Personal Information Protection and Electronic Documents Act
Cases published to February 5, 2007
Click on a Case Name for full text (links off site).2007 February 5
The Federal Court held that PIPEDA gives the federal Privacy Commissioner jurisdiction to investigate complaints relating to the transborder flow of personal information. The Applicant Lawson, the executive director of the Canadian Internet Policy and Public Interest Clinic at the University of Ottawa, complained to the Privacy Commissioner alleging that Accusearch, a US corporation, had collected, used and disclosed her personal information and that of other Canadians contrary to PIPEDA, for inappropriate purposes and without knowledge and consent of the individual. The Privacy Commissioner had declined to investigate on the ground she lacked jurisdiction to compel US organizations to produce the evidence necessary to conduct the investigation. The Federal Court disagreed, stating the Commissioner failed to distinguish her power to investigate from the effectiveness of her investigation. “The Commissioner does not lose her power to investigate because she can neither subpoena the organization nor enter its premises in Wyoming.” “It would be most regrettable indeed if Parliament gave the Commissioner jurisdiction to investigate foreigners who have Canadian sources of information only if those organizations voluntarily name names. Furthermore, even if an order against a non-resident might be ineffective, the Commissioner could target the Canadian sources of information.”
2007 January 29
The Federal Court of Appeal, dismissing an appeal by several employees from Turner v Telus Communications Inc., 2005 FC 1601, held that the implementation of e.Speak voice recognition service by Telus did not violate the provisions of PIPEDA “in view of the fact that consent to the collection of voice characteristics was actually sought by Telus (from the employees/appellants) and that no disciplinary measure has yet been taken by Telus.
The Federal Court of Appeal expressly declined to determine whether Telus’ management rights allow it to discipline an employee who refuses to submit personal information protected by PIPEDA on several grounds: (1) the issue is hypothetical as Telus has not taken disciplinary measures; (2) the issue is a labour law dispute which should be settled in a labour law forum. “Once it is found that e.Speak is permissible under PIPEDA and that Telus applies this new technology only to the employees who consent to the collection of their voice characteristics, the employment consequences flowing from the refusal to consent to the reasonable collection of personal information are nowhere to be found in PIPEDA.” The Court of Appeal also declined to determine, whether under the terms of a collective agreement, consent may be given by a trade union on an individual employee’s behalf.”
Although the Federal Court of Appeal agreed with the finding of the Court below that the collection, use and disclosure of the employee voice characteristics was for purposes that a reasonable person would consider appropriate in the circumstances existing at the time, the Court of Appeal disagreed with the lower Court that clause 4.3 of the PIPEDA Schedule add to the exceptions in PIPEDA s. 7(1) for obtaining informed consent of the individual. Further, the Court of Appeal held that the lower Court erred in concluding that consent was not necessary because the exception in PIPEDA s. 7(1)(a) applied ( where consent cannot be obtained in a timely way and collection in the interest of the individual concerned). The Court of Appeal held the exception only applies where consent cannot be obtained (in this case, consent was refused by three of the complainants and given by the fourth), not where “consent is not obtained.” Further “the used of the words ‘in a timely way’ makes it clear that the exception [applies] only in exceptional and temporary circumstances, such as where the individual cannot be contacted before the collection of the personal information has to be done.”
2006 December 21
On the hearing of an application by the plaintiff to remove the defendant’s solicitors from the record, the Ontario Superior Court of Justice rejected submissions that a document should be excluded from the Court record because a law firm had violated the provisions of PIPEDA by obtaining and using the document without the consent of its owners. The Court stated: “[PIPEDA] creates a procedure in which complaints of breaches of its provisions are to be received by the federal privacy commissioner and under which hearings may be conducted in the Federal Court after the Commissioner has made a report. I do not believe that on this motion, I can properly be expected to bypass that procedure and, in effect, usurp the statutory jurisdiction under the guise of deciding a question of admissibility.” The Court also held that it was not clear, in any event, that the provisions of PIPEDA had been violated.
2006 December 5
The Ontario Superior Court of Justice granted an application by the defendants for an order permitting them to use documents and information obtained in the discovery process in this commercial litigation to make complaints to regulatory bodies (the Federal Privacy Commissioner) against a private investigator and a private investigation agency pursuant to PIPEDA. During this lawsuit, an affidavit of documents was served on the defendants on behalf of the plaintiff which revealed to the defendants the existence of an investigation report and other information provided by the investigation agency, including information about telephone records of the defendants allegedly obtained without the defendants’ consent, and the existence of a video and audio recording created when the investigator, posing as a prospective customer, entered the business premises of one of the defendants posing as a prospective customer.
The Court stated that in this case “it would be unjust to restrict the enforcement of privacy rights to the lawsuit. If the rights were violated, damages may be awarded but such … ought not to be the exclusive remedy. Regulatory bodies, established for this very purpose, must be permitted to investigate the complaint and have made available to it the vest evidence. Preventing a regulatory investigation, by restricting the evidence that may be consider would, in effect, condone what may be an illegal act. Such is clearly not the intent of the deemed undertaking rule.”
