Canadian Court Rulings – Personal
Information Protection
This is a list of Canadian court decisions which
refer to Canadian statutes concerning the protection of personal
information in the private sector. [The only Canadian jurisdiction not covered is Quebec,
which will be the subject of a separate McConchie Law Corporation
webpage now under construction.]
This list is not necessarily exhaustive: (a)
court rulings are not always reduced to writing; and (b) the law
reports and electronic databases do not contain all written court
rulings. Further, the list is only updated periodically. Any decision listed on this page should be updated by appropriate legal research before any reliance is placed on that decision. This is necessary to determine whether a decision has been over-ruled, criticized or distinguished on its facts by a subsequent court decision.
The Canadian decisions will be listed and summarized
under the following topic headings:
Under each topic heading, the Canadian decisions
will be listed in chronological order.
Wherever possible, a hypertext link is provided to
the full text of a Canadian decision. A link will in most cases
lead to a free, publicly-accessible website.
2001 June 12
The Ontario Superior Court of Justice held that discovery
of documents in civil litigation conducted under the Ontario Rules
of Civil Procedure is exempt from the provisions of PIPEDA which
generally require individual consent for the disclosure of personal
information. PIPEDA s.7 (3) (c) expressly provides that disclosure
can be made to comply with an order of the court or to comply with
rules of court relating to the production of records. PIPEDA does
not create a claim of privilege to be advanced as justification
for not producing a relevant document.
2001 October 16
The Ontario Superior Court of Justice held that PIPEDA
applied to an electronic database containing personal information
provided by prospective life insurance agents, both within Ontario
and in other provinces, insofar as the database included information
complied in respect of agents from outside Ontario, or in respect
of applications to insurers who were located outside Ontario.
The Court examined applicant documentation and held
that it was sufficient to constitute adequate consent on the part
of the agent to the compilation of the personal information but
required amendment if the information was to be used in respect
of a new application at a later time.
2002 January 31
The Toronto Small Claims Court held there was no right
of action under PIPEDA where the plaintiff was negligent in the
use of his bank debit card and openly punched in his PIN at a drugstore
in full sight of strangers.
2002 April 30
International
Brotherhood of Electrical Workers, Locals 213 and 258 v Telus
The British Columbia Supreme Court ordered Telus to
produce certain records sought by the plaintiffs relating to the
investigation of the conduct and subsequent suspension of two employees
who the plaintiffs alleged breached privacy rights by accessing
telephone, electronic mail, or facsimile records of the plaintiff
union locals and officials. The Court rejected Telus' submissions
that such an Order should not be made because it would be a grave
thing to override privacy rights created by PIPEDA (and Telus' General
Terms of Service and Privacy Code), ruling that Telus had failed
to show that disclosing the records would reveal confidential customer
information.
2003 January 03
Maheu
v IMS Health Canada
Justice Lemieux of the Federal Court of Canada set
aside a decision of a Prothonotary requiring the plaintiff to post
security for costs an Application, following a report by the federal
Privacy Commissioner, for a determination whether the practices
of a business competitor comply with PIPEDA in terms of relevant
collection gathering techniques involving personal information.
It was not relevant that the Applicant's personal information was
not at stake, as PIPEDA is a public regulatory statute providing
for the means of enforcement through complaints, the Privacy Commissioner's
investigation, report and an appeal by the complainant as of right
to the Federal Court.
2003 September 03
L'Ecuyer
v Aeroports de Montreal
The Federal Court held that neither the federal Privacy
Commissioner nor the Court had jurisdiction to consider a complaint
that the respondent had not complied with s. 4.3 of Schedule 1 and
s. 5(3) of PIPEDA regarding disclosure of personal information of
the plaintiff to third parties. The matter fell within the exclusive
jurisdiction of a labour grievance arbitrator [applying Weber v
Ontario Hydro [1995] 2 S.C.R. 929] because the dispute arose from
the interpretation, application, administration or failure to implement
a collective agreement."
The Court also found the Application to be without
merit on the grounds that the Applicant consented, at least by implication,
to disclosure of certain personal information to the union representatives.
2003 September 03
The Quebec Superior Court held that Air Canada, an
airline, was not subject to the jurisdiction of the Quebec Access
to Information Commission under Quebec's Law for the Protection
of Personal Information in the Private Sector, L.R.Q., c. P-39.1.
Air Canada was exclusively under federal jurisdiction.
2003 November 27
Maheu
v IMS Health Canada,
The Federal Court of Appeal unanimously dismissed
an appeal by IMS Canada from the decision of Blais J., 2003 FCT
1, which reversed a decision of the Prothonotary. 2002 FCT 558
2004 March 31
BMG
Canada v Doe,
The Federal Court rejected an application by the BMG
Canada and other plaintiffs for an order compelling five Canadian
internet service providers to identify certain customers who allegedly
infringed copyright laws by illegally trading in music downloaded
from the internet.
The Court declined to make an order for disclosure
- which would have invoked the exemption to consent prescribed by
s. 7(3)(c) of PIPEDA-because the Applicants had not satisfied certain
elements of the common law test for granting an "equitable
bill of discovery" which should apply to Rule 238 of the Federal
Court Rules in a John Doe action, namely:
| a) |
The applicant must establish a prima facie case
against the unknown alleged wrongdoer; |
| b) |
The person from whom discovery is sought must
be in some way involved in the matter under dispute, he must
be more than an innocent bystander; |
| c) |
The person from whom discovery is sought must
be the only practical source of the information available to
the applicants; |
| d) |
The person from whom discovery is sought must
be reasonably compensated for his expenses arising out of compliance
with the discovery order in addition to his legal costs; |
| e) |
The public interests in favour of disclosure
must outweigh the legitimate privacy concerns. |
2004 April 14
Ferenczy
v MCI Medical Clinics
The Ontario Superior Court of Justice rejected submissions
of the plaintiff that certain video surveillance evidence relating
to the plaintiff, gathered by a private investigator hired by the
defendant to a medical malpractice action, was inadmissible as having
been obtained in violation of PIPEDA.
PIPEDA does not contain a provision making information
obtained in violation of that statute inadmissible in court proceedings
and the reception of this evidence would not make the trial unfair.
PIPEDA did not in any event apply. The private investigator
was not collecting a making a record during the course of "commercial
activity" within the meaning of PIPEDA because he was acting
as an agent for the defendant, who was collecting the disclosing
the information for personal purposes within the meaning of s. 4(2).
