Teresa Scassa - Blog

Displaying items by tag: Privacy

The Supreme Court of Canada has struck down Alberta’s Personal Information Protection Act (PIPA), on the grounds that it violates the guarantee of freedom of expression in the Canadian Charter of Rights and Freedom. The invalidation of the legislation has been suspended for 12 months to give the Alberta government time to amend the legislation so as to bring it into compliance with the Charter.

The conflict between privacy rights and the freedom of expression in Information and Privacy Commissioner of Alberta v. United Food and Commercial Workers, Local 401 arose after an adjudicator under PIPA ruled that the Union’s practice of taking photographs and videotapes of people crossing its picket line during a labour dispute – and of using some of the footage on its website – contravened the data protection statute. Judges at the Alberta Court of Queen’s Bench and the Alberta Court of Appeal had found that to the extent that PIPA restrained the ability of the Union to collect, use and disclose personal information in relation to a labour dispute it violated the Union’s freedom of expression. Although the statute contains a series of exceptions that cover a range of circumstances, none of these exceptions were available to the Union. Some of these exceptions were specifically crafted to balance privacy rights with the freedom of expression, but the exceptions for material collected, used or disclosed “for journalistic purposes and for no other purpose” or “for artistic or literary purposes and for no other purpose” were found not to apply to the Union’s activities. As a result, the limitation on the freedom of expression was not mitigated, and the legislation was found to contravene the Charter.

In substance, the Supreme Court of Canada was of much the same view as the courts below. Emphasizing the importance of freedom of expression in the labour relations context, Justices Abella and Cromwell, for a unanimous court, found that the private sector data protection statute did not properly balance this freedom with privacy rights.

In reaching their decision, Justices Abella and Cromwell emphasized the quasi-constitutional nature of data protection legislation “because of the fundamental role privacy plays in the preservation of a free and democratic society.” (at para 19) The Court also emphasized that control over one’s personal information was of central importance to the human values of autonomy, dignity and privacy. While the court has made statements of this nature before, it is important to hear them used in relation to private sector data protection legislation.

However, the Court criticized PIPA for limiting the collection, use and disclosure of personal information, other than with consent, “without regard for the nature of the personal information, the purpose for which it is collected, used or disclosed, and the situational context for that information.” (para 25). While this may be true in the particular factual context of this case (in other words, there is no exception tailored to the labour relations context) it is not true generally, as PIPA does indeed include a raft of exceptions to the consent principle that are tailored to a wide range of contexts, including investigations, audits, archival purposes, and so on. There are also the above-noted exceptions for journalistic, artistic or literary purposes, and further exceptions for information collected for purely private or domestic purposes. The flaw, it would seem, is that PIPA does not contain an exception crafted to deal with the labour relations context. This is supported by the Court’s statement that “the Act does not include any mechanisms by which a union’s constitutional right to freedom of expression may be balanced with the interests protected by the legislation.” (at para 25) Later in the decision the Court states that “[t]o the extent that PIPA restricted the Union’s collection, use and disclosure of personal information for legitimate labour relations purposes, the Act violates s. 2(b) of the Charter and cannot be justified under s. 1.” (at para 38) It would appear, then, that the constitutional violation is narrowly cast; a fairly straightforward way for the legislature to respond to the Court’s decision would be to craft an exception specifically for the labour relations context.

It is worth noting that the Court also specifies that PIPA is “considerably broader” in scope than the federal private data protection statute, the Personal Information Protection and Electronic Documents Act (PIPEDA). This is because PIPEDA applies only to the collection, use or disclosure of personal information in the course of commercial activity. Thus it would not have applied in the circumstances of this case. PIPA, by contrast, applies to organizations engaged in a much broader range of activities; its application specifically extends to trade unions. The distinction is important: in the unlikely event that the Alberta government does not act to save its legislation, PIPEDA would fill the gap left by PIPA’s invalidation, and would apply to private sector data collection, use and disclosure in the course of commercial activity in Alberta. The distinction also suggests that PIPEDA itself is not at risk of being found unconstitutional on these grounds, and that Parliament need not act to save it from such peril. This is just as well, since Parliament’s inability or unwillingness to reform PIPEDA is by now well-established.

It is noteworthy that the Court states that “[i]t goes without saying that by appearing in public, an individual does not automatically forfeit his or her interest in retaining control over the personal information which is thereby exposed.” (at para 27). It is not to be assumed that this goes without saying. For example, in the Leon’s Furniture decision from the Alberta Court of Appeal, for which leave to appeal to the Supreme Court of Canada was refused, the majority of the Court of Appeal had appeared to find a correlation between private and personal information, suggesting that information in public view was somehow exempt from the reach of data protection legislation. The affirmation by the Supreme Court of Canada that information in public can still be personal information is more important than the Court lets on.

