The fourth principle of the 10 Privacy Principles of PIPEDA is Limiting Collection.
Limiting Collection
The principle of Limiting Collection states that the personal information an organization collects should only be limited to that which is necessary for the purposes identified.
Information Handling Policies and Procedures
An organization’s privacy officer or person(s) responsible for privacy compliance should create information handling policies and procedures and specify what type of personal information is collected. This works in tandem with the Openness principle.
Fair and Lawful Means
An organization must collect personal information by fair and lawful means. Whether collecting personal information in-person, on the phone, or through an application form, an organization shall identify the purposes for doing so, obtain proper consent, and do so in such a way that is clear and straight-forward.
An organization may not use deception, trickery, or ambiguity to construe the purposes for which personal information is used.
NEXT PRINCIPLE: Limiting Use, Disclosure, and Retention
BACK TO: 10 Privacy Principles of PIPEDA