The defendant, through his agents, was collecting information to
defend himself against the lawsuit brought by the plaintiff. This
is a personal purpose in the context of the civil action brought
against him by the plaintiff.
Further, the plaintiff gave implied consent to the
collection and use by commencing an action which put the conduct
recorded in the video surveillance in issue.
Further, the exemptions in s. 7(1)(b), 7(2)(d) and
7(3)(c) and (i) of PIPEDA applied. With respect to s. 7(1)(b), "the
law of Canada or a Province" includes the common law, including
the law of tort. In this case, the "surveillance" was
"related to investigating" the claim made by the plaintiff
against the defendant. Disclosure of the surveillance efforts or
seeking the consent of the plaintiff would "compromise the
availability or the accuracy of the information." Once the
collection is found to be within s. 7(1)(b), it can be used pursuant
to s. 7(2)(d). Section 7(3)(c) and (i) are broad enough to cover
the disclosure of the information in accordance with the rules of
court and at a trial.
2004 June 11
Eastmond
v CPR
The Federal Court dismissed an application by a union
human rights representative for an Order that the respondent railroad
comply with a determination by the Privacy Commissioner that a complaint
about video cameras in the workplace was well-founded and recommending
that the railroad remove the cameras.
The Court rejected the respondent employer's submission
that the Court lacked jurisdiction on the basis the dispute gave
rise to the exclusive labour arbitration model espoused by the Supreme
Court of Canada in Weber v Ontario Hydro, [1995] 2 S.C.R. 929. Parliament's
intention in enacting PIPEDA was not to exclude unionized workers
from the scope of PIPEDA. Further, in the circumstances of this
case, the essence of the dispute did not arise from the collective
agreement. There was nothing which dealt with personal information
and how it may be collected in the workplace.
A proceeding under s. 14 of PIPEDA is not a review
of the Privacy Commissioner's report or his recommendation. It is
a fresh application to this Court by a person who had made a complaint
to the Privacy Commissioner under PIPEDA and who, in order to obtain
a remedy under section 16, bears the burden of demonstrating there
has been a violation of PIPEDA obligations.
The Court may accord the federal Privacy Commissioner
some deference in his area of expertise (including appropriate recognition
to the factors the Commissioner took into account in balancing interests),
but did not accord any deference to the Commissioner's findings
of fact because the evidence before the Court was considerably different
than that gathered by the Privacy Commissioner.
The employer's reasons for the video cameras were
purposes that a reasonable person would consider appropriate in
the circumstances.
In this regard, the Court took into account and was
guided by the following factors:
- Was camera surveillance and recording necessary
to meet a specific need?
- Was camera surveillance and recording likely to
be effective in that need?
- Was the loss of privacy proportional to the benefit
gained?
- Was there a less privacy-invasive way of achieving
the same end?
These factors may not necessarily be relevant in other
contexts.
The camera system had several appropriate fences:
the collection was not surreptitious; not continuous (only when
within footprint of the camera); not limited to employees (it captured
contractors, visitors, suppliers and trespassers); not used to measure
employee work performance; recorded images were kept under lock
and key and only accessed by responsible managers and police if
an incident was reported. Numerous past incidents justified the
need to have surveillance cameras in place.
S. 7(1) of [PIPEDA] has given content to the words
'except where inappropriate' found in section 4.3 of the Schedule.
S. 4.3 prescribes only four circumstances where collection may take
place without knowledge or consent.
The words "except where inappropriate" contained
in section 4.3 of Schedule 1 to PIPEDA do not enable the Privacy
Commissioner or the Court to make a determination when the knowledge
or consent of the individual whose personal information is being
collected is unnecessary in the circumstances.
The exemption from consent provided in s. 7(1)(b)
of PIPEDA applied.
2004 July 6
Clustercraft
Jewellery Manufacturing Co. Ltd. v Wygee Holdings Ltd.
The Ontario Superior Court of Justice, hearing an
interlocutory appeal from a ruling of a Master relating to questions
objected to on examination for discovery, rejected submissions by
the plaintiff that disclosure of certain information to the defendant
of certain information relating to employees and former employees
of the plaintiff would violate the Personal Information Protection
and Electronic Documents Act. The Court held that disclosure
was expressly permitted by PIPEDA section 7(3)(c) which provides
that “an organization may disclose personal information without
the knowledge or consent of the individual …if the disclosure
is …required to comply with a subpoena or warrant issued or
an order made by a court, person or body with jurisdiction to compel
the production of the information, or to comply with rules of court
relating to the production of records.”
2004 September 8
Rodgers
v Calvert, [2004] O.J. No. 3653
The Ontario Superior Court of Justice held that the
fact that the Criminal Code of Canada and the Firearms
Act and Regulations enacted by the Federal Parliament
under its criminal law power applied to the recreational shooting
activities of the defendant association did not make the defendant
a “federal work or undertaking” within the meaning of
PIPEDA.
The Court further held that producing a membership
list pursuant to s. 307 of the Corporations Act (Ontario)
was not a “commercial activity” within the meaning of
PIPEDA, relying on the interpretation from the federal
Privacy Commissioner that “collecting membership fees, organizing
club activities, compiling a list of member’s names and addresses
and mailing out newsletters are not considered commercial activities.”
In ordering the defendant association to disclose
its membership list to the plaintiff, who was the subject of expulsion
proceedings, the Court found it unnecessary to address the defendant
association’s submission that the words “required by
law” in s. 7(3)(i) of PIPEDA did not apply to s.
307 of the Corporations Act but only to case law.
2004 September 29
Goldberg
v St. John
The Ontario Superior Court of Justice rejected
submissions by the plaintiff in a personal injury case that PIPEDA
prevented him from disclosing on examination for discovery certain
records about the plaintiff’s customers (including names and
addresses). The Court was “not persuaded that [PIPEDA] applies
to a provincially regulated business and its employees such as CIBC
World Markets Inc. and the plaintiff. CIBC World Markets Inc. is
a stockbroker, not a bank.” Nevertheless, the Court declined
the order sought by the defendant, ruling that in the circumstances
of the case, the relationship between investors and their brokers
and financial advisors should be protected as confidential.
2004 November 17
Englander
v Telus Communications Inc.
The Federal Court of Appeal allowed, in part, an appeal
by the Applicant from a decision of the Federal Court which had
dismissed the Application. The Court of Appeal held that the federal
Privacy Commissioner, and the lower court, had erred in finding
that none of the Applicant's complaints against the respondent Telus
were valid.