The decision in this case raises issues for British Columbia’s Personal Information Protection Act, which, like its Alberta counterpart, applies to trade unions. It will also have implications for the newly enacted, though not yet in force, Personal Information Protection and Identity Theft Prevention Act in Manitoba. This statute, which has other issues, also extends in its application to unions. The BC and Manitoba legislatures may thus also need to turn their attention to crafting an exception relating to the application of the statute to the labour relations context.

Published in Privacy

A recent decision of the Federal Court of Canada may demonstrate a new willingness to give greater bite to the rather limited recourses available under federal data protection legislation for privacy breaches.

A chronic problem with private sector data protection law in Canada has been the rather impoverished remedial arsenal available to address privacy breaches. In those contexts where the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, for example, the Federal Privacy Commissioner plays the role of an ombud. She is able to investigate complaints and to make recommendations, but has no order-making powers. She has recommended that PIPEDA be amended not only to give her such powers, but also to enable her to impose fines on organizations in cases of egregious privacy breaches. Parliament, however, has shown little interest in amending PIPEDA to address these and other concerns.

Absent any real enforcement powers in the hands of the Privacy Commissioner, individuals who have filed complaints under PIPEDA receive a report on the investigation of their complaint, complete with non-binding recommendations. Should they wish to see these recommendations enforced by court order, or should they wish to receive compensation for any damage they have suffered, they must take the matter to Federal Court. To date, relatively few have chosen this option, all have been unrepresented, and only a handful have been successful in obtaining damage awards. Where damages have been awarded, the amounts have been relatively small.

This is why the recent decision in Chitraker v. Bell TV is interesting. In this case, the applicant sought damages for breaches of Bell TV’s legal obligations under PIPEDA. Chitraker had ordered satellite TV service from Bell, and had signed an electronic Proof of Delivery Device when the service was installed in his home. Bell TV then lifted the signature from this device, without Chitraker’s knowledge, and affixed his signature to a contract. Chitraker had not been given a copy of this contract. Among other things, the contract provided that the customer consents to Bell TV performing a credit check. Relying on this clause, Bell accessed Chitraker’s credit history without his actual knowledge or consent. When he later learned of this, Chitraker contacted Bell to begin what turned out to be a long and fruitless customer service runaround. The most he received from Bell was an apology left in his voicemail. Chitraker eventually filed a Complaint with the Office of the Privacy Commissioner of Canada (OPC). The complaint was investigated, ruled well-founded, and recommendations were made to allow Bell to bring itself into compliance with the law. Chitraker then took the matter to the Federal Court, seeking compensatory and aggravated damages for the breach of his privacy rights, and for Bell TV’s “malicious and high-handed conduct” (at para 1).

As is typical in these cases, Chitraker represented himself before the Federal Court. Less typical was Bell TV’s failure to respond to the applicaton. Justice Phelan noted that this “failure to appear in this Court is consistent with its disregard of Chitraker’s privacy rights.”(at para 18). He also noted that without any submissions from Bell it was impossible to know whether the company had implemented any of the OPC’s recommendations.

Justice Phelan was critical of Bell’s failure to compensate Chitraker for what he considered to be a significant breach of his privacy rights, and one that might have had actual adverse consequences for him. He noted that Bell took no steps “to compensate for breach of Chitraker’s privacy rights” (para 22). This wording is interesting since there is nothing in the Act which speaks of an obligation to “compensate”. For the most part, PIPEDA is currently oriented towards correcting improper business practices. Certainly in this case, the court was critical of Bell’s apparent lack of interest in doing even this much; nevertheless, the language used may signal a greater openness to actual compensation for harm suffered. In spite of the lack of evidence of any direct loss suffered by Chitraker, Justice Phalen was prepared to award damages, noting that “there is no reason to require that the violation be egregious before damages will be awarded.” (para 24) This is a most noteworthy departure from earlier case law. For example, in Randall v. Nubody’s Fitness Centres, Justice Mosely of the same court had ruled that a damage award “should not be made lightly and that such an award should only be made in the most egregious situations”. This point was also cited by the Federal Court in another decision, Nammo v. TransUnion of Canada Inc. In Nammo, the first case in which a damages award was made under s. 16 of PIPEDA, the court had awarded $5,000 for what the court clearly felt qualified as an “egregious” situation.

In Chitraker, Justice Phelan emphasized the importance of privacy rights “in an era where information on an individual is so readily available even without consent.” (at para 25) He also took into account the nature of the respondent, noting that “Bell is a large company for whom a small damages award would have little material impact.” In a notable departure from the rather stingy approach of the court in Nammo, Justice Phelan awarded Chitraker $10,000 in damages, with an additional $10,000 in exemplary damages and a further $1,000 in costs. Although the elevated damage award in this case no doubt reflects the particular circumstances, including Bell’s apparent disinterest in addressing the privacy concerns, it does mark an important departure from the Federal Court’s previous approach to damages under PIPEDA.

