Protecting Children's Personal Information in BC Programs

Why children's data deserves extra care

When a parent signs a child up for a program, they hand you a surprising amount of sensitive detail: the child's full name, birthdate, home address, who they live with, allergies, and sometimes photos. Children cannot meaningfully consent to most of this themselves, and the information can follow them for years, so regulators treat it as especially sensitive. In BC, protecting it is not just good practice, it is the law. Handling it well also builds trust with families, especially newcomers who may be cautious about giving information.

Which privacy law applies to your centre

In British Columbia, the Personal Information Protection Act (PIPA) governs how private-sector organizations, including non-profits and charities, collect, use, and disclose personal information. This is broader than the federal law, PIPEDA, which mainly applies to commercial activity, so many community organizations that would fall outside PIPEDA are still fully covered by PIPA in BC. Public bodies like school districts and municipalities follow a different law, FIPPA, instead. For the Canada-wide picture, start with privacy basics for community organizations.

Other provinces differ. Alberta has its own PIPA, Quebec has Law 25, and organizations elsewhere generally fall under PIPEDA. If you operate only in BC, PIPA is your starting point.

What counts as a child's personal information

Personal information is any information about an identifiable individual. For a child in your programs, that usually includes:

• Full name, birthdate, and age.

• Home address and contact details.

• Family relationships, such as who their parents or caregivers are and who lives in the household.

• Photos and video.

• Health details like allergies, medications, and accessibility needs.

• Attendance and program history.

Some of these are more sensitive than others. Health details and family circumstances deserve tighter handling than a first name on a name tag. The more sensitive the information, the more care and the clearer the consent you need.

Collect only what the program needs

The single most useful habit is collecting less. Under PIPA you may only collect personal information a reasonable person would consider appropriate for the purpose you have identified. So for each field on your form, ask a plain question: what program decision does this help us make? A cooking program needs allergies. It probably does not need a child's full home address if a parent's phone number would do. Our field-by-field walkthrough of what participant information to collect is a useful companion when you are trimming a form.

Fewer fields mean less to protect, less to explain, and less to lose. When you do collect sensitive details, tell families why, in plain language. For how consent works when the participant is a child, see who can consent for a child under BC privacy rules.

Everyday habits that protect kids' records

You do not need an enterprise security team to handle children's data responsibly. A few habits do most of the work:

1. 1

   Limit who can see what. Give staff and volunteers access to the information their role needs, and no more.

2. 2

   Keep it in one place. Scattered spreadsheets and paper forms are harder to secure and easier to lose than a single system with sign-in controls.

3. 3

   Write down your practices. PIPA expects a privacy policy that families can read and a named person responsible for privacy.

4. 4

   Destroy what you no longer need. Once a purpose is fulfilled and no law requires you to keep a record, dispose of it securely.

These same habits make it easier to answer a parent who asks to see or correct what you hold, which is their right under PIPA.