The Court of Appeal held that in interpreting Schedule
1 of PIPEDA, which does not lend itself to rigorous construction
because of its non-legal drafting, flexibility, common sense and
pragmatism will best guide the Court.
At a hearing pursuant to s. 14(1) of PIPEDA, the Court
proceeds de novo and the report of the Privacy Commissioner, if
put in evidence, may be challenged or contradicted like any other
document adduced in evidence. Further, pursuant to s. 15 of PIPEDA,
the Commissioner may appear as a party to the hearing.
Only a complainant with respect to whose complaint
a report was prepared by the Commissioner can apply to the Court.
Where the Commissioner has prepared a report, and
where his decision to do so has not been challenged, the individual
who has filed the complaint becomes a complainant for the purposes
of an application to Court pursuant to section 14 of PIPEDA as soon
as the report is sent to that individual, whether or not his own
personal information is at stake.
Nevertheless, the Court retains inherent jurisdiction
to decline to hear a matter which no longer has any object or which
is normally considered non-justiciable.
Principals 2 ("Identifying Purposes) and 3 ("Consent")
were at the heart of the appeal. In this regard, the Court held
that proper consent was not, could not have been given, by TELUS
first-time customers with respect to use by TELUS of the personal
information in its Internet directory assistance service, in its
Directory File Service and Basic Listing Interchange File Service
and its CD-ROM service. Those services were not identified at the
time of enrolment and there was no evidence they were so connected
with the primary purposes of telephone directories that a new customer
would reasonably consider them as appropriate. There was no evidence
that TELUS made any "effort," let alone a "reasonable"
one, within the meaning of clause 4.3.2, to ensure that its first-time
customers were advised of the secondary purposes at the time of
collection.
The lower court's finding that first time customers
can be considered to have consented to the primary uses if they
do not, on their own initiative, request an unlisted number, was
not compatible with the very exercise of seeking informed consent
before or at the time of enrolment mandated by Part 1 of [PIPEDA]
and by Schedule 1.
Consent is not informed if the person allegedly giving
it is not aware at the time of giving it that he or she had the
possibility to opt-out.
First-time customers have the right to know -- before
their personal information becomes "publicly available"
within the meaning of section 7 of [PIPEDA], with all the consequences
that might flow from such publicity -- that they can exercise their
right to privacy and choose not to be listed.
The Court of Appeal proceeded on the assumption that
the CRTC has jurisdiction to set the rates for use of the Non-Published
Number Service.
In the circumstances of this case, where s. 4(3) was
applicable, PIPEDA took precedence over the federal Telecommunications
Act. The Federal Court has the power to decide whether the imposition
of a fee for the Non-Published Number Service is permissible under
clause 4.3.3 of Schedule 1 of PIPEDA.
In this case, the imposition of a fee did not violate
PIPEDA. Nothing in PIPEDA expressly prohibits fees. In the circumstances
of this case, the fee facilitates, rather than restricts, the right
to privacy and there was no evidence that the rate was unbearable.
2004 December 16
The Manitoba Court of Queen’s Bench granted
an interim (not interlocutory) injunction until the hearing of the
application for an interlocutory injunction. The interim injunction
permitted the employer to maintain video surveillance only of four
pieces of equipment. Any other video surveillance was to be prohibited.
The Court noted that at the hearing of the interlocutory application,
once the defence had filed its evidence, the Court would be asked
to determine whether the employer’s video surveillance violated
inter alia PIPEDA.
2005 March 8
[SEE BELOW 2006 OCTOBER 18: REVERSED BY FEDERAL COURT OF APPEAL]
The Federal Court held that the federal Privacy Commissioner was
entitled to order pursuant to s. 12(1)(a) and (c) of PIPEDA that
the Blood Tribe Health Department to produce certain documents over
which it claimed solicitor-client privilege in order to assess whether
the solicitor-client objection applies. “Parliament has given
the Commissioner the power to intervene in disputes between individuals
and organizations over the retention and use of personal information,
the responsibility to determine the facts and the duty to prepare
report on her findings. I agree with the respondent that she cannot
effectively perform that role is she is denied access to the information
necessary to ascertain the facts merely on the assertion of a claim
of privilege.” [THE FEDERAL COURT OF APPEAL DISAGREED THAT PIPEDA CONFERRED THIS POWER ON THE COMMISSIONER]
2005 March 29
The Federal Court held that no violation of PIPEDA
occurred where the employer attempted, but failed, to surreptitiously
record the conversations of some of its employees including the
applicant: “The law of attempted breach does not exist under
the Act.”
2005 April 15
In this British Columbia Supreme Court interlocutory
ruling in a personal injury case, the Court cautioned that a defendant
who wishes to interview potential medical witnesses without first
obtaining a court order “should examine the provisions of
the Freedom of Information and Protection of Privacy Act,
R.S.B.C. 1996, c. 165, the Personal Information Protection Act,
S.B.C. 2003, c. 63 and the Personal Information Protection and
Electronic Documents Act, S.C. 2000, c. 5.” The Court
suggested that in the absence of a court order, those statutes may
affect the process of interviewing such witnesses.
2005 May 19
The Federal Court of Appeal dismissed an appeal by
BMG Canada from the decision of the Chambers judge [See
2004 March 31, 2004 FC 488] who rejected an application by the
plaintiffs for an order compelling five Canadian internet service
providers to identify certain customers who allegedly infringed
copyright laws by illegally trading in music downloaded from the
internet. The Chambers judge declined to make an order for disclosure
- which would have invoked the exemption to consent prescribed by
s. 7(3) (c) of PIPEDA-because the applicants had not satisfied certain
elements of the common law test for granting an "equitable
bill of discovery" which the Court held should apply to Rule
238 of the Federal Court Rules in a John Doe action.
The Federal Court of Appeal agreed with the Chambers
judge that the criteria relating to granting an equitable bill of
discovery applied to a motion under Rule 238 of the Federal Court
Rules.
However, the Court of Appeal held the Chambers judge
erred in concluding the plaintiffs had to present evidence of a
prima facie case, holding they merely had to show a bona fide claim,
namely a genuine intent to bring an action for copyright infringement
and that the information is not sought for an improper purpose.
The Federal Court of Appeal agreed that privacy is a an important
consideration, and held caution must be exercised by the Courts
in ordering disclosure of personal information, to make sure that
privacy rights are invaded in the most minimal way.
The Court held that in this case, because a lengthy delay between
the time the request for the identities was made by the plaintiffs
and the time the plaintiffs would collect their information, there
is a risk that the information as to identity may be inaccurate.