Published in Privacy

The Manitoba government has recently enacted the Personal Information Protection and Identity Theft Protection Act (PIPITPA), which has yet to come into force. This statute is private sector data protection legislation which will is presumably intended to apply in place of the federal Personal Information Protection and Electronic Documents Act (PIPEDA) to private sector activity within provincial jurisdiction. In order to effectively substitute for the application of PIPEDA, the PIPITPA would need to be declared by the federal Governor-in-Council to be substantially similar to PIPEDA. If Manitoba were to be successful, it would join the ranks of Alberta, British Columbia and Quebec as a province with legislation that is substantially similar to PIPEDA. However, as I will explain below, this may be a difficult case to make.

In terms of the substantive norms that guide the collection, use or disclosure of personal information, the Manitoba legislation draws heavily upon Alberta’s Personal Information Protection Act (PIPA). Indeed, many of the provisions of PIPITPA are taken word for word from the Alberta statute. There are, however, some differences. Unlike PIPA, PIPITPA does not create distinct obligations to notify individuals when they outsource the processing or storage of their personal information to a company in another country (see art. 6(2) of PIPA). Neither does PIPITPA require notification of individuals when an organization uses an offshore service provider to collect personal information, or where it transfers personal information to an offshore company (PIPA s. 13.1). The obligations in PIPITPA regarding personal employee information are also slightly different from those in PIPA; they seem to be somewhat more permissive (although such protections are notably absent under PIPEDA). Perhaps one of the most significant substantive differences relates to the date breach notification requirements. Alberta’s PIPA requires the Commissioner to be notified by an organization where there has been unauthorized access to or disclosure of personal information. The Commissioner may then require the organization to notify affected individuals where “there is a real risk of significant harm as a result of the loss or unauthorized access.” Under Manitoba’s new legislation, an organization must “as soon as is reasonably practicable”, notify any individual if their personal information that has been in the custody or control of the organization “is stolen, lost or accessed in an unauthorized manner.” The organization is not required to make such a notification if it is “satisfied that it is not reasonably possible for the personal information to be used unlawfully.” (art. 34) The difference is important: under Alberta’s statute, the Commissioner, at arm’s length, makes the call as to whether notification is required; under the Manitoba legislation it is the organization, facing embarrassment or even possible legal action, that gets to decide whether individuals should be told of the mishandling of their personal information.

The most significant difference between the Manitoba legislation and both PIPEDA and its substantially similar counterparts relates to oversight and enforcement. The Manitoba Ombudsman is given extremely limited oversight powers under the legislation, and there is no mechanism through which the public can make complaints regarding the handling of their personal information by private sector organizations. Instead, the Manitoba legislation offers only judicial recourse. For example, individuals are given a right of action in a court of competent jurisdiction where an organization has failed to take proper care of information under its control, or for failure in its duty to notify of a significant security breach in respect of personal information. The Act also provides that it is an offence to willfully collect, use or disclose personal information in contravention of the Act, to wilfully attempt to access personal information, or to dispose, alter, falsify, conceal or disclose personal information in order to evade a request for access. These offences require the acts to be willful, setting a rather high threshold. The legislation provides a defense where the organization is considered to have “acted reasonably in the circumstances.” The mens rea requirement will likely make prosecutions rare; in any event, they will be beyond the power of individuals to initiate and pursue on their own. Without a complaint mechanism and without the power to control prosecutions of offenses, the individual is left with no other option but to take an organization to court. As we have seen with court actions under PIPEDA, the damage awards are typically too low to make this kind of recourse practicable. An individual who is willing to take the time and effort to represent themselves in small claims court might walk away with a few dollars, but for many types of mishandling of personal information a complaints mechanism would be far more effective in guiding an organization to modify its practices while at the same time reassuring individuals that something has been done to rectify the problem.

The lack of effective oversight and the lack of an accessible complaints mechanism, in my view make this legislation very far from being substantially similar to PIPEDA. Basic normative requirements are essentially meaningless without appropriate oversight. It is worth noting that even with PIPEDA’s much more significant oversight provisions, the Privacy Commissioner of Canada has grown frustrated with the limits of her own lack of order-making powers under PIPEDA, and with the lack of additional powers to impose fines or penalties in appropriate circumstances. The Manitoba legislation is a long way from what should be required of a province that wishes to remove its private sector organizations out from under the reach of PIPEDA.

Published in Privacy

My colleague Michael Deturbide and I are very honoured to have been awarded the 2013 Walter Owen Book Prize for our new book Electronic Commerce and Internet Law in Canada, published by Wolters Kluwer (CCH). We are very grateful to the Foundation for Legal Research, which awards this prize, and which also has been a strong pillar of support for legal research in Canada.


Is there any such thing as a free app? In Albilia v. Apple inc, Justice Pierre Nollet of the Quebec Superior Court authorized a class action law suit against Apple in relation to the collection of personal information by third party application (app) developers via Apple devices such as the iPhone and the iPad.