2006 October 26
The Federal Court ordered a medical doctor to produce notes made by the doctor during an independent medical examination (“IME”) of the applicant, whose long-term disability benefits were terminated by an insurer following the IME. The Court held that the medical doctor’s notes constitute “personal information” within the meaning of PIPEDA. The Court found that the notes were not produced for the dominant purpose of litigation (in which case they would have been protected by litigation privilege) nor were they produced in a formal dispute resolution process within the meaning of s. 9(3) of PIPEDA, in which case they would have been exempt from disclosure.
2006 October 24
The Federal Court dismissed a preliminary motion by the Bank to strike out a customer’s application under s. 16 of PIPEDA for a court review of the federal Privacy Commissioner’s decision to reject the customer’s allegations that his privacy interests had been violated. The complaint arose from a direct marketing solicitation. On the review, the customer also sought damages from the Bank for alleged legal expenses, loss of time and revenue and humiliation. The Court acknowledged that the Bank’s concerns about the adequacy of the customer’s claim “have considerable force” but ruled that the circumstances in which the Court will strike out an application on a preliminary motion to dismiss are required to be “exceptional.” Although the Court stated that the strength of the customer’s application for review “as presently documented is certainly tenuous, it noted the possibility of an oral hearing at which time the customer might seek to supplement the evidentiary record. The Court also noted that the potential inconvenience to the Bank of having to deal with the review application on the merits could be “ameliorated by the summary nature of the process and by an award of costs if appropriate.
2006 October 18
Reversing 2005 FC 328 (see below, 2005 March 8), the Federal Court of Appeal held that the federal Privacy Commissioner did not have extraordinary procedural and substantive powers superior to that of a superior court of record to compel a private organization to turn over for the Commissioner’s review documents in respect of which a claim of solicitor-client privilege was being made pursuant to s. 9(3) of PIPEDA. The Federal Court of Appeal held that “little deference” should be shown to the Commissioner’s interpretation of the scope of her powers under s. 12(1)(a) and (c) of PIPEDA.
The Appeal Court noted that PIPEDA has no express language to abrogate privilege and held that “on the present record, there have been no facts alleged to demonstrate why the Privileged Documents are in any way necessary to the Commissioner’s investigation. The Appeal Court also noted that “documents subject to solicitor-client privilege would be exempt from disclosure whether or not PIPEDA purported to make them so.”
When a question of solicitor-client privilege arises under PIPEDA, the Court of Appeal held that the Commissioner should apply to the Federal Court under s. 15 of PIPEDA.
2006 September 11
S.C. (Re), [2006] O.J. No. 3754
A Justice of the Peace of the Ontario Court of Justice denied a search warrant application for the residential premises of “S.C.” on the grounds that certain information allegedly obtained by Toronto police pursuant to PIPEDA was not lawfully in police possession.
The unsuccessful police application for a search warrant relied on an affidavit (“Information to Obtain a Search Warrant”) which recited that the Internet Protocol address and residential address of “S.C.” had been obtained by Toronto police from an Internet Service Provider after police faxed the ISP a letter entitled “Letter of Request for Account Information Pursuant to a Child Sexual Exploitation Investigation” which requested that information, ostensibly under the authority of PIPEDA.
Section 7(3)(c.1)(ii) of PIPEDA provides that an organization “may disclose personal information without the knowledge or consent of the individual only if the disclosure is …made to a government institution … that has made a request for the information, identified its lawful authority to obtain the information and indicated that … the disclosure is requested for the purpose of enforcing any law of Canada…”
The Justice of the Peace held that section 7(3)(c.1)(ii) of PIPEDA (on which the police apparently relied, although the affidavit did not expressly say so) does not itself provide police with the authority to obtain the ISP subscriber information and there was no evidence that the police had otherwise identified to the ISP their “lawful authority” [within the meaning of PIPEDA s. 7(3)(c.1)(ii)] to obtain the information. Accordingly, the ISP “did not have a basis upon which to disclose the information.” “In the absence of express authority within [PIPEDA], the [Canadian] Charter [of Rights and Freedoms] right not to have one’s reasonable expectation of privacy interfered with, except through prior judicial authorization with all the protections that affords, must govern.”
2006 June 13
The Alberta Court of Appeal set aside an Order of the Alberta Court of Queen’s Bench pursuant to which the Calgary Health Region (CHR) was permitted to audit and inspect the entirety of “hybrid” files held by Innovative where a portion of each file was funded publicly and was therefore subject to Alberta’s Health Information Act and a portion was funded by a private insurer or an entity such as the Workers’ Compensation Board.