This is because an IP address may not be associated with the same
individual for long periods of time. Therefore it is possible that
the privacy rights of innocent persons would be infringed and legal
proceedings against such persons would be without justification.
The Court held that the greatest care should be taken
to avoid delay between the investigation and the request for information.
Failure to take such care might well justify a court in refusing
to make a disclosure order.
Further, plaintiffs should be careful not to extract
irrelevant information, as this might amount to a breach of PIPEDA
by the ISPs leaving them open to prosecution. If a disclosure order
is granted, specific directions should be given as to the type of
information disclosed and the manner in which it can be used. In
addition, it must be said that where there exists evidence of copyright
infringement, privacy concerns may be met if the court orders that
the user only be identified by initials, or makes a confidentiality
order.
2005 June 16
[NOTE: This decision of the Court of Queen’s Bench was set aside by the Alberta Court of Appeal on 2006 June 13 and a new order substituted: 2006 ABCA 184, see summary below]]
In the instant case, the Alberta Court of Queen’s Bench ruled that the Calgary Health Region (CHR) had the right to audit and inspect certain files held by Innovative where a portion of each file was funded publicly (and was therefore subject to Alberta’s Health Information Act) and a portion was funded by a private insurer or an entity such as the Workers’ Compensation Board.
The Court of Queen’s Bench reasoned in the alternative that if information in such “hybrid” files which includes information about privately-funded treatment was not subject to the Health Information Act, that information would be subject to PIPEDA.
The Court of Queen’s Bench noted that health information in Alberta is not subject to Alberta’s Personal Information Protection Act, which has been declared substantially similar” to PIPEDA under s. 26(2)(b) of PIPEDA and the Exemption Order Regulation.
Accordingly, the Court of Queen’s Bench reasoned, “it would appear PIPEDA continues to apply to private sector health information in Alberta.” “As a consequence, if the [files containing private sector funded patient information] were not subject to the [Health Information Act], then the use and disclosure of health information would be governed by PIPEDA.”
Although the Court of Queen’s Bench concluded that the entirety of each file maintained by Innovative fell under Alberta’s Health Information Act, it concluded in the alternative that the CHR would be entitled under s. 7(3)(d)(i) and s. 7(3)(i) of PIPEDA to conduct an audit of those files without the consent of the patient. “The investigation of the possibility of fraudulent or irregular billing is one of the purposes of the audit and as such it falls within those sections.
2005 July 22
The British Columbia Supreme Court rejected submissions by the
defendant bank that either s. 7(3)(d)(i) or s. 7(3)(h.2) of PIPEDA
authorized the defendant bank to release certain personal information
about the plaintiffs’ business and personal accounts to another
bank.
PIPEDA s. 7(3) (d) (i) provides that disclosure of
personal information does not require knowledge or consent of the
individual if it is (1) made on the initiative of the organization
(2) to an “investigative body” and (3) the organization
has reasonable grounds to believe the disclosed information relates
to a breach of agreement or a contravention of the laws of Canada,
a province or a foreign jurisdiction that has been, is being or
will be committed. All three conditions must be satisfied.
In this case, the Court held that that condition (2)
had not been met as there was no evidence that the representatives
of the bank which received the information from the defendant were
designated as officers of the “Bank Crime Prevention and Investigation
Office of the Canadian Bankers Association” which is designated
by regulation as an “investigative body.”
PIPEDA s. 7(3)(h.2) provides for disclosure without
knowledge or consent where it is made by an “investigative
body” and the disclosure is reasonable for the purposes related
to investigating a breach of an agreement or a contravention of
the laws of Canada or a province.
The Court accepted the plaintiff’s submission
that the defendant bank’s officers who made the disclosure
were not designated members of the “Bank Crime Prevention
and Investigation Office of the Canadian Bankers Association”
and that in consequence s. 7(3)(h.2) did not apply.
2005 July 15
The Ontario Superior Court of Justice side-stepped the questions
whether PIPEDA applied to a request to the defendant society to
furnish the applicant with a list setting out the names and addresses
of all persons who are members of the respondent society as shown
on its books. The Court held that the applicant had not delivered
an affidavit, a prerequisite required by s. 307 of the Ontario Corporations
Act, R.S.O. 1990, c. C-38, showing that the information sought was
to be used only for purposes connected with the respondent society.
2005 August 25
The Ontario Superior Court of Justice (Small Claims Court) held
that PIPEDA did not give rise to a cause of action against the defendant,
who in October 2002 provided a written statement to police concerning
three alleged incidents with the plaintiff in the workplace, because
in 2002 that statute only applied to federal undertakings, international
and interprovincial trade and the health sector. “PIPEDA was
not applicable to all organizations (individuals) until 2004, well
after the subject events occurred.” Further, the Court stated
that “PIPEDA sets up its own regime for enforcement of the
legislation through the Privacy Commissioner and the Federal Court.”
2005 October 7
IMS Health Canada, Ltd. v Information and Privacy Commissioner
The Alberta Court of Appeal held that the Alberta Information and Privacy
Commissioner, whose jurisdiction includes the Freedom of Information and
Protection of Privacy Act, RSA 2000, c. F-25, the Health Information Act,
RSA 2000, C. H-5 ("HIA")and the Personal Information Protection Act, RSA
2003, c. P-65 ("Alta PIPA"), was required to produce to IMS all documents
which touch on the issue of his decision in January 2002 to conduct an
investigation and to issue an order on March 19, 2003 prohibiting Alberta
pharmacies from disclosing prescriber's names to IMS without the consent of
the prescriber.
In these proceedings commenced by IMS on April 17, 2003, the company seeks
judicial review alleging, among other grounds, that the Commissioner erred
in law and/or jurisdiction in conducting an investigation and issuing an
Order limited to disclosures by pharmacists and pharmacies to IMS and/or
that either Alta PIPA or the federal Personal Information Protection and
Electronic Documents Act, S.C. 2000, c. 5 ("PIPEDA") had supplanted the HIA thereby making the Commissioner's Order unreasonable.
Under PIPEDA, the federal Privacy Commissioner previously conducted an
investigation and on October 2, 2001 ruled that PIPEDA did not prevent
pharmacies from disclosing prescription information to IMS. Documents
disclosed in this litigation in Alberta revealed that the Alberta
Commissioner's decision to investigate IMS was triggered by that decision of
the federal Commissioner.
