Canadian Privacy Laws (Part 5): Nova Scotia’s Privacy Laws
Nova Scotia’s Privacy Laws are similar to Ontario in one important way: it does not have one broad private-sector privacy law that replaces PIPEDA for most businesses.
For many private organizations operating in Nova Scotia, PIPEDA is still the main privacy law to understand when personal information is collected, used, or disclosed during commercial activity.
That said, Nova Scotia does have important provincial privacy laws. These mainly apply to public bodies, municipalities, and the health care sector.
Together, these laws set rules for how public-sector organizations, municipalities, and health custodians collect, use, share, protect, and give access to personal information.
FOIPOP: Nova Scotia’s Public-Sector Privacy Law
The Freedom of Information and Protection of Privacy Act (FOIPOP) applies to public bodies in Nova Scotia.
Who it applies to: provincial government departments, public bodies, universities, school boards, health authorities, and provincial agencies, boards, and commissions.
What it does: FOIPOP gives people the right to request access to government records. It also sets rules for how public bodies collect, use, disclose, protect, and correct personal information.
Why businesses should care: If your company works with Nova Scotia public-sector clients, FOIPOP may influence what those clients expect from you. This could show up in contracts, privacy requirements, security controls, records management, access requests, or breach response processes.
MGA Part XX: Nova Scotia’s Municipal Privacy Rules
The Municipal Government Act (MGA), Part XX applies to local government organizations in Nova Scotia.
Who it applies to: regional and district municipalities, towns, villages, service commissions, municipal fire departments, and police forces.
What it does: MGA Part XX sets access and privacy rules for municipal bodies. It helps govern how local governments handle personal information and how people can request access to municipal records.
Why businesses should care: If your business supports a municipality or local government organization in Nova Scotia, these rules may affect expectations around records, privacy safeguards, data storage, access controls, and how information is shared or retained.
PHIA: Nova Scotia’s Health Privacy Law
The Personal Health Information Act (PHIA) is Nova Scotia’s health privacy law.
Who it applies to: health information custodians and organizations that handle personal health information, including health authorities, health care providers, and other regulated health-sector organizations.
What it does: PHIA sets rules for how personal health information is collected, used, disclosed, accessed, and protected. It also gives people rights related to their own health information.
Why businesses should care: Health information is highly sensitive. If your business supports health care providers, stores health-related data, manages health systems, or provides services to a custodian, PHIA may affect privacy, security, access, consent, breach response, and compliance expectations.
How Nova Scotia Fits with PIPEDA
The biggest difference between Nova Scotia and provinces like British Columbia or Alberta is that Nova Scotia does not have its own broad private-sector privacy law.
For most private businesses, PIPEDA remains the main law for commercial activity. Nova Scotia’s provincial privacy laws usually become more relevant when a business works with public bodies, municipalities, or health-sector organizations.
That means businesses should look at both the type of data they handle and the type of client they support. A technology provider working with a health clinic may need to consider PHIA. A vendor supporting a municipality may need to understand MGA-related privacy expectations. A company working with a provincial department may need to align with FOIPOP requirements.
Why This Matters for Your Business
If your business operates in Nova Scotia, serves Nova Scotia customers, or supports Nova Scotia organizations, privacy responsibilities may depend on the sector you work in.
A good starting point is to know what personal information you collect, why you collect it, where it is stored, who can access it, and how long it is kept. It is also important to have clear consent practices, reasonable safeguards, documented privacy policies, and a plan for responding to privacy incidents.
In short, Nova Scotia may not have one single private-sector privacy law, but its public-sector, municipal, and health privacy rules still matter.
For businesses, that means privacy compliance is not only about following federal rules. It is also about understanding when Nova Scotia’s FOIPOP, MGA, and PHIA requirements may affect your work.
A Seven Part Series on Privacy Laws in Canada
Stay tuned for the next entry in our series, where we will look at how privacy laws differ across the Canadian provinces.
- Part 1: Federal Laws: Unpack overarching federal frameworks like PIPEDA to establish baseline data protection standards.
- Part 2: Provincial Laws – Ontario: Navigate local corporate privacy standards and sector-specific regulations unique to Ontario.
- Part 3: Provincial Laws – British Columbia: Examine B.C.’s distinct statutes and strict regional rules regarding data residency.
- Part 4: Provincial Laws – Alberta: Review Alberta’s PIPA framework for private sector accountability and local consent rules.
- Part 5: Provincial Laws – Nova Scotia: Learn how Nova Scotia’s regional frameworks shape commercial privacy and administrative accountability.
- Part 6: Provincial Laws – Quebec: Dive into Quebec’s Law 25, focusing on strict corporate transparency and severe penalties.
- Part 7: Provincial Laws – Manitoba: Map out Manitoba’s legislative landscape to keep regional digital operations compliant.