The petitioner alleges that Apple encourages and supports the development of third party apps as a means of bolstering the popularity and sales of its devices. He also alleges that Apple permits third party app developers to harvest personal the information of users from their devices without their knowledge or consent. In particular, he alleges that such information may include precise location information, the unique device identifier, the user’s name, gender, age, postal code and time zone, information about activities performed using the app. He also alleges that this ongoing harvesting of personal information uses up the resources of the devices without the permission of the device owners. The class action is similar to two others that have been filed in the United States against Apple.

Although the petitioner initially sought to certify a Canada-wide class of affected persons, the judge limited the class to Quebec residents. He did so because the petitioner had failed to establish that the laws in relation to privacy across Canada were equivalent to those in Quebec. Indeed, although there are some similarities, it is fair to say that both the Civil Code of Quebec and the Quebec Charter of Human Rights and Freedoms offer both different and quite likely more extensive protection for privacy than do the laws in the common law provinces and territories.

Justice Nollet ultimately certified two classes for the law suit. The first consists of:

all residents in Quebec who have purchased or otherwise acquired an iPhone or iPad (“iDevice”) and who have downloaded free Apps from the App Store onto their iDevices since December 1, 2008 through to the present.

A second class relates specifically to concerns about the collection of geolocation information. This class consists of:

all residents in Quebec who have purchased or otherwise acquired an iPhone and turned Location Services off on their iPhones prior to April 27, 2011 and have unwittingly, and without notice or consent transmitted location data to Respondents’ servers.

The questions to be explored in the class action law suit include issues regarding whether the respondent Apple facilitated profiling of individual users or disclosed personal information without users’ consent to third party app developers. Other issues include whether location information could be collected from devices even after the location services functions are turned off by the user. The litigation also involves issues relating to consent by users to information gathering practices by both Apple and app developers. In bringing his motion the petitioner referred to a recent study by Eric Smith that detailed the information collecting practices of iPhone apps.

The collection of personal information from mobile devices – including data about a user’s online activities and detailed location information – raises significant privacy concerns. Many “free” apps may use information gathering as a means of generating a revenue stream; the information gathered may have nothing to do with the functions of the app itself. Users of mobile devices may not be sufficiently aware of the detailed location information that can be collected and shared when the location functions of their device are turned on; alternatively, they may turn these functions on specifically to enable certain useful features of their device without realizing that the same information may also be collected and used by apps whose functions are completely unrelated to their location. As with many other contexts, the user who downloads apps may have little time or attention to allocate to reading the detailed user agreements and privacy policies that may accompany their new apps. While courts may continue to insist that users are bound by these agreements, there is a growing concern that the sheer number, complexity and length of such agreements makes informed consumer consent virtually impossible on a consistent basis.

Class action law suits advance with glacial speed, and it is not likely that the questions raised in this dispute will be answered any time soon. Yet it is important that they be asked both here and in other contexts. The burden of privacy, in particular of protecting one’s personal information from unwanted profiling and surveillance, is becoming increasingly challenging for individuals. Not only is it difficult to grasp the full range of information that is being collected, by whom, and for what purposes, as we engage in perfectly ordinary day-to-day activities, secondary access to this information by third parties, including police and other state authorities is not at all transparent. In addition to greater scrutiny of data collection practices, attention must also be paid to the issue of consent, which is increasingly becoming a fiction in the face of turgid and impenetrable legal texts accompanying every small piece of software in our lives.

Published in Privacy
Wednesday, 19 June 2013 12:48

Google Glass and the Privacy Gap

Canada’s Privacy Commissioner, Jennifer Stoddart, along a number of her international counterparts and the commissioners of B.C., Quebec and Alberta have issued a joint letter written to the CEO of Google raising concerns about privacy in relation to Google Glass. This product, still at the beta stage, consists of a kind of interactive mobile computer worn as eyeglasses. Among other things, the glasses have the capacity to record audio and video data, and will be able to run all manner of third party applications.

The Commissioners are justifiably concerned about a product that once launched might raise a host of new and troubling privacy issues. In the letter they call on Google to enter into a dialogue with data protection commissioners with a view to ensuring that the design of the product and of its applications respects privacy values.

What is interesting in this letter is the frank admission by the commissioners of their own precarious jurisdiction when it comes to this technology. While there is no doubt that Google Glass poses significant privacy risks, they are not necessarily ones which would fall within the scope of private sector data protection laws in Canada. These laws generally apply to organizations that collect, use and disclose personal information in the course of commercial activity. Certainly, some of the concerns raised in the letter fall within the scope of these laws. For example, the Commissioners demand to know what information Google might itself collect via Glass when it is in use by individuals. They also seek to know what information will be shared with third parties, including the developers of apps for this product. These are clearly questions that fall within the scope of data protection legislation, as Google is clearly an organization that collects, uses and discloses personal information in the course of commercial activity.