2005 October 26
Fishing Lake First Nation v Paley
The Federal Court stated in obiter dicta that an adjudicator appointed under the Canada Labour Code, R.S.C. 1985, c. L-2 has lawful authority to pursuant to s. 7(3)(c)(i) of PIPEDA to order an employer to disclose to a terminated employee the amount of salary paid to her replacement. The replacement employee was not a party to the labour adjudication and had not given her consent to the release of the salary information.
The Federal Court noted that under s. 242(2)(c) of the Canada Labour Code, an adjudicator has the powers conferred on the Canada Industrial Relations Board in relation to any proceeding before that Board, which includes the power to summon and enforce the attendance of witnesses and to compel them to “produce such documents and things as the Board deems requisite to the full investigation and consideration of any matter within its jurisdiction.” In this context, the Federal Court considered that the disclosure of the replacement employee’s salary was “required by law” within the meaning of PIPEDA s. 7(3)(c)(i).
Also in obiter dicta, the Federal Court said it was satisfied that in any event the Court could make its own order pursuant to s. 7(1)(c) of PIPEDA [subpoena, warrant or court order] compelling the employer to provide the salary information.
2005 November 29
Turner v Telus Communications Inc.
Appeal dismissed, 29 January 2007, 2007 FCA 21 [see summary below]
The Federal Court held that Telus Communications Inc. was entitled to continue with its implementation of “e.Speak”, a voice recognition technology which allowed Telus employees to access and use Telus’ internal computer network by speaking commands through a telephone. “Because e.Speak is a direct connection to the Telus internal computer network, when an employee attempts to access e.Speak by telephone, their identity must be verified so that confidential information held within the date stores of the network is protected.”
Four employees of Telus and the Telecommunications Workers Union (“TWU”) took the position that they did not consent to the collection of such biometric information and that the collective agreement between the TWU and Telus did not provide consent on their behalf. The federal Privacy Commissioner rejected their complaint under PIPEDA, ruling that Telus had complied with s. 5(3) [“reasonable purposes”] and Principles 4.2 [“Identifying purposes”] and 4.7 {“Safeguards”].
On these applications to the Federal Court, the four employees and the TWU unsuccessfully sought a ruling that Telus had contravened PIPEDA by requiring employees to provide biometric personal information for Telus’ use in authenticating identity.
The TWU application was dismissed by the Federal Court on the basis it was not a proper party because it had not made a complaint under s. 11(1) of PIPEDA to the Privacy Commissioner and therefore did not fall with the definition of “complainant” in s. 14(1) of PIPEDA which authorizes a complainant to apply to Court following receipt of the Privacy Commissioner’s report.
The applications of the four employees were dismissed on the basis of s. 7(1)(a) of PIPEDA, which provides that an organization “may collect personal information without the knowledge or consent of the individual [if] the collection is in the interests of the individual and consent cannot be obtained in a timely way.” In this connection, the Court stated: “I am loathe to conclude that, on facts such as those before the Court where consent is sought from a large number of individuals by the employer of those individuals and the vast majority provide consent, while a very small minority, as here refuse consent, Parliament intended that that small minority should be able to paralyse action by the employer that it considers to be in its business interests and that view is not opposed by the vast majority of the affected employees.”
Alternatively, the Court held, Telus acted within it residual management rights by introducing e.Speak and making it applicable only to those who consented to its enrollment. The Court suggested that Telus would be entitled to implement “progressive discipline” short of termination with respect to the employee holdouts.
The Court rejected Telus submissions that the collection of biometric information was permitted pursuant to Principle 4.3 [consent not required where consent “inappropriate”] or s. 7(1)(d) [information “publicly available”].
2005 December 15
Encana Corp. v Douglas
Reversing the Alberta Court of Queen’s Bench, the Alberta Court of Appeal unanimously held that once there has been technical compliance with section 21 of the Canada Business Corporations Act (“CBCA”), which provides that a corporation must provide access to its securities register to shareholders, creditors and certain other persons, that corporation must provide access to an applicant. If a corporation provides the securities register to an applicant in accordance with section 21, it has fulfilled its obligations under both the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) and under the Alberta Personal Information Protection Act (“Alta PIPA”). However, in circumstances where a corporation has reason to believe that information in the securities register will be used for an improper purpose, a corporation is entitled to seek directions from the court as to whether it must comply with the obligation to provide access. “Suppose, for instance, that when requesting the securities register, the applicant says that he wants to use the information to solicit investments from wealthy individuals for another enterprise. In such a case, it may be proper to seek directions from the court as to whether it is relieved of its duty to provide access to the register.”[ paragraph 23]
The Court of Appeal held that privacy legislation does not modify the obligation under section 21 of the CBCA, which places the onus of protecting against misuse of the personal information of shareholders not on the corporation, but on the applicant for access to the register.
The Court of Appeal noted that statutes in different jurisdictions limit shareholder access to records including the securities register on different terms. Accordingly, the purpose of disclosure defined by each statute must be carefully examined.
2005 December 21
Osiris Inc. v 1444707 Ontario Ltd.,
On the hearing of an application by the plaintiff to remove the defendant’s solicitors from the record, the Ontario Superior Court of Justice rejected submissions that a document should be excluded from the Court record because a law firm had violated the provisions of PIPEDA by obtaining and using the document without the consent of its owners. The Court stated: “[PIPEDA] creates a procedure in which complaints of breaches of its provisions are to be received by the federal privacy commissioner and under which hearings may be conducted in the Federal Court after the Commissioner has made a report. I do not believe that on this motion, I can properly be expected to bypass that procedure and, in effect, usurp the statutory jurisdiction under the guise of deciding a question of admissibility.” The Court also held that it was not clear, in any event, that the provisions of PIPEDA had been violated.
2006 February 9
Cash Converters Canada Inc. v Oshawa (City)
The Ontario Superior Court of Justice dismissed a challenge to the validity of a City bylaw that required second-hand goods dealers to collect and transmit customer information to police to aid in preventing fencing of stolen property. The Court held that PIPEDA did not apply where the collection of “personal information” is “required by law” or “authorized by statute” (s. 7(1)(e)). The Court also stated: “It is possible to comply with the Bylaw and the federal and provincial privacy laws by simply collecting the required information with the consent of the person selling the second-hand goods to the dealer.”
2006 March 21
Morgan v Alta Flights (Charters) Inc.
The Federal Court of Appeal affirmed the 2005 decision of the Federal Court holding that no violation of PIPEDA occurred where the employer attempted, but failed, to surreptitiously record the conversations of some of its employees including the applicant. “PIPEDA does not expressly prohibit attempts to collect personal information and the word ‘collects’ cannot be interpreted to include them.
