The fourth principle of the 10 Privacy Principles of PIPEDA is Limiting Collection.
Information Handling Policies and Procedures
An organization’s privacy officer or person(s) responsible for privacy compliance should create information handling policies and procedures and specify what type of personal information is collected. This works in tandem with the Openness principle.
Fair and Lawful Means
An organization must collect personal information by fair and lawful means. Whether collecting personal information in-person, on the phone, or through an application form, an organization shall identify the purposes for doing so, obtain proper consent, and do so in such a way that is clear and straight-forward.
An organization may not use deception, trickery, or ambiguity to construe the purposes for which personal information is used.