Rules
PIPEDA dashboard compliance metrics for Canadian insurers
PIPEDA dashboard compliance metrics for insurers track consent withdrawal, 24-month breach logs and Quebec's Law 25 add-ons. What each regulator expects.
What to take away
- Canadian insurers answer to the Office of the Privacy Commissioner under PIPEDA, and to provincial regulators in Alberta, British Columbia and Quebec.
- A consent dashboard earns its name only when it carries the purpose, the date and the record behind every consent and every withdrawal.
- Breach records are kept for 24 months whether or not the breach was reported.
- Quebec's Law 25 adds a named privacy officer, retention schedules and privacy impact assessments.
- Weak records lead to an OPC application to Federal Court, where compliance orders and damages can follow.
- A metric block needs consent rate by purpose, withdrawal-to-system propagation rate and breach log age bands.
An insurance dashboard that counts consent withdrawals but cannot produce the record behind each one fails the first test a regulator applies.
Who holds jurisdiction over an insurer dashboard
Under the Personal Information Protection and Electronic Documents Act, private-sector organizations that handle personal information in commercial activity must follow federal rules. That covers insurers in provinces where no substantially similar law exists.
Alberta's Personal Information Protection Act and British Columbia's PIPA hold substantially similar status, so the provincial commissioner leads there. Quebec's Law 25 amended its private-sector statute, which puts the Commission d'acces a l'information in charge of a stricter set of duties for any insurer writing policies in the province.
A privacy officer usually starts with the same dashboards questions about scope and ownership.
What a compliant consent dashboard must disclose
A compliant consent record names the purpose of collection, the date consent was given, the version of the notice the person saw, and the channel used. It logs withdrawal in the same detail, because withdrawal is a right under PIPEDA. The OPC publishes compliance help on what meaningful consent requires in practice.
The insurer must also state how to reach its privacy officer, what it does with the information, who it shares it with, and how long it keeps it.
A withdrawal that is logged but never reaches the pricing model is still a withdrawal.
Metric definitions for a PIPEDA dashboard
A consent rate by purpose = consents held for that purpose divided by people contacted for that purpose, expressed as a percentage. Report it per purpose, not as one blended figure.
Withdrawal-to-system propagation rate = withdrawals that reached every named downstream system divided by withdrawals logged, expressed as a percentage. A typical target is 100 percent within one business day. A withdrawal rate on a life and health book typically runs in the low single digits per year, but the propagation rate is the number that decides an investigation.
Breach log age bands = open breach records grouped by days since discovery: 0 to 7, 8 to 30, 31 to 90, and over 90. Federal rules expect a report to the OPC and to affected people as soon as feasible after the breach is determined. The 24-month retention clock runs from discovery, not from the report.
A sample field list for one panel:
Metric definitions
- consent_id, purpose_code, notice_version, consent_date, channel
- withdrawal_id, withdrawal_date, channel, downstream_system_code, propagation_date
- breach_id, discovery_date, risk_score, report_date, affected_count
- retention_reason_code, retention_end_date
- jurisdiction_code on every row
Records to keep, and for how long
- Consent recordspurpose, date, notice version, channel.
- Withdrawal recordsdate, channel, and each system that stopped using the data.
- Breach recordsevery breach, reported to the OPC as soon as feasible where there is a real risk of significant harm, and kept for 24 months from discovery.
- Retention schedulesthe stated reason each data set is still held.
- Access requests and the date each one was answered.
PIPEDA sets no single retention period. It requires that personal information be kept only as long as needed for the stated purpose, then destroyed. A retention panel should therefore show age bands against purpose, not one global expiry date.
Alberta aligns breach record keeping with the federal 24 months. British Columbia's PIPA has no general mandatory breach report. Quebec adds a register of confidentiality incidents. The dashboards metrics that predict an audit finding are the age bands and the propagation rate.
Example: one dashboard, two provincial rulebooks
An insurer licensed in Alberta and Quebec runs a single consent panel for both books. In Alberta, a withdrawal logged with a date and a source may be enough. In Quebec, the same event has to feed the register of incidents where it touches a confidentiality breach, and a retention schedule has to exist before the data is collected.
Law 25 dashboard requirements add fields the federal panel does not carry. The two views are not the same reporting formats, and merging them into one figure loses the distinction.
What happens when the records fall short
The Privacy Commissioner can investigate a complaint or open an own-motion inquiry. Where an organization has not followed the Act, the Commissioner may apply to the Federal Court for an order requiring compliance and, in some cases, damages. Individuals may sue for damages after a breach of security safeguards. The OPC brief on PIPEDA sets out the statutory footing.
PIPEDA sets no fixed fine for private-sector organizations. Quebec's Law 25 allows administrative monetary penalties of up to CAD 10 million or 2 percent of worldwide turnover for the most serious breaches.
Balanced arithmetic is no defence. The failures that matter are the ones catalogued in reporting mistakes, where correct numbers still produced a wrong read. A finding that names the organization and orders a change of practice is the concrete consequence of thin records, and it outlasts the quarter it was filed in.
Where the rules differ across provinces
Canadian privacy dashboard metrics are not interchangeable across provincial lines.
Provincial Privacy Rulebooks Compared
Federal (PIPEDA)
- Breach notification
- OPC + individuals
- Breach records
- 24 months
- Extra duties
- Policy, complaint route
Alberta (PIPA)
- Breach notification
- Commissioner
- Breach records
- 24 months
- Extra duties
- Named privacy officer
British Columbia (PIPA)
- Breach notification
- No general report
- Breach records
- Not prescribed
- Extra duties
- Privacy officer, policy
Quebec (Law 25)
- Breach notification
- CAI + individuals
- Breach records
- Register of incidents
- Extra duties
- Officer, retention, assessments
Where the rules differ
Breach notification
- Federal (PIPEDA)
- Report to the OPC and notify people where there is a real risk of significant harm
- Alberta (PIPA)
- Report to the Commissioner where there is a real risk of significant harm
- British Columbia (PIPA)
- No general mandatory report
- Quebec (Law 25)
- Report to the CAI and to affected people where there is a risk of serious injury
Breach records
- Federal (PIPEDA)
- 24 months
- Alberta (PIPA)
- 24 months
- British Columbia (PIPA)
- Not prescribed
- Quebec (Law 25)
- Register of incidents
Extra duties
- Federal (PIPEDA)
- Privacy policy and complaint route
- Alberta (PIPA)
- Named privacy officer
- British Columbia (PIPA)
- Privacy officer and policy
- Quebec (Law 25)
- Privacy officer, retention schedule, impact assessments
A single national panel will not satisfy all four columns. Build it so a filter switches the rulebook, and label every field with the jurisdiction it serves. Tag every field with a jurisdiction code and a rulebook version.
A field that serves only Quebec, such as an incident register entry, returns a null for the other jurisdictions rather than a zero.