2006 March 21
Shilton v Fassnacht
The British Columbia Supreme Court held that PIPEDA has no application to a civil action for personal injuries following a motor vehicle accident which the Court described as relating to “matters wholly within the province of British Columbia.”
2006 June 13
Innovative Health Group Inc. v Calgary Health Region, 2006 ABCA 184
The Alberta Court of Appeal set aside an Order of the Alberta Court of Queen’s Bench pursuant to which the Calgary Health Region (CHR) was permitted to audit and inspect the entirety of “hybrid” files held by Innovative where a portion of each file was funded publicly and was therefore subject to Alberta’s Health Information Act and a portion was funded by a private insurer or an entity such as the Workers’ Compensation Board.
The Court of Appeal held that Alberta’s Health Information Act did not extend to the private sector and therefore that statute did not give CHR the right to review health information relating to privately funded care. The Court of Appeal rejected CHR’s argument that s. 7(3)(d)(i) of PIPEDA authorizes CHR access to the privately-funded information. “Innovative says it does not have reasonable grounds to believe that the privately-funded information relates to the breach of an agreement or of federal or provincial laws.” In this connection, the Court of Appeal noted: “Arguably, the CHR might have relied on s. 7(3)(c.1)(ii). But it cannot do so now because when it tried to access the Disputed Information, it did not explain its rationale, as required by that provision.” [Note: s. 7(3)(c.1)(ii) allows for disclosure of personal information to a government institution that has “identified its lawful authority to obtain the information and indicated that … the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law...”]
| (c.1) |
made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that |
| (i) |
it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs, |
| (ii) |
the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or |
| (iii) |
the disclosure is requested for the purpose of administering any law of Canada or a province; |
2006 September 11
S.C. (Re), [2006] O.J. No. 3754
A Justice of the Peace of the Ontario Court of Justice denied a search warrant application for the residential premises of “S.C.” on the grounds that certain information allegedly obtained by Toronto police pursuant to PIPEDA was not lawfully in police possession.
The unsuccessful police application for a search warrant relied on an affidavit (“Information to Obtain a Search Warrant”) which recited that the Internet Protocol address and residential address of “S.C.” had been obtained by Toronto police from an Internet Service Provider after police faxed the ISP a letter entitled “Letter of Request for Account Information Pursuant to a Child Sexual Exploitation Investigation” which requested that information, ostensibly under the authority of PIPEDA.
Section 7(3)(c.1)(ii) of PIPEDA provides that an organization “may disclose personal information without the knowledge or consent of the individual only if the disclosure is …made to a government institution … that has made a request for the information, identified its lawful authority to obtain the information and indicated that … the disclosure is requested for the purpose of enforcing any law of Canada…”
The Justice of the Peace held that section 7(3)(c.1)(ii) of PIPEDA (on which the police apparently relied, although the affidavit did not expressly say so) does not itself provide police with the authority to obtain the ISP subscriber information and there was no evidence that the police had otherwise identified to the ISP their “lawful authority” [within the meaning of PIPEDA s. 7(3)(c.1)(ii)] to obtain the information. Accordingly, the ISP “did not have a basis upon which to disclose the information.” “In the absence of express authority within [PIPEDA], the [Canadian] Charter [of Rights and Freedoms] right not to have one’s reasonable expectation of privacy interfered with, except through prior judicial authorization with all the protections that affords, must govern.”
2006 October 18
Blood Tribe (Department of Health) v Canada (Privacy Commissioner)
Reversing 2005 FC 328 (see above 2005 March 8), the Federal Court of Appeal held that the federal Privacy Commissioner did not have extraordinary procedural and substantive powers superior to that of a superior court of record to compel a private organization to turn over for the Commissioner’s review documents in respect of which a claim of solicitor-client privilege was being made pursuant to s. 9(3) of PIPEDA. The Federal Court of Appeal held that “little deference” should be shown to the Commissioner’s interpretation of the scope of her powers under s. 12(1)(a) and (c) of PIPEDA.
The Appeal Court noted that PIPEDA has no express language to abrogate privilege and held that “on the present record, there have been no facts alleged to demonstrate why the Privileged Documents are in any way necessary to the Commissioner’s investigation. The Appeal Court also noted that “documents subject to solicitor-client privilege would be exempt from disclosure whether or not PIPEDA purported to make them so.”
When a question of solicitor-client privilege arises under PIPEDA, the Court of Appeal held that the Commissioner should apply to the Federal Court under s. 15 of PIPEDA.
2006 October 24
Funk v Bank of Montreal
The Federal Court dismissed a preliminary motion by the Bank to strike out a customer’s application under s. 16 of PIPEDA for a court review of the federal Privacy Commissioner’s decision to reject the customer’s allegations that his privacy interests had been violated. The complaint arose from a direct marketing solicitation. On the review, the customer also sought damages from the Bank for alleged legal expenses, loss of time and revenue and humiliation. The Court acknowledged that the Bank’s concerns about the adequacy of the customer’s claim “have considerable force” but ruled that the circumstances in which the Court will strike out an application on a preliminary motion to dismiss are required to be “exceptional.” Although the Court stated that the strength of the customer’s application for review “as presently documented is certainly tenuous, it noted the possibility of an oral hearing at which time the customer might seek to supplement the evidentiary record. The Court also noted that the potential inconvenience to the Bank of having to deal with the review application on the merits could be “ameliorated by the summary nature of the process and by an award of costs if appropriate.
2006 October 26
Rousseau v Wyndowe
The Federal Court ordered a medical doctor to produce notes made by the doctor during an independent medical examination (“IME”) of the applicant, whose long-term disability benefits were terminated by an insurer following the IME. The Court held that the medical doctor’s notes constitute “personal information” within the meaning of PIPEDA. The Court found that the notes were not produced for the dominant purpose of litigation (in which case they would have been protected by litigation privilege) nor were they produced in a formal dispute resolution process within the meaning of s. 9(3) of PIPEDA, in which case they would have been exempt from disclosure.
2006 December 5
Shred-Tech Corp. v Viveen,
The Ontario Superior Court of Justice granted an application by the defendants for an order permitting them to use documents and information obtained in the discovery process in this commercial litigation to make complaints to regulatory bodies (the Federal Privacy Commissioner) against a private investigator and a private investigation agency pursuant to PIPEDA. During this lawsuit, an affidavit of documents was served on the defendants on behalf of the plaintiff which revealed to the defendants the existence of an investigation report and other information provided by the investigation agency, including information about telephone records of the defendants allegedly obtained without the defendants’ consent, and the existence of a video and audio recording created when the investigator, posing as a prospective customer, entered the business premises of one of the defendants posing as a prospective customer.
