[LadyMischief]

Here are some of the obligations under PIPA for businesses and organization who collect personal information:

Your responsibilities

* Comply with all 10 of the principles of Schedule 1.
* Appoint an individual (or individuals) to be responsible for your organization's compliance.
* Protect all personal information held by your organization or transferred to a third party for processing.
* Develop and implement personal information policies and practices.

How to fulfil these responsibilities

* Give your designated privacy official senior management support and the authority to intervene on privacy issues relating to any of your organization's operations.
* Communicate the name or title of this individual internally and externally (e.g. on Web sites and in publications).
* Analyze all personal information handling practices including ongoing activities and new initiatives, using the following checklist to ensure that they meet fair information practices:
o What personal information do we collect?
o Why do we collect it?
o How do we collect it?
o What do we use it for?
o Where do we keep it?
o How is it secured?
o Who has access to or uses it?
o To whom is it disclosed?
o When is it disposed of?
* Develop and implement policies and procedures to protect personal information:
o define the purposes of its collection
o obtain consent
o limit its collection, use and disclosure
o ensure information is correct, complete and current
o ensure adequate security measures
o develop or update a retention and destruction timetable
o process access requests
o respond to inquiries and complaints
* Include a privacy protection clause in contracts to guarantee that the third party provides the same level of protection as your organization does.
* Inform and train staff on privacy policies and procedures.
* Make information available explaining these policies and procedures to customers (e.g. in brochures and on Web sites).

When transferring personal information to third parties, ensure that they:

* Name a person to handle all privacy aspects of the contract.
* Limit use of the personal information to the purposes specified to fulfil the contract.
* Limit disclosure of the information to what is authorized by your organization or required by law.
* Refer any people looking for access to their personal information to your organization.
* Return or dispose of the transferred information upon completion of the contract.
* Use appropriate security measures to protect the personal information.
* Allow your organization to audit the third party's compliance with the contract as necessary.