After reading this post, you will know how to use real client scenarios in your content marketing without violating Canada’s federal privacy law, without triggering regulator complaints about misleading outcome claims, and without exposing yourself or your brokerage to liability. The short version: anonymisation alone is not enough. You also need to understand what regulators consider a “specific outcome” claim, and that line matters as much as the privacy question.
What PIPEDA Actually Requires From You
The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to any private-sector organisation that collects, uses, or discloses personal information in the course of commercial activity. Mortgage agents and brokers fall squarely within that scope. When you write a case study, you are disclosing information about a client’s financial situation, which PIPEDA classifies as sensitive personal information under Schedule 1, Principle 4.3.
The consent requirement under PIPEDA is meaningful consent, not assumed consent. A client signing a standard mortgage application form has not consented to having their file used in a blog post or social media story. You need a separate, specific, written authorisation that tells the client exactly what information will be shared, in what format, and for what purpose. If you cannot produce that signed authorisation, you should not be publishing that story, full stop.
Provincial private-sector privacy legislation in Alberta (the Personal Information Protection Act, or PIPA) and British Columbia (also called PIPA) sets requirements that are substantially similar to PIPEDA and in some cases stricter. In Quebec, the Act respecting the protection of personal information in the private sector, recently updated through Law 25, adds explicit requirements around the use of personal information for promotional purposes. Quebec licensees operating under the Autorité des marchés financiers (AMF) should treat that consent process as a formal document, not a verbal agreement.
Anonymisation That Actually Holds Up
The Office of the Privacy Commissioner of Canada has published guidance making clear that removing a name is not sufficient anonymisation. A case study that describes a client as a “35-year-old self-employed contractor in Barrie who purchased a $750,000 semi-detached property in late 2023 using a B-lender” could be re-identified by anyone who knows that person. That is not anonymous. That is pseudonymous, and PIPEDA treats pseudonymous data as personal information.
Effective anonymisation for content purposes means changing or removing any combination of details that could identify an individual: location, property type, approximate price range, employment category, family composition, and timing. A genuinely anonymised case study describes a situation, not a person. It sounds like this: “A salaried borrower with a mid-prime credit profile qualified for a refinance through an alternative lender after we restructured two outstanding debts into the mortgage balance.” No location. No price. No timeline. The educational point is preserved. The individual is not recoverable.
If that level of generalisation makes the case study feel too vague to be useful, that is a signal the value you were trying to communicate was really about the specific client, not about the principle. Build the content around the principle instead.
Regulator Expectations Around Specific Outcomes
Privacy law is one side of this. Advertising rules are the other, and the two operate independently. A case study that is fully PIPEDA-compliant can still generate a complaint under mortgage advertising guidelines.
The Financial Services Regulatory Authority of Ontario (FSRA) expects that licensee communications do not create misleading impressions about results clients can expect. The Real Estate Council of Alberta (RECA) and the BC Financial Services Authority (BCFSA) apply comparable standards to their regulated communities. A case study that says “we saved our client $40,000 in interest” or “we got approval in 48 hours when the bank said no” implies a repeatable outcome. Regulators treat that kind of framing as a performance claim, and performance claims require substantiation or carry compliance risk.
The practical fix is to frame case studies around process, not outcome. Describe the problem you identified, the options you presented, and why a particular solution was appropriate given the circumstances at the time. Avoid dollar figures attached to savings or gains. Avoid timelines framed as achievements. Language like “in this situation, the client qualified for” is safer than “we got the client approved for.” The difference is small in wording. The difference in regulatory interpretation is not.
For insurance professionals holding a Life Licence Qualification Program (LLQP) designation, the same caution applies to testimonials and case illustrations under provincial insurance advertising rules. Regulators across jurisdictions scrutinise scenarios that imply a specific benefit payment or claim outcome without appropriate context or disclaimers.
A Compliant Content Workflow
Before publishing any case study or client scenario, run through four checkpoints. First, confirm you have specific written consent if the story is not fully anonymised. Second, test your anonymisation against the re-identification standard, not just a name-removal standard. Third, review the framing to confirm you are describing a process and not implying a repeatable result. Fourth, confirm the content passes your brokerage’s compliance review if your firm has one, and many do under FSRA and BCFSA licence conditions.
REMIC’s Finfluencer for Licensed Professionals module covers these compliance considerations in the context of building a content practice that lasts. If you are building a social media or content presence as a mortgage or insurance professional, that is the right starting point. Visit remic.ca for details on current course offerings and enrolment.
