As of January 1, 2004, the Personal Information Protection and Electronic Documents Act ("PIPEDA") will regulate the collection, use and disclosure of personal information in the course of commercial activities. PIPEDA and other pending and existing provincial privacy legislation generally impose two types of obligations: (1) the obligation to obtain prior knowledge and consent to the collection, use and disclosure of personal information, and (2) various administrative obligations with respect to that personal information. The purpose of this one-page summary is to outline how the consent obligations of PIPEDA and the provincial legislation apply to D&B and how D&B is complying with those obligations in relation to the personal information D&B collects about you, including, as applicable, in your capacity as an owner, partner, officer or director of a business.

What is "Personal Information"?

"Personal Information" is defined similarly under PIPEDA, the legislation in British Columbia, pending legislation in Alberta and under existing Quebec legislation. In brief, "Personal Information" is " information about an identifiable individual" or " information that relates to a natural person and allows that person to be identified."

How does this privacy legislation affect the information D&B has obtained about you?

The vast majority of information that we have obtained about you is information pertaining to your business and thus does not constitute Personal Information. As such, privacy legislation does not apply to such information. Generally, the legislation requires that those who collect, use and disclose Personal Information obtain an individual's consent before collecting, using and/or disclosing Personal Information, unless an exemption applies. Therefore, with respect to the information D&B has obtained about you that may be characterized as Personal Information, there are 3 exemptions from the consent requirement which are particularly relevant to the operations of D&B: publicly available information, business contact Information, and employee personal information.

Publicly available information

D&B may periodically obtain information about you from public record sources, which contain information about the individuals who act as officers and/or directors of businesses on D&B reports. D&B does not report public record information on you if it does not bear on your ability or capacity for operating a business. In most cases, D&B is permitted to collect and report this information without obtaining your consent.

Business Contact Information

D&B, as a commercial business information company, obtains your business contact information such as your name, title, business address, business telephone number, business fax number and business email address in your capacity as an owner, partner, officer or director. D&B is not required to obtain your consent before collecting, using or disclosing that information.

Employee personal information

D&B collects, uses and discloses information about individuals who act as officers and/or directors of businesses. Such officers, and in some cases directors, are considered to be employees. Under PIPEDA, D&B is not required to obtain the consent of the individual before collecting, using or disclosing that information, because employee personal information - other than the personal information of employees of a federal work, undertaking or business - is not regulated by PIPEDA. In British Columbia, Alberta and Quebec, however, while there is an exemption for the collection, use and disclosure of employee personal information, in certain circumstances, that exemption may not be available. In such cases, consent will be obtained.

Consent Obtained

In rare circumstances, we will be collecting, using and disclosing your Personal Information to which the above exemptions do not apply. In such circumstances, we will collect Personal Information only directly from you with your consent or, where you are an officer or a director of a business on which D&B reports, from your authorized representative who has the necessary consent to permit the disclosure of such information in accordance with applicable privacy legislation.

What are Individuals (e.g. owner, partner, director, officer) required to do?

D&B endeavors to ensure that it complies with all laws, rules and regulations governing the collection, use or disclosure of information, including personal information. As such and as described above, D&B has taken the necessary measures to ensure that your Personal Information is protected in accordance with applicable privacy legislation.

Who do I contact if I need more information?

General questions with respect to the privacy practices of D&B should be directed to Paul Lavin, Chief Privacy Officer, at 905.568.5885.

The D&B Companies of Canada Ltd. All rights reserved.