However, Glass will also have privacy implications as between the wearers of the technology and those persons who may fall within the field of view of the user. The Commissioners specifically address the use of this product to surreptitiously film or record individuals. This is a serious privacy concern. It is one that is already raised by the recording capacity of smartphones and tablets; the particular concern with Glass is that it will be possible to be even more surreptitious in making such recordings. Yet the privacy issues raised by this type of activity are not ones to which private sector data protection legislation would apply. For example, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) specifically does not apply to any individual in respect of personal information that the individual collects, uses or discloses for personal or domestic purposes and does not collect, use or disclose for any other purpose.” The scope of this exception is potentially very broad; the law would not apply, for example, to recordings made by individuals and posted to their Facebook accounts or to YouTube.

The Commissioners, of course, are well aware of this gap in their powers. In their letter they explicitly acknowledge it: “We are aware that these questions relate to issues that fall squarely within our purview as data protection commissioners, as well as to other broader, ethical issues that arise from wearable computing.” Nevertheless, they use the opportunity presented by the privacy issues within their mandates to raise the “broader ethical issues”.

This gap in jurisdiction over privacy is of growing importance. Where once high powered technologies of surveillance were only affordable by professionals, low cost, high powered technology is increasingly moving into the hands of ordinary individuals. In addition, the ability to disseminate audio and video recordings to a global audience – also something that was once only within the powers of established private sector corporations – is now something that can be done by any individual with an internet connection. As the corporate intermediaries become obsolete, so too do data protection laws that are framed exclusively around private sector actors engaged in commercial activity. The appropriate legislative response is not clear; legislated limits on how individuals can interact with and communicate information about themselves and their experiences would raise significant freedom of expression issues.

The data commissioners’ letter to Google is thus most interesting. Acknowledging both the limits of their powers and the enormous gap in the protection of the public in a rapidly changing information technology environment, they have chosen to publicly raise both privacy and ethical issues with Google. Law- and policy-makers should be watching and should be thinking about how this gap should be filled.

Published in Privacy

The US government is in damage control mode after it was leaked to the press this week that it had established a massive surveillance program under which it obtained comprehensive communications data from telecommunications and technology companies. Privacy advocates have decried this secret and massive data mining exercise.

Canadians should not sit back complacently to watch this unfolding spectacle south of the border. It was only last year that our own government tried to introduce legislation that would have provided for the building of the physical and legal infrastructure for substantially increased Internet surveillance. Although Bill C-30 was ultimately defeated, there are nonetheless other laws already on the books that leave Canadians vulnerable to unwarranted and invisible surveillance. For years privacy advocates in Canada have been warning of legal provisions that allow police and national security agencies to seek personal information from private sector companies, and that allow these companies to hand over this information without a court order and with no accountability.

The first of these provisions is s. 7(3)(c.1) of the Personal Information Protection and Electronic Documents Act, which provides that an organization “may disclose personal information without the knowledge or consent of the individual” where the disclosure is made to a government actor that has made a request for the information, and has indicated that the information may be related to national security issues, may be relevant to an investigation related to the enforcement of any law, or is sought for the purpose of “administering” any federal or provincial law.

The second provision is s. 487.014 of the Criminal Code, which provides that no court order is required for a law enforcement official “to ask a person to voluntarily provide to the officer documents, data or information that the person is not prohibited by law from disclosing.” In other words, as long as no other law prohibits such a disclosure, the information may simply be handed over.

Both PIPEDA and the Criminal Code permit private sector companies in Canada to voluntarily disclose the personal information of their customers to police officers or national security officials without the knowledge or consent of the individuals in question, and without an order from a judge. Companies may still refuse to make such disclosures without being ordered to do so by a court, and while some do in some circumstances, plenty of others do not. According to the federal Privacy Commissioner, “We have no way of knowing for certain the number, scale, frequency of, or reasons for, such disclosures although we understand that they are substantial.”(The Case for Reforming the Personal Information Protection and Electronic Documents Act at p. 13). Nothing obliges companies to disclose to the public how many requests for information they receive or with how many they have voluntarily complied. Similarly, nothing obliges public authorities to disclose how many requests they make, to what companies, or for what types of information.

Given the vast amounts of personal information of increasingly fine detail that private sector companies collect about all of us, this should be a matter of some concern. Telecommunications companies can match our personal information to IP addresses, which in turn can be linked to all of our online activities. Telecommunications companies also have rich stores of data regarding our calling activities; in the case of smart phones, this information may also include fine-grained location information. Other companies gather our location information, as well as information about our purchases, transactions, conversations, friends, associates and activities. These vast stores of information in the private sector may be simply a request away from disclosure to authorities – and we may never know just how much information is being shared or in what circumstances.