The Court of Appeal held that Alberta’s Health Information Act did not extend to the private sector and therefore that statute did not give CHR the right to review health information relating to privately funded care. The Court of Appeal rejected CHR’s argument that s. 7(3)(d)(i) of PIPEDA authorizes CHR access to the privately-funded information. “Innovative says it does not have reasonable grounds to believe that the privately-funded information relates to the breach of an agreement or of federal or provincial laws.” In this connection, the Court of Appeal noted: “Arguably, the CHR might have relied on s. 7(3)(c.1)(ii). But it cannot do so now because when it tried to access the Disputed Information, it did not explain its rationale, as required by that provision.” [Note: s. 7(3)(c.1)(ii) allows for disclosure of personal information to a government institution that has “identified its lawful authority to obtain the information and indicated that … the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law…”]
(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that
(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,
(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or
(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;
2006 March 21
The Federal Court of Appeal affirmed the 2005 decision of the Federal Court holding that no violation of PIPEDA occurred where the employer attempted, but failed, to surreptitiously record the conversations of some of its employees including the applicant. “PIPEDA does not expressly prohibit attempts to collect personal information and the word ‘collects’ cannot be interpreted to include them.
2006 March 21
The British Columbia Supreme Court held that PIPEDA has no application to a civil action for personal injuries following a motor vehicle accident which the Court described as relating to “matters wholly within the province of British Columbia.”
2006 February 9
The Ontario Superior Court of Justice dismissed a challenge to the validity of a City bylaw that required second-hand goods dealers to collect and transmit customer information to police to aid in preventing fencing of stolen property. The Court held that PIPEDA did not apply where the collection of “personal information” is “required by law” or “authorized by statute” (s. 7(1)(e)). The Court also stated: “It is possible to comply with the Bylaw and the federal and provincial privacy laws by simply collecting the required information with the consent of the person selling the second-hand goods to the dealer.”
2005 December 15
Reversing the Alberta Court of Queen’s Bench, the Alberta Court of Appeal unanimously held that once there has been technical compliance with section 21 of the Canada Business Corporations Act (“CBCA”), which provides that a corporation must provide access to its securities register to shareholders, creditors and certain other persons, that corporation must provide access to an applicant. If a corporation provides the securities register to an applicant in accordance with section 21, it has fulfilled its obligations under both the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) and under the Alberta Personal Information Protection Act (“Alta PIPA”). However, in circumstances where a corporation has reason to believe that information in the securities register will be used for an improper purpose, a corporation is entitled to seek directions from the court as to whether it must comply with the obligation to provide access. “Suppose, for instance, that when requesting the securities register, the applicant says that he wants to use the information to solicit investments from wealthy individuals for another enterprise. In such a case, it may be proper to seek directions from the court as to whether it is relieved of its duty to provide access to the register.”[ paragraph 23]
The Court of Appeal held that privacy legislation does not modify the obligation under section 21 of the CBCA, which places the onus of protecting against misuse of the personal information of shareholders not on the corporation, but on the applicant for access to the register.
The Court of Appeal noted that statutes in different jurisdictions limit shareholder access to records including the securities register on different terms. Accordingly, the purpose of disclosure defined by each statute must be carefully examined.
2005 November 29
The Federal Court held that Telus Communications Inc. was entitled to continue with its implementation of “e.Speak”, a voice recognition technology which allowed Telus employees to access and use Telus’ internal computer network by speaking commands through a telephone. “Because e.Speak is a direct connection to the Telus internal computer network, when an employee attempts to access e.Speak by telephone, their identity must be verified so that confidential information held within the date stores of the network is protected.”
Four employees of Telus and the Telecommunications Workers Union (“TWU”) took the position that they did not consent to the collection of such biometric information and that the collective agreement between the TWU and Telus did not provide consent on their behalf. The federal Privacy Commissioner rejected their complaint under PIPEDA, ruling that Telus had complied with s. 5(3) [“reasonable purposes”] and Principles 4.2 [“Identifying purposes”] and 4.7 {“Safeguards”].
On these applications to the Federal Court, the four employees and the TWU unsuccessfully sought a ruling that Telus had contravened PIPEDA by requiring employees to provide biometric personal information for Telus’ use in authenticating identity.
The TWU application was dismissed by the Federal Court on the basis it was not a proper party because it had not made a complaint under s. 11(1) of PIPEDA to the Privacy Commissioner and therefore did not fall with the definition of “complainant” in s. 14(1) of PIPEDA which authorizes a complainant to apply to Court following receipt of the Privacy Commissioner’s report.
The applications of the four employees were dismissed on the basis of s. 7(1)(a) of PIPEDA, which provides that an organization “may collect personal information without the knowledge or consent of the individual [if] the collection is in the interests of the individual and consent cannot be obtained in a timely way.” In this connection, the Court stated: “I am loathe to conclude that, on facts such as those before the Court where consent is sought from a large number of individuals by the employer of those individuals and the vast majority provide consent, while a very small minority, as here refuse consent, Parliament intended that that small minority should be able to paralyse action by the employer that it considers to be in its business interests and that view is not opposed by the vast majority of the affected employees.”
Alternatively, the Court held, Telus acted within it residual management rights by introducing e.Speak and making it applicable only to those who consented to its enrollment. The Court suggested that Telus would be entitled to implement “progressive discipline” short of termination with respect to the employee holdouts.
