Summary
"Principle 5 of the Personal Information Protection and Electronic Documents Act (PIPEDA) states that "personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information." Moreover, Paragraph 4.7.5 specifies that care shall be used in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information.
When it comes to federal institutions, Section 6 of the Privacy Act provides that "personal information that has been used by a government institution for an administrative purpose shall be retained by the institution for such period of time after it is so used as may be prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the information." Moreover, an institution "shall dispose of personal information under the control of the institution in accordance with the regulations and in accordance with any directives or guidelines issued by the designated minister in relation to the disposal of that information."
The Office of the Privacy Commissioner of Canada (OPC) has developed these guidelines to assist organizations in developing and implementing smart retention and disposal practices related to the handling of personal information.
Federal institutions are encouraged to adapt these guidelines with adjustments appropriate to their specific situation."--Page 1.