We are all living in the data age, whether we like it or not. Data is everywhere, and the collection and use of personal data is one of the most discussed legal topics of the 21^st century. There are several laws that govern personal information, imposing significant obligations on persons and businesses to collect, gather, use, and disclose information only as authorized. In turn, businesses and agencies often create their own policies to explain privacy obligations in plain language and to assist their representatives or those who fall under their jurisdiction in complying with them. 

This article discusses the laws in British Columbia around the collection and use of personal information and the ways in which BCREA’s Privacy Notice and Consent Form can help keep REALTORS® onside with personal information protection laws.  

Privacy Laws in British Columbia 

The primary law that deals with the collection, disclosure, and use of personal information in BC is the Personal Information Protection Act (PIPA). PIPA was enacted in 2003, and its stated purpose is to govern the collection, use, and disclosure of personal information in a way that balances people's right to protect their own personal information with organizations' reasonable need to collect, use, and disclose information in an appropriate way. The default is that personal information cannot be collected, used, or disclosed but the law creates carve-outs where the individual consents or the action is authorized by law.  

Though both are part of BC privacy law, PIPA is distinct from the Freedom of Information and Protection of Privacy Act (FOIPPA), which generally governs the disclosure of and access to information collected and retained by public organizations.  

Consent to the collection, use, and disclosure of personal information can be implied as opposed to express. However, implied consent is more difficult to prove and is open to interpretation, making it easier for an individual to later deny having given consent. The express consent reflected in a privacy notice or document containing privacy-related terms that is signed, initialled, or marked by the individual is more likely to meet the requirement for advance consent and, as such, is considered the better practice. Additionally, an organization must notify individuals about what information is being collected and the purpose for collection before the collection occurs. An organization cannot require individuals to consent to the collection of information over and above what is necessary to provide the requested product or service. Consent may be withdrawn at any time.  

Even if an individual has consented, personal information may only be used or disclosed for purposes that are reasonably appropriate in the circumstances and consistent with the purpose given to the individual for collecting the information.  

The BCREA Privacy Notice and Consent 

Although there are a number of privacy consent forms currently circulating, BCREA has prepared a form specifically for use in the BC real estate context. Like any other disclosure form, its ability to protect a REALTOR® from later allegations of improper collection or use of information depends, in part, on it being adequately explained at the time it is executed, ensuring that the individual understands its contents. Since PIPA requires that consent be obtained before personal information is collected, it is best practice to discuss and have the BCREA Privacy Notice and Consent Form executed before any personal information from the individual is collected. 

The BCREA Privacy Notice and Consent form addresses "primary" and "secondary" uses and disclosures of personal information. Primary uses and disclosures are required to perform real estate services, such as disclosures to the Multiple Listing Service® System or FINTRAC. Secondary uses are optional and relate to future marketing outreach for real estate or other services, or to conduct market surveys. Individuals may opt out of any of the secondary uses or disclosures by initialling the boxes provided.  

It is beyond the scope of this article to discuss the sections of the form in detail. However, some common questions are: 

1. Do you need a new form when working with a repeat client? 
   
   The best practice is to have a client sign this form whenever they start working with you on a new transaction or contract. While it is arguable that previously obtained consent continues to apply so long as it has not been withdrawn, the form is updated from time to time to keep current with changing requirements. Using a new form every time better ensures that you are complying with the most up-to-date privacy laws and regulations.  

2. What if a client refuses to sign the Privacy Notice and Consent Form? 
   
   While you may be able to rely on implied consent to collect, use, and disclose the information strictly necessary to provide the specific real estate services a client has asked you to provide, a client’s refusal to sign the privacy notice and consent form indicates heightened privacy concerns. In such cases, the client is likely particularly sensitive to collection, use, and disclosure of their information. If a client refuses to sign the form, document their concerns and speak to your managing broker or a lawyer about whether there are workable alternatives that will allow you to take on the client without increasing the risk of a privacy complaint or dispute.  

3. Do you need to have this form signed when working with an unrepresented party? 
   
   It is particularly important to have an unrepresented party sign a Privacy Notice and Consent form because you have no contractual relationship with them and, therefore, no ready ability to outline in writing the personal information collection, use, and disclosure items that allow you and your brokerage to comply with PIPA and other privacy obligations.  

4. Can the clause regarding storing personal information outside of Canada be struck out?
   
   No, that clause cannot be struck. Many of the platforms used to facilitate real estate transactions use servers that are located outside of Canada; therefore, it is not feasible to track and store personal information based on an individual's personal preference for where it is stored.  

BCREA has a Frequently Asked Questions document with more detailed information on the Privacy Notice and Consent Form. You can find it here. 

Other Privacy Notices / Consents  

The BC Financial Services Authority (BCFSA) has its own Privacy Guidelines that REALTORS® should familiarize themselves with. While these are guidelines and not strictly requirements, they will inform how BCFSA views allegations of improper collection or disclosure of personal information by those under its jurisdiction.  

The Real Estate Services Rules (the Rules) also provide for the disclosure of personal information by brokerages in certain circumstances.¹ Since these disclosures are mandated by law, consent is not required to comply with these requirements. These changes came into effect in February 2024, so managing brokers should familiarize themselves with these relatively recent changes if they have not already done so. Other references to personal information in the Rules include a requirement that provisions respecting the use and disclosure of personal information be included in a service agreement with the client² and that provisions regarding the personal information of strata owners be specifically addressed in a strata management services agreement.³ 

Finally, the province has an Office of the Information and Privacy Commissioner for BC (OIPC), which independently oversees and enforces BC's privacy laws and access to public information. The OIPC investigates and resolves privacy complaints and educates the public on their privacy rights. Its website provides additional information about the OIPC's mandate and the BC privacy regime in general.  

While collecting personal information is necessary for REALTORS® to do their job, it is important to know both the limits on its collection, use, and disclosure, and how to stay onside of the privacy protections we are all entitled to in this data-crazy world.

---

	1.	Rules, p. 8 (d,4).
	2.	Rules, s. 43(4)(h).
	3.	Rules, s. 43(6)(g).

To subscribe to receive BCREA publications such as this one, or to update your email address or current subscriptions, click here.

Without limiting the Terms of Use applicable to your use of BCREA's website and the information contained thereon, the information contained in BCREA’s Legally Speaking publications is prepared by external third-party contributors and provided for general informational purposes only. The information in BCREA’s Legally Speaking publications should not be considered legal advice, and BCREA does not intend for it to amount to advice on which you should rely. You should not, in any circumstances, rely on the legal information without first consulting with your lawyer about its accuracy and applicability. BCREA makes no representation about and has no responsibility to you or any other person for the accuracy, reliability or timeliness of the information supplied by any external third-party contributors.