The Court rejected Telus submissions that the collection of biometric information was permitted pursuant to Principle 4.3 [consent not required where consent “inappropriate”] or s. 7(1)(d) [information “publicly available”].
2005 October 26
The Federal Court stated in obiter dicta that an adjudicator appointed under the Canada Labour Code, R.S.C. 1985, c. L-2 has lawful authority to pursuant to s. 7(3)(c)(i) of PIPEDA to order an employer to disclose to a terminated employee the amount of salary paid to her replacement. The replacement employee was not a party to the labour adjudication and had not given her consent to the release of the salary information.
The Federal Court noted that under s. 242(2)(c) of the Canada Labour Code, an adjudicator has the powers conferred on the Canada Industrial Relations Board in relation to any proceeding before that Board, which includes the power to summon and enforce the attendance of witnesses and to compel them to “produce such documents and things as the Board deems requisite to the full investigation and consideration of any matter within its jurisdiction.” In this context, the Federal Court considered that the disclosure of the replacement employee’s salary was “required by law” within the meaning of PIPEDA s. 7(3)(c)(i).
Also in obiter dicta, the Federal Court said it was satisfied that in any event the Court could make its own order pursuant to s. 7(1)(c) of PIPEDA [subpoena, warrant or court order] compelling the employer to provide the salary information.
2005 October 7
The Alberta Court of Appeal held that the Alberta Information and Privacy Commissioner, whose jurisdiction includes the Freedom of Information and Protection of Privacy Act, RSA 2000, c. F-25, the Health Information Act, RSA 2000, C. H-5 (“HIA”)and the Personal Information Protection Act, RSA 2003, c. P-65 (“Alta PIPA”), was required to produce to IMS all documents which touch on the issue of his decision in January 2002 to conduct an investigation and to issue an order on March 19, 2003 prohibiting Alberta pharmacies from disclosing prescriber’s names to IMS without the consent of the prescriber.
In these proceedings commenced by IMS on April 17, 2003, the company seeks judicial review alleging, among other grounds, that the Commissioner erred in law and/or jurisdiction in conducting an investigation and issuing an Order limited to disclosures by pharmacists and pharmacies to IMS and/or that either Alta PIPA or the federal Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”) had supplanted the HIA thereby making the Commissioner’s Order unreasonable.
Under PIPEDA, the federal Privacy Commissioner previously conducted an investigation and on October 2, 2001 ruled that PIPEDA did not prevent pharmacies from disclosing prescription information to IMS. Documents disclosed in this litigation in Alberta revealed that the Alberta Commissioner’s decision to investigate IMS was triggered by that decision of the federal Commissioner.
2005 August 25
Rosic v. Mayer, [2005] O.J. No. 3539
The Ontario Superior Court of Justice (Small Claims Court) held that PIPEDA did not give rise to a cause of action against the defendant, who in October 2002 provided a written statement to police concerning three alleged incidents with the plaintiff in the workplace, because in 2002 that statute only applied to federal undertakings, international and interprovincial trade and the health sector. “PIPEDA was not applicable to all organizations (individuals) until 2004, well after the subject events occurred.” Further, the Court stated that “PIPEDA sets up its own regime for enforcement of the legislation through the Privacy Commissioner and the Federal Court.”
2005 July 22
The British Columbia Supreme Court rejected submissions by the defendant bank that either s. 7(3)(d)(i) or s. 7(3)(h.2) of PIPEDA authorized the defendant bank to release certain personal information about the plaintiffs’ business and personal accounts to another bank.
PIPEDA s. 7(3) (d) (i) provides that disclosure of personal information does not require knowledge or consent of the individual if it is (1) made on the initiative of the organization (2) to an “investigative body” and (3) the organization has reasonable grounds to believe the disclosed information relates to a breach of agreement or a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or will be committed. All three conditions must be satisfied.
In this case, the Court held that that condition (2) had not been met as there was no evidence that the representatives of the bank which received the information from the defendant were designated as officers of the “Bank Crime Prevention and Investigation Office of the Canadian Bankers Association” which is designated by regulation as an “investigative body.”
PIPEDA s. 7(3)(h.2) provides for disclosure without knowledge or consent where it is made by an “investigative body” and the disclosure is reasonable for the purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.
The Court accepted the plaintiff’s submission that the defendant bank’s officers who made the disclosure were not designated members of the “Bank Crime Prevention and Investigation Office of the Canadian Bankers Association” and that in consequence s. 7(3)(h.2) did not apply.
2005 July 15
Lawrence v. Toronto Humane Society, [2005] O.J. No. 3078
The Ontario Superior Court of Justice side-stepped the questions whether PIPEDA applied to a request to the defendant society to furnish the applicant with a list setting out the names and addresses of all persons who are members of the respondent society as shown on its books. The Court held that the applicant had not delivered an affidavit, a prerequisite required by s. 307 of the Ontario Corporations Act, R.S.O. 1990, c. C-38, showing that the information sought was to be used only for purposes connected with the respondent society.
