the answers in the contract and in your own privacy policy. The article on checking Canadian data residency claims shows how to test a vendor's claims instead of accepting a marketing line. If your team shares files with US partners, the guide for cross-border teams moving files covers the transfer side.

Check 3: Security measures that match the sensitivity

The Alberta guidance says organizations must take reasonable security measures against unauthorized access, and that security should be appropriate to the sensitivity of the information. It lists physical, technological and administrative safeguards, such as locked doors, password protection, encryption, confidentiality agreements and IT terms of use.

In a document control product, look for:

Compare these against the file sharing security checklist, since many document control tools share the same weak points as general file sharing: broad links, old accounts and unmanaged guest users.

Check 4: Retention, deletion and records that must be kept

PIPA expects personal information to be kept as accurate as is reasonable for its purpose, kept only while needed for business or legal purposes, and then securely destroyed or made anonymous. Document control creates tension here because engineering and regulatory records often have long retention periods, while personal information inside them may not.

Ask the vendor:

Set your retention schedule first, then test that the tool can enforce it. A product that only archives forever leaves you holding personal information with no purpose.

Check 5: Breach duties and the vendor contract

Under the Alberta guidance, if a breach creates a real risk of significant harm, the organization must notify the OIPC, even if only one individual is at risk. The report must be in writing and include the circumstances, the information involved, a harm assessment, the estimated number of people affected, and a contact person. The OIPC may also require notice to affected individuals.

The organization that holds the information carries that duty, so your contract needs terms that let you meet it:

The guidance also says policies should be available in writing on request and cover breach management, breach notification, access requests and complaints. Align your internal breach procedure with the vendor's, so both teams use the same steps.

Check 6: Access requests and administration

PIPA gives individuals a right to access their own personal information. A document archive that cannot be searched by person makes that hard. Test it: ask the vendor to demonstrate how you would find every document that names a given employee, and how you would restrict the output to what the individual is entitled to see.

Also check how the tool handles departing employees. Their accounts, comments and signatures stay in the revision history, and you will need a policy on what is kept and what is removed.

Questions to put in writing before you sign

Keep the vendor's replies with the contract. When you review the tool each year, repeat the questions and compare the answers.

This article is general information, not legal advice. Statutes and guidance change, so confirm current text with the Alberta government and the OIPC, and ask counsel how PIPA or PIPEDA applies to your business.

Official sources