In response to this highly troubling set of circumstances, the federal Privacy Commissioner, Jennifer Stoddart, recently called for reforms to PIPEDA that would impose some level of accountability where public authorities access information in this manner. In a document titled The Case for Reforming the Personal Information Protection and Electronic Documents Act the Commissioner recommended that the law be amended to require private sector organizations “to publicly report on the number of disclosures they make to law enforcement under paragraph 7(3)(c.1), without knowledge or consent, and without judicial warrant, in order to shed light on the frequency and use of this extraordinary exception.”

This call for greater transparency in determining just how often the personal information of Canadians is disclosed to government authorities without the knowledge or consent of the individual and without judicial authorization is well-timed. As disturbing as the news of the US surveillance program is, we should not lose sight of the fact that there are vast personal information resources that sit within easy reach of our own government and its officials – and that there are laws currently on the books that facilitate easy and virtually traceless access to it.

Published in Privacy

In case there was any doubt, the Office of the Privacy Commissioner of Canada (OPC) produced a report this week that confirms that Canada’s private sector data protection legislation is simply not up to the task of adequately protecting the personal information of Canadians. The report is aptly titled: The Case for Reforming the Personal Information Protection and Electronic Documents Act.

The introduction to this report makes plain the frustration of those charged with administering the Personal Information Protection and Electronic Documents Act (PIPEDA). Enacted with much fanfare in 2001, this statute contains a provision that requires that it be reviewed every 5 years to ensure that it remains adequate for the task of protecting the personal information of Canadians in commercial contexts. As the introduction to the Report notes, the first 5 year review ended with a Bill to amend the statute – this Bill died on the order paper and in spite of attempts to resuscitate it, it has never been passed. The second 5 year review has simply stalled. In the meantime, as the report notes, the personal data landscape has been dramatically transformed with the rise of social networking, mobile communications, increased cross-border data collection and sharing, and the growing use of personal information for the profiling and targeting of consumers

PIPEDA is a fairly tentative piece of legislation, giving only ombudsperson powers to the Privacy Commissioner, and favouring an approach that encourages compliance rather than mandating it. This new report issued by the Office of the Privacy Commissioner (OPC) makes it clear that this approach is no longer effective nor is it appropriate to the current data protection context. The Report notes that comparable jurisdictions have moved towards giving data commissioners more powers of enforcement, including order-making powers and the ability to impose fines or other administrative penalties on companies that play fast and loose with personal information. PIPEDA even lags behind the laws of those few provinces that have their own private sector data protection statutes: Commissioners in Quebec, B.C. and Alberta have order making powers, and Alberta also has mandatory data breach notification requirements. The report observes that not only is the toothless PIPEDA a difficult tool to use to gain compliance from large web-based collectors of personal information that are based outside of Canada, it also relies too heavily upon the willingness of domestic companies to take the Commissioner’s findings or audit reports seriously.

The OPC report identifies four pressure points based on their 12 years of experience with the legislation, and makes four recommendations for legislative reform to address each of these. The first pressure point is enforcement. The report explains how the lack of enforcement powers has hindered the ability of the OPC to address data protection issues. It notes, for example, that there is “nothing in the law that provides enough incentive for organizations to invest in privacy in significant ways.” (at p. 6). It notes as well that even when complaints lead to investigation and recommendations, companies may renege on agreements to change practices because there is nothing to compel them to do so. The report laments that other jurisdictions have taken steps to enhance their enforcement powers while nothing is done in Canada. As a result, the report recommends that stronger enforcement powers be added to the legislation. It identifies as possibilities: adding statutory damages powers to enhance the damages available to complainants who ultimately take their issues to Federal Court; giving the Commissioner order-making powers; and giving the Commissioner the power to impose administrative monetary penalties. Ideally, all three should be added. I note in particular that while statutory damages will improve the individual recourse under the Act, this on its own will not greatly improve compliance under the legislation (see my earlier blog post on individual recourse in privacy cases).

The second pressure point identified in the report is the lack of mandatory reporting for data breaches. The Report notes that as things currently stand, organizations who voluntarily report a data breach face negative publicity, while those who cover up breaches are insulated from reproach. A mandatory data breach reporting provision (which is what the report recommends) would ensure that Canadians are made aware of data breaches, would give Canadians a much clearer picture of the state of personal data security, and would create strong incentives for organizations to improve their privacy practices.

