Privacy Requests Procedure

Under Alberta’s Personal Information Protection Act (PIPA), a person may ask an organization what personal information it holds about them (section 24) and ask for it to be corrected (section 25). The organization must respond within 45 days of receiving the request (section 28), or tell the person in writing why it needs more time.

For information on a client file, the organization is the law firm. RealEstAi holds that information on the firm’s behalf and gives the firm a tool to answer. This page says what happens when a request arrives at either door.

1. A request received by the firm

1. Log the date received. The 45 days run from that date.
2. A firm administrator opens Admin, Privacy requests, finds the person by name or email, and generates the report. The report assembles everything the platform holds about that person across the firm’s files: the contact record, any portal account, the matters they are a party to (including matters under retention hold), identity-verification records, the names of their ID scans and their own uploads, notes, appointments, retainer agreements, FINTRAC assessments, dower consents, portal invitations, e-signature requests, post-closing reports, portal messages, notifications, invoices addressed to them, conflict checks naming them, prospective-client consultations, imported archive records, and their own sign-in and download activity. Records are matched on the person’s name and email addresses; a record held under a different spelling is checked by hand.
3. A lawyer reviews the report before anything leaves the firm. Some of it may be subject to solicitor-client privilege or belong to another person, such as the other party’s identity record on the same file. The firm decides what is released and what is withheld under PIPA sections 24(2) and 24(3). The report can be downloaded or printed for the firm’s mark-up.
4. The firm responds to the person within 45 days, with the information released, the reasons for withholding, or a written notice extending the time where the Act allows.
5. The firm keeps its own record of the request, the review and the response. The platform records that a report was generated (section 4) but does not store the report or the response.

2. A request received by RealEstAi

Requests sometimes come to RealEstAi directly, at privacy@realestai.ca.

1. Acknowledge receipt to the sender.
2. Identify the firm. RealEstAi does not decide what is released from a client file; the firm that collected the information does. Where the person names the firm, or their email matches a contact at one firm, that firm is the recipient.
3. Forward the request to that firm’s administrator within five business days, with the date RealEstAi received it, so the firm’s 45-day clock is counted correctly. Tell the sender which firm the request has gone to.
4. Log it in RealEstAi’s privacy-request register: date received, date forwarded, firm and reference. No copy of the person’s information is made in the process.
5. Where the request is about information RealEstAi holds as the organization itself, such as a platform account, a contact-form message or support correspondence, RealEstAi answers it directly within 45 days using the same review steps as section 1.

3. Corrections

A person may ask for their information to be corrected (PIPA section 25). Corrections are made on the file in the usual way, by a lawyer or conveyancer editing the contact, the file or the record concerned. Where the firm declines to make a correction, it annotates the record with the correction that was requested but not made, and tells the person. Corrections to identity-verification records follow the file’s normal verification process, since a change there may need the ID to be re-checked.

4. Every report is recorded

Generating a report reads the person’s identity numbers, so every generation writes a row to the firm’s audit log: the administrator who ran it, the contact concerned, the network address and device, and how many records each section returned. The report itself is not stored by the platform. Firm administrators can see these rows under Admin, Audit Logs.

5. Who can do this

Only an active firm administrator can search for a person or generate a report, and only within their own firm. A contact from another firm answers “not found”. Lawyers, conveyancers, assistants and clients cannot open the page.