Is licensing company records legal in Canada?

1. Start with the rights in each work

Section 3(1) of the Copyright Act gives the copyright owner the sole right to produce or reproduce a work, or any substantial part of it, in any material form. It also covers specified rights including publication of an unpublished work and communication to the public by telecommunication.

A records collection may contain many works and contributions rather than one company-owned object. Identify the relevant works, what amounts to a substantial part, and whether client, supplier or employee-created material changes the ownership analysis.

Copyright Act, s 3(1): the sole right includes producing or reproducing “the work or any substantial part thereof in any material form whatever”.

2. Trace authorship, employment and written grants

Section 13(1) begins with the author as first owner. Section 13(3) addresses work made in the course of employment under a contract of service or apprenticeship, generally making the employer first owner in the absence of an agreement to the contrary, with a specific newspaper and periodical reservation.

Section 13(4) permits assignments and grants of interests by licence, subject to limits including territory, medium and market, and requires a writing signed by the owner or duly authorised agent. Review the actual contract and its scope rather than assuming possession of a file includes every right.

Copyright Act, s 13(4): an assignment or grant must be “in writing signed by the owner” or the owner's duly authorised agent.

3. Fair dealing needs more than a research label

Section 29 states that fair dealing for research, private study, education, parody or satire does not infringe copyright. The purpose is only part of the analysis: the dealing must also be fair. Other fair-dealing provisions have their own purposes and conditions.

Do not read section 29 as blanket permission for every commercial reproduction or AI-training activity. A company proposing a licence should identify the permission it can grant and have any claimed exception assessed for the actual records and use.

Copyright Act, s 29: “Fair dealing for the purpose of research, private study, education, parody or satire does not infringe copyright.”

4. Check whether PIPEDA applies, and where

PIPEDA section 4(1) applies Part 1 to organisations for personal information collected, used or disclosed in the course of commercial activities, and to specified employee or applicant information connected with a federal work, undertaking or business. The scope is not identical for every employee record in every organisation.

Section 5(3) adds that an organisation may collect, use or disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances. That is a separate question from whether the organisation owns a document or has obtained a form of consent.

PIPEDA, s 5(3): collection, use or disclosure is limited to purposes “a reasonable person would consider are appropriate in the circumstances”.

5. Purposes, consent, retention and safeguards all matter

Schedule 1 clause 4.3 addresses knowledge and consent, including meaningful explanation of purposes, while recognising statutory exceptions. Clause 4.5 limits use or disclosure to the identified purposes except with consent or as required by law, and limits retention to what is necessary for those purposes.

Clause 4.7 requires security safeguards appropriate to sensitivity. A licensing review should therefore document the original and proposed purposes, any new purpose, the form of consent or claimed exception, the sensitivity of the records, retention and the protections applied before and after transfer.

PIPEDA, Schedule 1, clause 4.5: personal information shall be retained “only as long as necessary for the fulfilment of those purposes”.

6. Add provincial law and third-party processing to the review

Québec's Act respecting the protection of personal information in the private sector is separate provincial legislation covering personal information collected, held, used or communicated in the course of carrying on an enterprise, subject to its own scope and exceptions. Organisations with a Québec connection should include that Act in their review rather than treating PIPEDA as the only possible text. Other provincial and sector regimes may also need review.

PIPEDA Schedule 1 clause 4.1.3 addresses accountability when personal information is transferred to a third party for processing, calling for contractual or other means to provide a comparable level of protection during that processing. Map the buyer, processors, onward recipients and locations; do not assume a border crossing or de-identification label resolves every obligation.

7. Define the licence and confirm authority

The agreement should identify the records, rights, permitted uses, exclusivity, territory, duration, recipients, onward licensing, safeguards, retention and end-of-licence treatment. Existing confidentiality, customer, employment and platform terms need to be reviewed alongside copyright and privacy law.

For a closed or winding-down company, an authorised officeholder should direct the process. Records may be a possible extra asset for creditors, but former access does not authorise former staff to license them. Personal data in insolvency estates needs its own lawful basis; your officeholder and the buyer decide.