2005 June 16
[NOTE: This decision of the Court of Queen’s Bench was set aside by the Alberta Court of Appeal on 2006 June 13 and a new order substituted: 2006 ABCA 184, see summary above]
In the instant case, the Alberta Court of Queen’s Bench ruled that the Calgary Health Region (CHR) had the right to audit and inspect certain files held by Innovative where a portion of each file was funded publicly (and was therefore subject to Alberta’s Health Information Act) and a portion was funded by a private insurer or an entity such as the Workers’ Compensation Board.
The Court of Queen’s Bench reasoned in the alternative that if information in such “hybrid” files which includes information about privately-funded treatment was not subject to the Health Information Act, that information would be subject to PIPEDA.
The Court of Queen’s Bench noted that health information in Alberta is not subject to Alberta’s Personal Information Protection Act, which has been declared substantially similar” to PIPEDA under s. 26(2)(b) of PIPEDA and the Exemption Order Regulation.
Accordingly, the Court of Queen’s Bench reasoned, “it would appear PIPEDA continues to apply to private sector health information in Alberta.” “As a consequence, if the [files containing private sector funded patient information] were not subject to the [Health Information Act], then the use and disclosure of health information would be governed by PIPEDA.”
Although the Court of Queen’s Bench concluded that the entirety of each file maintained by Innovative fell under Alberta’s Health Information Act, it concluded in the alternative that the CHR would be entitled under s. 7(3)(d)(i) and s. 7(3)(i) of PIPEDA to conduct an audit of those files without the consent of the patient. “The investigation of the possibility of fraudulent or irregular billing is one of the purposes of the audit and as such it falls within those sections.”
2005 May 19
The Federal Court of Appeal dismissed an appeal by BMG Canada from the decision of the Chambers judge [See 2004 March 31, 2004 FC 488] who rejected an application by the plaintiffs for an order compelling five Canadian internet service providers to identify certain customers who allegedly infringed copyright laws by illegally trading in music downloaded from the internet. The Chambers judge declined to make an order for disclosure – which would have invoked the exemption to consent prescribed by s. 7(3) (c) of PIPEDA-because the applicants had not satisfied certain elements of the common law test for granting an “equitable bill of discovery” which the Court held should apply to Rule 238 of the Federal Court Rules in a John Doe action.
The Federal Court of Appeal agreed with the Chambers judge that the criteria relating to granting an equitable bill of discovery applied to a motion under Rule 238 of the Federal Court Rules.
However, the Court of Appeal held the Chambers judge erred in concluding the plaintiffs had to present evidence of a prima facie case, holding they merely had to show a bona fide claim, namely a genuine intent to bring an action for copyright infringement and that the information is not sought for an improper purpose.
The Federal Court of Appeal agreed that privacy is a an important consideration, and held caution must be exercised by the Courts in ordering disclosure of personal information, to make sure that privacy rights are invaded in the most minimal way.
The Court held that in this case, because a lengthy delay between the time the request for the identities was made by the plaintiffs and the time the plaintiffs would collect their information, there is a risk that the information as to identity may be inaccurate. This is because an IP address may not be associated with the same individual for long periods of time. Therefore it is possible that the privacy rights of innocent persons would be infringed and legal proceedings against such persons would be without justification.
The Court held that the greatest care should be taken to avoid delay between the investigation and the request for information. Failure to take such care might well justify a court in refusing to make a disclosure order.
Further, plaintiffs should be careful not to extract irrelevant information, as this might amount to a breach of PIPEDA by the ISPs leaving them open to prosecution. If a disclosure order is granted, specific directions should be given as to the type of information disclosed and the manner in which it can be used. In addition, it must be said that where there exists evidence of copyright infringement, privacy concerns may be met if the court orders that the user only be identified by initials, or makes a confidentiality order.
2005 April 15
In this British Columbia Supreme Court interlocutory ruling in a personal injury case, the Court cautioned that a defendant who wishes to interview potential medical witnesses without first obtaining a court order “should examine the provisions of the Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, the Personal Information Protection Act, S.B.C. 2003, c. 63 and the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5.” The Court suggested that in the absence of a court order, those statutes may affect the process of interviewing such witnesses.
2005 March 29
The Federal Court held that no violation of PIPEDA occurred where the employer attempted, but failed, to surreptitiously record the conversations of some of its employees including the applicant: “The law of attempted breach does not exist under the Act.”