The Court stated that in this case “it would be unjust to restrict the enforcement of privacy rights to the lawsuit. If the rights were violated, damages may be awarded but such … ought not to be the exclusive remedy. Regulatory bodies, established for this very purpose, must be permitted to investigate the complaint and have made available to it the vest evidence. Preventing a regulatory investigation, by restricting the evidence that may be consider would, in effect, condone what may be an illegal act. Such is clearly not the intent of the deemed undertaking rule.”
2007 January 29
Wansink v Telus Communications Inc.
The Federal Court of Appeal, dismissing an appeal by several employees from Turner v Telus Communications Inc., 2005 FC 1601, held that the implementation of e.Speak voice recognition service by Telus did not violate the provisions of PIPEDA “in view of the fact that consent to the collection of voice characteristics was actually sought by Telus (from the employees/appellants) and that no disciplinary measure has yet been taken by Telus.
The Federal Court of Appeal expressly declined to determine whether Telus’ management rights allow it to discipline an employee who refuses to submit personal information protected by PIPEDA on several grounds: (1) the issue is hypothetical as Telus has not taken disciplinary measures; (2) the issue is a labour law dispute which should be settled in a labour law forum. “Once it is found that e.Speak is permissible under PIPEDA and that Telus applies this new technology only to the employees who consent to the collection of their voice characteristics, the employment consequences flowing from the refusal to consent to the reasonable collection of personal information are nowhere to be found in PIPEDA.” The Court of Appeal also declined to determine, whether under the terms of a collective agreement, consent may be given by a trade union on an individual employee’s behalf.”
Although the Federal Court of Appeal agreed with the finding of the Court below that the collection, use and disclosure of the employee voice characteristics was for purposes that a reasonable person would consider appropriate in the circumstances existing at the time, the Court of Appeal disagreed with the lower Court that clause 4.3 of the PIPEDA Schedule add to the exceptions in PIPEDA s. 7(1) for obtaining informed consent of the individual. Further, the Court of Appeal held that the lower Court erred in concluding that consent was not necessary because the exception in PIPEDA s. 7(1)(a) applied ( where consent cannot be obtained in a timely way and collection in the interest of the individual concerned). The Court of Appeal held the exception only applies where consent cannot be obtained (in this case, consent was refused by three of the complainants and given by the fourth), not where “consent is not obtained.” Further “the used of the words ‘in a timely way’ makes it clear that the exception [applies] only in exceptional and temporary circumstances, such as where the individual cannot be contacted before the collection of the personal information has to be done.”
2007 February 5
Lawson v Accusearch Inc. dba Abika.com
The Federal Court held that PIPEDA gives the federal Privacy Commissioner jurisdiction to investigate complaints relating to the transborder flow of personal information. The Applicant Lawson, the executive director of the Canadian Internet Policy and Public Interest Clinic at the University of Ottawa, complained to the Privacy Commissioner alleging that Accusearch, a US corporation, had collected, used and disclosed her personal information and that of other Canadians contrary to PIPEDA, for inappropriate purposes and without knowledge and consent of the individual. The Privacy Commissioner had declined to investigate on the ground she lacked jurisdiction to compel US organizations to produce the evidence necessary to conduct the investigation. The Federal Court disagreed, stating the Commissioner failed to distinguish her power to investigate from the effectiveness of her investigation. “The Commissioner does not lose her power to investigate because she can neither subpoena the organization nor enter its premises in Wyoming.” “It would be most regrettable indeed if Parliament gave the Commissioner jurisdiction to investigate foreigners who have Canadian sources of information only if those organizations voluntarily name names. Furthermore, even if an order against a non-resident might be ineffective, the Commissioner could target the Canadian sources of information.”
2006 November 27
Hydamacka v Carlson
The British Columbia Supreme Court (Master) ordered that a plaintiff in a motor vehicle lawsuit disclose to the defence her appointment book containing contact information (names and addresses) for her clients. The plaintiff was not required, however, to disclose telephone numbers. The Master applied Shilton v Fassnacht, 2006 BCSC 431, in arriving at the conclusion that the BC PIPA does not limit the defendant’s right under Rule 27(22) of the British Columbia Supreme Court Rules to obtain the names and addresses of relevant witnesses.
2006 March 21
Shilton v Fassnacht
The British Columbia Supreme Court held that BC PIPA did not limit the defendant’s right under Rule 27(22) of the British Columbia Supreme Court to obtain the names and contact information of relevant witnesses in a civil lawsuit for personal injury damages allegedly sustained as a result of a motor vehicle lawsuit. The Court noted that BC PIPA provides in s. 3(4): “This Act does not limit the information available by law to a party in a proceeding.” Further, s. 1 “specifies that ‘personal information’ does not include ‘contact information.’”
2005 April 15
In this British Columbia Supreme Court interlocutory ruling in
a personal injury case, the Court cautioned that a defendant who
wishes to interview potential medical witnesses without first obtaining
a court order “should examine the provisions of the Freedom
of Information and Protection of Privacy Act, R.S.B.C. 1996, c.
165, the Personal Information Protection Act, S.B.C. 2003, c. 63
and the Personal Information Protection and Electronic Documents
Act, S.C. 2000, c. 5.” The Court suggested that in the absence
of a court order, those statutes may affect the process of interviewing
such witnesses.
2005 December 8
Canadian Office and Professional Employees’ Union, Local 378 v
Coast Mountain Bus Co.
Although this decision of the British Columbia Court of Appeal concerns the public sector statute (Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165 (“FOIPPA”)), the unanimous reasons of the Court may provide guidance concerning the relationship between the provisions of collective agreements and privacy statutes.
The Court of Appeal held that provision in the union’s collective agreement with the employer must comply with the privacy protections defined in FOIPPA. Accordingly, in the circumstances of this case, the employer could only disclose personal information to the union if the limitations imposed by FOIPPA permitted such disclosure.
The Court of Appeal concluded that the union was entitled to certain information sought, because it would be consistent with the lawful purpose of disclosure, namely to evaluate the employer’s selection of a suitable candidate for employment.
The Court noted, however, that once the union collects the personal information, “the Personal Information Protection Act, R.S.B.C. 2003, c. 63 (the “PIPA”) applies to any subsequent use and disclosure by the union. PIPA also imposes obligations on the union to ensure that security arrangements are made to properly protect the information.”
