The Personal Information Protection and Electronic Documents Act (Canada) (PIPEDA) applies to personal information which an organization collects, uses or discloses in the course of commercial activities (subsection 4 (1)).
The Law Society conducts audits of lawyers' financial records pursuant to section 49.2 of the Law Society Act. An audit conducted by the Law Society is not a commercial activity. It is a regulatory activity.
The collection and use of personal information by the Law Society in the course of conducting an audit is not subject to the requirements or restrictions imposed by PIPEDA.
PIPEDA may apply to certain personal information that lawyers collect in the course of their practice, requiring them to obtain consent prior to collecting, using or disclosing the personal information. However, under clause (i) of subsection 7 (3) of PIPEDA, an organization may disclose personal information without knowledge or consent of the individual if required by law.
Lawyers whose financial records are being audited by the Law Society are required by law to provide the Law Society with personal information. Under subsection 49.2 (2) of the Law Society Act, such lawyers are required to produce documents in their possession or control and to provide information for the purpose of understanding or substantiating the financial records.
The requirements of subsection 49.2 (2) are sufficient to bring lawyers within clause (i) of subsection 7 (3) of PIPEDA, permitting them to disclose personal information to the Law Society without knowledge or consent of the individual.