The third pressure point identified is an interesting and important one. PIPEDA contains a provision which allows organizations to voluntarily share personal information with police or other authorities without the consent of the individuals to whom the information relates. Given the increasingly high volumes of personal data in the hands of private sector actors, and the fine grain of detail of much of this information (for example, it may include detailed location information about the movement of individuals over extended periods of time), this should be a matter of great concern. At present there is little or no transparency about the number of requests made by law enforcement for this type of information, nor is there any transparency about the number of times private sector organizations voluntarily share information without insisting upon a warrant. The report’s third recommendation is to require organizations “to publicly report on the number of disclosures they make to law enforcement. . . without knowledge or consent, and without judicial warrant, in order to shed light on the frequency and use of this extraordinary exception.” (at p. 14)

The final pressure point identified in the report is that of demonstrating accountability. Although accountability of organizations for compliance with data protection laws is one of the privacy principles set out in PIPEDA, the report notes that the record of accountability of private sector actors is not all it should be. Not only does the OPC expend significant resources on investigations and audits, they are forced to invest additional resources in follow ups to ensure that there has been compliance with their recommendations. The report recommends that the accountability principle in PIPEDA be amended to require organizations to demonstrate, on the request of the OPC, that they are actually compliant with the law. Further, the report recommends that the law provide for “enforceable agreements” – in other words, undertakings by organizations to comply with the legislation that can be enforced by the OPC if compliance is not actually forthcoming.

Commissioner Jennifer Stoddart is approaching the end of the second term of her appointment. Her leadership of the OPC has been exemplary; she has taken it from a beleaguered and unstable agency to one that has proven its expertise and effectiveness. It has worked with great effectiveness with federal departments and agencies, it has developed effective strategies for public outreach and education, and it has worked tireless to improve data protection in the private sector. The Commissioner has also maintained a high level of communication and collaboration with other data commissioners in Canada and abroad. In short, she has done as much – perhaps more – than one could expect to address the privacy of Canadians in both the public and private sectors under two neglected and outdated privacy statutes. This report is notable for the frank and direct way it publicly addresses the deficiencies in Canada’s private sector data protection legislation. Since the mandated legislative review process set out in PIPEDA has proven utterly ineffective in doing so, the Commissioner has taken the initiative, addressing Canadians directly to explain in plain and direct terms what the problems are and how they might be fixed. Let us hope that the government is listening.

Published in Privacy

Privacy is big news these days, particularly when it comes to online activity. Internet users are increasingly being tracked by websites they visit, by advertisers on those sites, and by their mobile apps. Profiling practices are ubiquitous. Information and activities on social networking sites are mined by “big data” for purposes that are hardly transparent to users. It is in this context that the Standing Committee on Access to Information, Privacy and Ethics has just released its report on Privacy and Social Media in the Age of Big Data.

The report outlines many of the challenges and issues facing individuals and regulators in the social media context. There are significant issues around how consumer consent is obtained to the collection, use and disclosure of their personal information, the unlimited nature of information collected, the uses to which harvested information is put, and the length of time information is retained. Some testimony before the Committee specifically addressed the added challenges raised by the collection of the personal information of children. Issues of accountability, transparency and security are also considered in the report, and the Committee heard testimony regarding the practices of specific social media companies, and the measures being adopted by the Federal Trade Commission in the US.

Given the broad scope of the inquiry and the importance of the issues, the Committee’s recommendations are a letdown. The first three recommendations consist largely of statements urging the Privacy Commissioner of Canada to develop new guidelines to address privacy challenges with social media. The recommendations which follow encourage both government and social media companies to support education, to promote safe online activities and to support digital literacy. While guidelines and education clearly have a role to play, the recommendations do not go far enough, and in particular, they ignore the sorry state of Canada's private sector data protection law.

During the course of its inquiry, the committee heard plenty of evidence about the lack of movement on long overdue legislative reform to the Personal Information Protection and Electronic Documents Act (PIPEDA), and about how the proposed amendments to this law in Bill C-12, which has languished for some time now, may already be out of date. The Committee also heard evidence about the need for enhanced powers of enforcement for the federal Privacy Commissioner who managed to do her job admirably well with largely only the power to cajole and encourage compliance. That the recommendations of the Committee are entirely silent on the need to amend PIPEDA to add data breach notification requirements, the power to levy fines, order-making powers or other enforcement measures is simply stunning.

One can be grateful, at least, for the recommendations contained in the Supplemental Report of the New Democratic Party of Canada. The NDP members of the Committee clearly took away a different message from these hearings than did the other members. The NDP makes a number of recommendations for legislative amendments that would enhance the enforcement power of the Privacy Commissioner. These include recommendations for legislative change to require companies to notify the Privacy Commissioner in cases of serious breaches of data security, to enhance the enforcement powers of the Commissioner, and to implement “do not track” functions. Indeed, earlier this year, the NDP’s Charmaine Borg (who sits on the Standing Committee) introduced a private members bill (Bill C-475) that would amend PIPEDA so as to implement some of these recommendations around data breach notification and enforcement powers.

The soft approach to privacy protection has not proven adequate to deal with the pervasive, intensive and ubiquitous data collection practices which have become the norm in our digitized society. The almost daily accounts of data breaches and their negative impacts on individuals are evidence of the failure of gentle encouragement to achieve regulatory compliance with even the most basic privacy norms. It is past time to update and upgrade Canada’s data protection legislation. It is most disappointing to see a Standing Committee report that can study these issues and conclude only that gentle encouragement is still the path to follow.