2006 February 07
Royal City Jewellers & Loans v New Westminster (City)
The British Columbia Supreme Court upheld the validity of a City bylaw requiring pawnbrokers to provide police with detailed information concerning individuals who sell or pledge second hand goods. The Court rejected the petitioning pawnbroker’s submission that the bylaw violated privacy rights under BC PIPA, stating: “ If the PIPA applies, then I am satisfied the petitioner may collect the personal information, even without consent, where the information "is required or authorized by law", as provided by s. 12(1)(h) of that Act. Further, I note that Section 17 of the PIPA allows for disclosure of such personal information ‘for purposes that a reasonable person would consider appropriate in the circumstances and that .... are otherwise permitted under this Act’. Section 18(1)(j) allows for disclosure to a public body of personal information without consent, provided the disclosure concerns ‘an offence under the laws of Canada or a province, to assist in an investigation or the making of a decision to undertake an investigation’ (my emphasis). Once again, s. 18(1)(o) allows such disclosure without consent provided ‘the disclosure is required or authorized by law’.”
2006 March 21
Shilton v Fassnacht
The British Columbia Supreme Court held that BC PIPA did not limit the defendant’s right under Rule 27(22) of the British Columbia Supreme Court to obtain the names and contact information of relevant witnesses in a civil lawsuit for personal injury damages allegedly sustained as a result of a motor vehicle lawsuit. The Court noted that BC PIPA provides in s. 3(4): “This Act does not limit the information available by law to a party in a proceeding.” Further, s. 1 “specifies that ‘personal information’ does not include ‘contact information.’”
2005 October 5
Telus
Communications Inc. v Telecommunications Workers Union
In this proceeding, Telus unsuccessfully sought to vary an injunction
granted in July, 2005 to restrain the TWU from picketing the homes of all
Telus employees. The Albert Court of Queen's Bench noted that in support of its application,
Telus had submitted: "that breaches of privacy have occurred. Telus submits
it is reasonable to infer that that the picketers had obtained the addresses
of the residences at which they attended from union records. Telus states
that TWU is bound by Alberta's Personal Information Protection Act, S.A.
2003, c. P-6.5 ("PIPA"). In general terms PIPA prevents the use of personal
information collected by an organization without consent."
Rejected this submission and others, the Court stated that "[e]ven if a
breach of PIPA can be considered an illegal act, there is no evidence the
addresses were obtained from union records. It is equally plausible the
addresses were obtained from the phone book or from the exchange of personal
information by employees before the strike." In these circumstances, the
Court held that there was no prima facie case of a breach of privacy."
2005 October 7
IMS
Health Canada, Ltd. v Information and Privacy Commissioner
The Alberta Court of Appeal held that the Alberta Information and Privacy
Commissioner, whose jurisdiction includes the Freedom of Information and
Protection of Privacy Act, RSA 2000, c. F-25, the Health Information Act,
RSA 2000, C. H-5 ("HIA")and the Personal Information Protection Act, RSA
2003, c. P-65 ("Alta PIPA"), was required to produce to IMS all documents
which touch on the issue of his decision in January 2002 to conduct an
investigation and to issue an order on March 19, 2003 prohibiting Alberta
pharmacies from disclosing prescriber's names to IMS without the consent of
the prescriber.
In these proceedings commenced by IMS on April 17, 2003, the company seeks
judicial review alleging, among other grounds, that the Commissioner erred
in law and/or jurisdiction in conducting an investigation and issuing an
Order limited to disclosures by pharmacists and pharmacies to IMS and/or
that either Alta PIPA or the federal Personal Information Protection and
Electronic Documents Act, S.C. 2000, c. 5 ("PIPEDA") had supplanted the HIA
thereby making the Commissioner's Order unreasonable.
Under PIPEDA, the federal Privacy Commissioner previously conducted an
investigation and on October 2, 2001 ruled that PIPEDA did not prevent
pharmacies from disclosing prescription information to IMS. Documents
disclosed in this litigation in Alberta revealed that the Alberta
Commissioner's decision to investigate IMS was triggered by that decision of
the federal Commissioner.
2005 December 15
Encana Corp. v Douglas
Reversing the Alberta Court of Queen’s Bench, the Alberta Court of Appeal unanimously held that once there has been technical compliance with section 21 of the Canada Business Corporations Act (“CBCA”), which provides that a corporation must provide access to its securities register to shareholders, creditors and certain other persons, that corporation must provide access to an applicant. If a corporation provides the securities register to an applicant in accordance with section 21, it has fulfilled its obligations under both the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) and under the Alberta Personal Information Protection Act (“Alta PIPA”). However, in circumstances where a corporation has reason to believe that information in the securities register will be used for an improper purpose, a corporation is entitled to seek directions from the court as to whether it must comply with the obligation to provide access. “Suppose, for instance, that when requesting the securities register, the applicant says that he wants to use the information to solicit investments from wealthy individuals for another enterprise. In such a case, it may be proper to seek directions from the court as to whether it is relieved of its duty to provide access to the register.”[ paragraph 23]
The Court of Appeal held that privacy legislation does not modify the obligation under section 21 of the CBCA, which places the onus of protecting against misuse of the personal information of shareholders not on the corporation, but on the applicant for access to the register.
The Court of Appeal noted that statutes in different jurisdictions limit shareholder access to records including the securities register on different terms. Accordingly, the purpose of disclosure defined by each statute must be carefully examined
2006 February 17
Grams Estate v Maple Leaf Metal Industries Ltd.
In an action by the estate of a deceased worker against his employer for alleged negligence, the Alberta Court of Queen’s Bench was asked to rule whether personal information contained in enrolment forms for group insurance relating to other employees should be protected from disclosure because of the provisions of Alta PIPA.
The Court held that because many of the forms filed in evidence in this lawsuit disclosed highly personal health information of non-party employees, they should be sealed and thereby excluded from public inspection. The Court arrived at this conclusion “based on the provisions of s. 4(3)(f) and s. 21 of the Personal Information Protection Act, notwithstanding s. 4(5)(b), which permits the information to be made available by law to a party to a legal proceeding.” In this connection, the Court referred to the Alberta Court of Appeal decision in Innovative Health Group Inc. v. Capital Health Region, 2006 ABCA 7, where portions of a court file containing information about confidential informants were ordered to be sealed, albeit without any reference to Alta PIPA
|
