In short
Yes: neither Canada’s PIPEDA nor Europe’s GDPR bans a channel. Both expect you to limit the document to what is strictly needed, to protect the send in line with how sensitive it is, and to know how to respond if something goes wrong. Because the fax line is unencrypted, the care goes mainly into getting the number right and knowing where the recipient’s machine sits.
Privacy law thinks in safeguards
In Canada, private-sector organizations are generally covered by PIPEDA or by a substantially similar provincial law, and health information often by a provincial statute such as Ontario’s PHIPA; in Europe, the GDPR applies. None of them keeps a list of approved channels: sending a document that identifies a person is handling personal information, whether by post, email or fax. The common thread: share only what is useful, match safeguards to how sensitive the information is, and have a plan ready for incidents.
Where fax differs
On FaxTelecom, the PDF arrives encrypted over HTTPS and is erased after sending; the phone line to the receiving machine, on the other hand, stays unencrypted, as with any fax. The measures that work are therefore mostly organisational.
Health data falls into a special category. Before faxing, find out whether the recipient offers a secure exchange tool for care professionals or an upload area: our article on fax in healthcare and pharmacies covers the subject.
The checklist before you send
Mask or remove any information the task does not require. Copy the number from a recent document and verify it a second time before clicking the confirmation link. Put the recipient’s name and “confidential” in the cover-page message. Call ahead, and ask them to confirm safe receipt.
If the fax goes to the wrong number, reach the person who got it by mistake, ask them to destroy the pages, and record the incident in writing. Under PIPEDA, a breach that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada as soon as feasible; provincial laws and the GDPR set their own rules and deadlines.
Key points
- PIPEDA and the GDPR allow fax, provided you minimise and secure.
- Unencrypted fax line: precautions are mostly organisational.
- Verified number, “confidential” notice, recipient warned.
- Wrong number: have it destroyed, record it, report if needed.