2005 March 8
The Federal Court held that the federal Privacy Commissioner was entitled to order pursuant to s. 12(1)(a) and (c) of PIPEDA that the Blood Tribe Health Department to produce certain documents over which it claimed solicitor-client privilege in order to assess whether the solicitor-client objection applies. “Parliament has given the Commissioner the power to intervene in disputes between individuals and organizations over the retention and use of personal information, the responsibility to determine the facts and the duty to prepare report on her findings. I agree with the respondent that she cannot effectively perform that role is she is denied access to the information necessary to ascertain the facts merely on the assertion of a claim of privilege.” [THE FEDERAL COURT OF APPEAL DISAGREED THAT PIPEDA CONFERRED THIS POWER ON THE COMMISSIONER]
2004 December 16
National Automobile, Aerospace, Transportation and General Workers Union of Canada (CAW-Canada) Local 100 v. Canadian National Railway co., [2004] M.J. No. 480
The Manitoba Court of Queen’s Bench granted an interim (not interlocutory) injunction until the hearing of the application for an interlocutory injunction. The interim injunction permitted the employer to maintain video surveillance only of four pieces of equipment. Any other video surveillance was to be prohibited. The Court noted that at the hearing of the interlocutory application, once the defence had filed its evidence, the Court would be asked to determine whether the employer’s video surveillance violated inter alia PIPEDA.
2004 November 17
The Federal Court of Appeal allowed, in part, an appeal by the Applicant from a decision of the Federal Court which had dismissed the Application. The Court of Appeal held that the federal Privacy Commissioner, and the lower court, had erred in finding that none of the Applicant’s complaints against the respondent Telus were valid.
The Court of Appeal held that in interpreting Schedule 1 of PIPEDA, which does not lend itself to rigorous construction because of its non-legal drafting, flexibility, common sense and pragmatism will best guide the Court.
At a hearing pursuant to s. 14(1) of PIPEDA, the Court proceeds de novo and the report of the Privacy Commissioner, if put in evidence, may be challenged or contradicted like any other document adduced in evidence. Further, pursuant to s. 15 of PIPEDA, the Commissioner may appear as a party to the hearing.
Only a complainant with respect to whose complaint a report was prepared by the Commissioner can apply to the Court.
Where the Commissioner has prepared a report, and where his decision to do so has not been challenged, the individual who has filed the complaint becomes a complainant for the purposes of an application to Court pursuant to section 14 of PIPEDA as soon as the report is sent to that individual, whether or not his own personal information is at stake.
Nevertheless, the Court retains inherent jurisdiction to decline to hear a matter which no longer has any object or which is normally considered non-justiciable.
Principals 2 (“Identifying Purposes) and 3 (“Consent”) were at the heart of the appeal. In this regard, the Court held that proper consent was not, could not have been given, by TELUS first-time customers with respect to use by TELUS of the personal information in its Internet directory assistance service, in its Directory File Service and Basic Listing Interchange File Service and its CD-ROM service. Those services were not identified at the time of enrolment and there was no evidence they were so connected with the primary purposes of telephone directories that a new customer would reasonably consider them as appropriate. There was no evidence that TELUS made any “effort,” let alone a “reasonable” one, within the meaning of clause 4.3.2, to ensure that its first-time customers were advised of the secondary purposes at the time of collection.
The lower court’s finding that first time customers can be considered to have consented to the primary uses if they do not, on their own initiative, request an unlisted number, was not compatible with the very exercise of seeking informed consent before or at the time of enrolment mandated by Part 1 of [PIPEDA] and by Schedule 1.
Consent is not informed if the person allegedly giving it is not aware at the time of giving it that he or she had the possibility to opt-out.
First-time customers have the right to know — before their personal information becomes “publicly available” within the meaning of section 7 of [PIPEDA], with all the consequences that might flow from such publicity — that they can exercise their right to privacy and choose not to be listed.
The Court of Appeal proceeded on the assumption that the CRTC has jurisdiction to set the rates for use of the Non-Published Number Service.
In the circumstances of this case, where s. 4(3) was applicable, PIPEDA took precedence over the federal Telecommunications Act. The Federal Court has the power to decide whether the imposition of a fee for the Non-Published Number Service is permissible under clause 4.3.3 of Schedule 1 of PIPEDA.
In this case, the imposition of a fee did not violate PIPEDA. Nothing in PIPEDA expressly prohibits fees. In the circumstances of this case, the fee facilitates, rather than restricts, the right to privacy and there was no evidence that the rate was unbearable.
2004 September 29
The Ontario Superior Court of Justice rejected submissions by the plaintiff in a personal injury case that PIPEDA prevented him from disclosing on examination for discovery certain records about the plaintiff’s customers (including names and addresses). The Court was “not persuaded that [PIPEDA] applies to a provincially regulated business and its employees such as CIBC World Markets Inc. and the plaintiff. CIBC World Markets Inc. is a stockbroker, not a bank.” Nevertheless, the Court declined the order sought by the defendant, ruling that in the circumstances of the case, the relationship between investors and their brokers and financial advisors should be protected as confidential.
2004 September 8
The Ontario Superior Court of Justice held that the fact that the Criminal Code of Canada and the Firearms Act and Regulations enacted by the Federal Parliament under its criminal law power applied to the recreational shooting activities of the defendant association did not make the defendant a “federal work or undertaking” within the meaning of PIPEDA.
The Court further held that producing a membership list pursuant to s. 307 of the Corporations Act (Ontario) was not a “commercial activity” within the meaning of PIPEDA, relying on the interpretation from the federal Privacy Commissioner that “collecting membership fees, organizing club activities, compiling a list of member’s names and addresses and mailing out newsletters are not considered commercial activities.”
