Quick answer. Alberta's Personal Information Protection Act (PIPA) governs the collection, use, and disclosure of personal information by private organisations, including landlords and property managers. A tenant application typically involves collecting sensitive personal information (SIN if used for credit check, credit report, employment records, references, government ID). PIPA requires: obtaining meaningful written consent before collecting sensitive information; limiting collection to what is necessary for the stated purpose (tenant screening); using and disclosing the information only for that purpose; protecting the information with reasonable security safeguards; retaining the information only as long as necessary; and destroying it securely when no longer needed. Landlords who run credit checks without a signed PIPA-compliant consent form, or who retain rejected applicants' information indefinitely, or who disclose applicant information to third parties for purposes beyond screening, are in breach and can face complaints and orders from the Office of the Information and Privacy Commissioner of Alberta.
The PIPA Framework Applied to Tenant Screening
PIPA applies to every private-sector organisation in Alberta that collects personal information, including individual landlords and property management firms. The Act's four core principles as they apply to screening:
- Consent: obtain meaningful consent before collecting personal information. For sensitive data (credit report, SIN), the consent must be explicit and in writing.
- Purpose limitation: collect and use the information only for the purpose stated at collection (tenant screening).
- Data minimisation: collect only the information needed for the stated purpose. Do not ask for more than necessary.
- Retention and destruction: keep the information only as long as needed, then destroy securely.
The Consent Form: Required Elements
A PIPA-compliant tenant screening consent form should include:
- The applicant's name and application date.
- A specific statement of purpose: 'I consent to the collection and use of my personal information for the purpose of assessing my application to rent [property address].'
- A specific list of information being collected: credit report, employment verification, previous landlord references, government identification.
- A specific list of third parties who will receive the information: [credit bureau name], the applicant's stated employer for verification, previous landlords contacted for references.
- A statement of retention: 'If my application is accepted, information will be retained for the term of the tenancy and up to 7 years after termination for legal and tax purposes. If my application is rejected, information will be retained for 90 days for record purposes and then securely destroyed.'
- The applicant's signature and date.
The Credit Check: Specific Consent Required
The credit bureaus (Equifax, TransUnion) require the landlord or property manager to have documented consent from the applicant before running a report. This consent is a separate PIPA requirement, not just a bureau contract term. Running a credit check without documented consent is both a PIPA violation and a contract breach with the bureau. Standard practice: the consent form (above) includes the credit-check consent as one of the itemised collection categories, and the signed form is retained as evidence of consent.
Retention: What to Keep and For How Long
Accepted Applicant (Now Tenant)
Retain the application, credit report, screening decision documentation, and any related information for the duration of the tenancy plus 7 years after termination. The 7-year period reflects typical statute-of-limitation periods for civil actions in Alberta and CRA record retention requirements.
Rejected Applicant
Retain the rejected applicant's information for 90 days after the rejection decision, then securely destroy. The 90-day window allows response to any Human Rights complaint or other challenge to the rejection. Keeping rejected applicants' information indefinitely is a PIPA violation.
Withdrawn Applicant
Applicants who withdraw before a decision have provided information without receiving a decision. Retain briefly (30 to 60 days) then destroy.
Security Safeguards
PIPA requires reasonable safeguards to protect personal information from unauthorised access, use, or disclosure. Practical safeguards for landlord tenant files:
- Digital files stored in secure cloud storage (Google Workspace, Microsoft 365) with two-factor authentication on the account.
- Physical files stored in a locked cabinet in a secure location.
- Access limited to individuals with a legitimate need (the landlord, the property manager assigned to the property, screening staff).
- Encrypted transmission when sending personal information electronically (avoid unencrypted email attachments containing SIN or full credit reports).
- Passwords not shared outside the small circle with legitimate access.
- Secure destruction: shredding for paper files, secure delete for digital files at the end of retention period.
Disclosure to Third Parties: The Purpose-Limitation Rule
Personal information collected for tenant screening may only be used for that purpose. Common landlord PIPA violations involve disclosing applicant or tenant information to third parties for other purposes:
- Sharing tenant credit reports with contractors, neighbours, or other applicants.
- Providing applicant information to marketing lists.
- Disclosing tenant information to a family member 'because they were curious.'
- Discussing a specific tenant's credit or income with another landlord socially.
Legitimate exceptions: sharing tenant information with the property manager (who is a legitimate agent of the landlord); required disclosure under a court order or subpoena; disclosure to a lawyer for legal advice; disclosure to insurance in connection with a claim.
The Access Request Right
Under PIPA, any individual has the right to request access to the personal information about them that an organisation holds. If a tenant or applicant requests their file, the landlord must provide access within 45 days (extendable in limited circumstances). Refusing an access request without a specific PIPA-permitted exception is a violation. In practice, provide the file, redacting only third-party information the tenant is not entitled to (e.g., another party's reference notes about them).
The Complaint Process
Complaints of PIPA violations go to the Office of the Information and Privacy Commissioner (OIPC) of Alberta. The OIPC investigates, can issue findings, and can order remedies including destruction of improperly held information, changes to information handling practices, and public findings. Damages for individuals typically flow through separate civil proceedings, not through the OIPC directly.
Frequently Asked Questions
Do I need PIPA consent for a reference check?
Yes. Any collection of personal information for a stated purpose requires consent. Include reference checks as an itemised category on the consent form.
Can I ask for a Social Insurance Number (SIN)?
PIPA discourages collection of SIN unless there is a specific documented need. Most credit checks can be run using name, date of birth, and address rather than SIN. Where SIN is required (rare for tenant screening), include it specifically on the consent form with an explanation of why it is needed.
What if I want to share applicant screening notes with another landlord I know?
You cannot. That would be a disclosure for a purpose beyond the original screening purpose. Personal information about applicants is not shareable among landlords informally.
How do I securely destroy tenant records at end of retention?
Paper: cross-cut shredding or professional destruction service with certificate of destruction. Digital: secure delete (not just moving to trash), or full disk destruction if disposing of hardware. Cloud files: permanent deletion (with any backup copies).
Does UrbanLease handle PIPA compliance for owner clients?
Yes. UrbanLease uses a PIPA-compliant consent form for every applicant, restricts access to screening data to authorised staff, retains data on statutory schedule, and destroys securely at end of retention. Property management services provided by PREP Realty, a RECA-licensed Alberta brokerage.
Bottom Line
PIPA compliance in landlord tenant screening comes down to: signed consent form before collection, limited data collected, secure storage, restricted access, purpose-limited use, and scheduled destruction. The consent form is the foundation; without it, every subsequent action is at risk. Individual landlords managing their own properties need to build this into their process; RECA-licensed managers do it as standard practice. UrbanLease handles this workflow under PREP Realty.