Published in Privacy
Thursday, 14 March 2013 14:33

The Failure of Privacy Law

Recently, the decision of the Ontario Court of Appeal in Jones v. Tsige was celebrated by privacy advocates for recognizing a new privacy tort in Ontario. The plaintiff/appellant Jones received an award of $10,000 in damages for harm suffered as a result of the defendant’s unauthorized access to her bank records over a period of time.

An even more recent dispute between Jones and her lawyer has highlighted a chronic problem with privacy law in Canada: the lack of meaningful recourse. Last week, a judge ordered Jones to pay her lawyer the balance of the legal fees she incurred in her ground-breaking lawsuit. These fees were in excess of $125,000 – more than 12 times Jones’ damage award. The judge made it clear that the lawyer had provided first rate representation for his client. The lesson here is that legal services are expensive, and frankly, the majority of Canadians cannot afford to go to court.

The new tort that resulted from Jones v. Tsige is similar to statutory torts in provinces such as British Columbia, Manitoba, Saskatchewan and Newfoundland and Labrador. They are fairly narrowly framed; these torts require a wilful violation of privacy. They are meant to apply in cases of stalking, voyeurism, and other deliberate privacy intrusions. The high cost of litigation combined with the fact that courts give relatively small damage awards for the difficult-to-quantify harms that flow from privacy invasion mean that these torts are of little practical use to most Canadians.

Arguably, the most pervasive threats to personal privacy come from routine over- collection of personal information, and poor information handling practices. The tort of invasion of privacy does not apply in such cases. Instead, private sector data protection legislation is meant to provide recourse to individuals when their personal information is inappropriately collected, used or disclosed by private sector organizations. Yet the Personal Information Protection and Electronic Documents Act (PIPEDA) has its own substantial defects. This law applies to activities in the federally regulated private sector, and to the private sector more broadly in those provinces without their own legislation (all provinces and territories except B.C., Alberta, and Quebec fall under PIPEDA),. Individuals may make complaints under PIPEDA; the outcome of any such complaint is a report by the Office of the Privacy Commissioner (OPC). This report may contain recommendations as to how an organization should correct deficiencies in its practices, but these recommendations are not binding. Once a report has been issued, an individual may choose to take the matter to Federal Court to get an order requiring the organization to change its practices. The individual may also seek compensation for any harm they have suffered. Once again, it costs money to go to court, and those few individuals who have exercised this option have had little success. Nammo v. Transunion of Canada Inc. has become the benchmark for awards of damages in such cases; Mr. Nammo was awarded a whopping $5000 after a credit reporting agency failed to collect accurate information about him, and shared the incorrect (and negative) credit information with a bank. It is no surprise that the majority (if not all) of those who have pursued their PIPEDA claims before the Federal Court have represented themselves. The cost of legal representation would far outstrip any likely award of damages.

The OPC does excellent work within the limits of its mandate, and it has no doubt had some success in improving how (receptive) businesses handle personal information. There is, however, little in the legislation to seriously motivate compliance. PIPEDA is a relatively toothless statute: the Privacy Commissioner has no order-making power, there is no mandatory breach disclosure provision, and there is little in the way of economic consequences for those who flout privacy principles. Yet PIPEDA has passed its first five-year review without much-needed legislative amendment (the Conservative government’s Bill C-12 died on the order paper and has yet to be revived), and it is now well overdue for its second five-year review. It is into this context that Charmaine Borg of the NDP has introduced a private member’s Bill C-475, which would impose a mandatory data breach disclosure requirement on organizations, would provide the Privacy Commissioner with order-making powers, and would create the potential for significant financial penalties for those who refuse to comply with orders.

Measures of this kind could provide a real incentive for organizations to take data protection more seriously. And let’s face it, for the vast majority of Canadians, it is not the right to go to court to sue for invasion of privacy or to seek damages for violations of PIPEDA that will make any kind of difference. These rights are rendered meaningless by both the cost of litigation and by the resultant lack of deterrent effect on bad behaviour. The best protection for individuals is a regime that gives organizations clear reasons to improve their practices and systems.

Published in Privacy
<< Start < Prev 11 12 13 14 15 Next > End >>
Page 11 of 15

Canadian Trademark Law

Published in 2015 by Lexis Nexis

Canadian Trademark Law 2d Edition

Buy on LexisNexis

Electronic Commerce and Internet Law in Canada, 2nd Edition

Published in 2012 by CCH Canadian Ltd.

Electronic Commerce and Internet Law in Canada

Buy on CCH Canadian

Intellectual Property for the 21st Century

Intellectual Property Law for the 21st Century:

Interdisciplinary Approaches

Purchase from Irwin Law