In ordering the defendant association to disclose its membership list to the plaintiff, who was the subject of expulsion proceedings, the Court found it unnecessary to address the defendant association’s submission that the words “required by law” in s. 7(3)(i) of PIPEDA did not apply to s. 307 of the Corporations Act but only to case law.
2004 July 6
The Ontario Superior Court of Justice, hearing an interlocutory appeal from a ruling of a Master relating to questions objected to on examination for discovery, rejected submissions by the plaintiff that disclosure of certain information to the defendant of certain information relating to employees and former employees of the plaintiff would violate the Personal Information Protection and Electronic Documents Act. The Court held that disclosure was expressly permitted by PIPEDA section 7(3)(c) which provides that “an organization may disclose personal information without the knowledge or consent of the individual …if the disclosure is …required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of the information, or to comply with rules of court relating to the production of records.”
2004 June 11
The Federal Court dismissed an application by a union human rights representative for an Order that the respondent railroad comply with a determination by the Privacy Commissioner that a complaint about video cameras in the workplace was well-founded and recommending that the railroad remove the cameras.
The Court rejected the respondent employer’s submission that the Court lacked jurisdiction on the basis the dispute gave rise to the exclusive labour arbitration model espoused by the Supreme Court of Canada in Weber v Ontario Hydro, [1995] 2 S.C.R. 929. Parliament’s intention in enacting PIPEDA was not to exclude unionized workers from the scope of PIPEDA. Further, in the circumstances of this case, the essence of the dispute did not arise from the collective agreement. There was nothing which dealt with personal information and how it may be collected in the workplace.
A proceeding under s. 14 of PIPEDA is not a review of the Privacy Commissioner’s report or his recommendation. It is a fresh application to this Court by a person who had made a complaint to the Privacy Commissioner under PIPEDA and who, in order to obtain a remedy under section 16, bears the burden of demonstrating there has been a violation of PIPEDA obligations.
The Court may accord the federal Privacy Commissioner some deference in his area of expertise (including appropriate recognition to the factors the Commissioner took into account in balancing interests), but did not accord any deference to the Commissioner’s findings of fact because the evidence before the Court was considerably different than that gathered by the Privacy Commissioner.
The employer’s reasons for the video cameras were purposes that a reasonable person would consider appropriate in the circumstances.
In this regard, the Court took into account and was guided by the following factors:
- Was camera surveillance and recording necessary to meet a specific need?
- Was camera surveillance and recording likely to be effective in that need?
- Was the loss of privacy proportional to the benefit gained?
- Was there a less privacy-invasive way of achieving the same end?
- These factors may not necessarily be relevant in other contexts.
The camera system had several appropriate fences: the collection was not surreptitious; not continuous (only when within footprint of the camera); not limited to employees (it captured contractors, visitors, suppliers and trespassers); not used to measure employee work performance; recorded images were kept under lock and key and only accessed by responsible managers and police if an incident was reported. Numerous past incidents justified the need to have surveillance cameras in place.
S. 7(1) of [PIPEDA] has given content to the words ‘except where inappropriate’ found in section 4.3 of the Schedule. S. 4.3 prescribes only four circumstances where collection may take place without knowledge or consent.
The words “except where inappropriate” contained in section 4.3 of Schedule 1 to PIPEDA do not enable the Privacy Commissioner or the Court to make a determination when the knowledge or consent of the individual whose personal information is being collected is unnecessary in the circumstances.
The exemption from consent provided in s. 7(1)(b) of PIPEDA applied.
2004 April 14
The Ontario Superior Court of Justice rejected submissions of the plaintiff that certain video surveillance evidence relating to the plaintiff, gathered by a private investigator hired by the defendant to a medical malpractice action, was inadmissible as having been obtained in violation of PIPEDA.
PIPEDA does not contain a provision making information obtained in violation of that statute inadmissible in court proceedings and the reception of this evidence would not make the trial unfair.
PIPEDA did not in any event apply. The private investigator was not collecting a making a record during the course of “commercial activity” within the meaning of PIPEDA because he was acting as an agent for the defendant, who was collecting the disclosing the information for personal purposes within the meaning of s. 4(2). The defendant, through his agents, was collecting information to defend himself against the lawsuit brought by the plaintiff. This is a personal purpose in the context of the civil action brought against him by the plaintiff.
Further, the plaintiff gave implied consent to the collection and use by commencing an action which put the conduct recorded in the video surveillance in issue.
Further, the exemptions in s. 7(1)(b), 7(2)(d) and 7(3)(c) and (i) of PIPEDA applied. With respect to s. 7(1)(b), “the law of Canada or a Province” includes the common law, including the law of tort. In this case, the “surveillance” was “related to investigating” the claim made by the plaintiff against the defendant. Disclosure of the surveillance efforts or seeking the consent of the plaintiff would “compromise the availability or the accuracy of the information.” Once the collection is found to be within s. 7(1)(b), it can be used pursuant to s. 7(2)(d). Section 7(3)(c) and (i) are broad enough to cover the disclosure of the information in accordance with the rules of court and at a trial.
