This is an area that I think causes a potential problem. If it's not subject to the Privacy Act, the question then would be whether or not it fell under the Personal Information Protection Electronic Documents Act. In essence, this act is the private sector form of privacy legislation, which regulates the trade and commerce in personal information. It's very different from the Privacy Act. The Access to Information Act works hand in glove with the Privacy Act, in that the Access to Information Act has an exemption within it for requests from any individual if that request would require the foundation to disclose personal information, as defined by the Privacy Act.
The definition of personal information in the Privacy Act is different from that under PIPEDA.