2004 March 31
The Federal Court rejected an application by the BMG Canada and other plaintiffs for an order compelling five Canadian internet service providers to identify certain customers who allegedly infringed copyright laws by illegally trading in music downloaded from the internet.
The Court declined to make an order for disclosure – which would have invoked the exemption to consent prescribed by s. 7(3)(c) of PIPEDA-because the Applicants had not satisfied certain elements of the common law test for granting an “equitable bill of discovery” which should apply to Rule 238 of the Federal Court Rules in a John Doe action, namely:
- The applicant must establish a prima facie case against the unknown alleged wrongdoer;
- The person from whom discovery is sought must be in some way involved in the matter under dispute, he must be more than an innocent bystander;
- The person from whom discovery is sought must be the only practical source of the information available to the applicants;
- The person from whom discovery is sought must be reasonably compensated for his expenses arising out of compliance with the discovery order in addition to his legal costs;
- The public interests in favour of disclosure must outweigh the legitimate privacy concerns.
2003 November 27
The Federal Court of Appeal unanimously dismissed an appeal by IMS Canada from the decision of Blais J., 2003 FCT 1, which reversed a decision of the Prothonotary. 2002 FCT 558
2003 September 3
The Federal Court held that neither the federal Privacy Commissioner nor the Court had jurisdiction to consider a complaint that the respondent had not complied with s. 4.3 of Schedule 1 and s. 5(3) of PIPEDA regarding disclosure of personal information of the plaintiff to third parties. The matter fell within the exclusive jurisdiction of a labour grievance arbitrator [applying Weber v Ontario Hydro [1995] 2 S.C.R. 929] because the dispute arose from the interpretation, application, administration or failure to implement a collective agreement.”
The Court also found the Application to be without merit on the grounds that the Applicant consented, at least by implication, to disclosure of certain personal information to the union representatives.
2003 September 3
Air Canada c. Constant, [2003] J.Q. No. 11619
The Quebec Superior Court held that Air Canada, an airline, was not subject to the jurisdiction of the Quebec Access to Information Commission under Quebec’s Law for the Protection of Personal Information in the Private Sector, L.R.Q., c. P-39.1. Air Canada was exclusively under federal jurisdiction.
2003 January 3
Maheu v. IMS Health Canada, 2003 FCT 1, reversing Maheu v IMS Health Canada, 2002 FCT 558 [See below: affirmed by the Federal Court of Appeal, 2003 FCA 462]
Justice Lemieux of the Federal Court of Canada set aside a decision of a Prothonotary requiring the plaintiff to post security for costs an Application, following a report by the federal Privacy Commissioner, for a determination whether the practices of a business competitor comply with PIPEDA in terms of relevant collection gathering techniques involving personal information. It was not relevant that the Applicant’s personal information was not at stake, as PIPEDA is a public regulatory statute providing for the means of enforcement through complaints, the Privacy Commissioner’s investigation, report and an appeal by the complainant as of right to the Federal Court.
2002 April 30
The British Columbia Supreme Court ordered Telus to produce certain records sought by the plaintiffs relating to the investigation of the conduct and subsequent suspension of two employees who the plaintiffs alleged breached privacy rights by accessing telephone, electronic mail, or facsimile records of the plaintiff union locals and officials. The Court rejected Telus’ submissions that such an Order should not be made because it would be a grave thing to override privacy rights created by PIPEDA (and Telus’ General Terms of Service and Privacy Code), ruling that Telus had failed to show that disclosing the records would reveal confidential customer information.
2002 January 31
Rosen v. CIBC, [2002] O.J. No. 1103
The Toronto Small Claims Court held there was no right of action under PIPEDA where the plaintiff was negligent in the use of his bank debit card and openly punched in his PIN at a drugstore in full sight of strangers.
2001 October 16
Thomas v. Robinson, [2001] O.J. No. 4373
The Ontario Superior Court of Justice held that PIPEDA applied to an electronic database containing personal information provided by prospective life insurance agents, both within Ontario and in other provinces, insofar as the database included information complied in respect of agents from outside Ontario, or in respect of applications to insurers who were located outside Ontario.
The Court examined applicant documentation and held that it was sufficient to constitute adequate consent on the part of the agent to the compilation of the personal information but required amendment if the information was to be used in respect of a new application at a later time.
2001 June 12
Lisozzi v. Bell Distribution Inc., [2001] O.J. No. 2378
The Ontario Superior Court of Justice held that discovery of documents in civil litigation conducted under the Ontario Rules of Civil Procedure is exempt from the provisions of PIPEDA which generally require individual consent for the disclosure of personal information. PIPEDA s.7 (3) (c) expressly provides that disclosure can be made to comply with an order of the court or to comply with rules of court relating to the production of records. PIPEDA does not create a claim of privilege to be advanced as justification for not producing a relevant document.
