Cherry Picking Among Apples and Oranges : Refocusing Current Debate About the Merits of the Ombuds-Model Under PIPEDA
By Jennifer Stoddart 1
October 21, 2005
Toronto, Ontario
Abstract
In 2000, the Parliament of Canada passed a new personal information protection
law for the private sector based on the existing public sector model.
As the first federal private-sector privacy legislation, PIPEDA has received
much scrutiny. One of the most remarked-upon features of PIPEDA has been
the choice of ombuds-model for the Privacy Commissioner.
This paper recalls the conceptual nature and characteristics of the ombuds-model,
and comments on the seeming mismatch between the integral aspects of that
model and contrasting types of regulatory controls governments are "expected" to
wield over "nefarious" private sector activity. In an attempt to facilitate
understanding, I will elaborate on four central themes around which much
of the confusion appears to revolve in debates about the appropriate administrative
model of PIPEDA: flexibility, procedural fairness, transparency and effectiveness.
Introduction
The concept of an ombudsman, at least as we understand it today, has its roots
in the justiteombudsman (ombudsman for justice) office created in
1809 in Sweden. 2 The office
of the ombudsman, in this form, may be described as:
…a mechanism that monitors the conduct of public administration to ensure
that it is conducted legally and fairly. The ombudsman is usually a single
individual, but occasionally the institution may comprise a number of persons.
An ombudsman is usually appointed by the legislative branch of government
to investigate the administrative activities of the executive… 3
After its introduction in 1809, the ombuds-model evolved into a variety of
forms, though at its root it remains "focused first and foremost on the protection
of certain values, values of equity and accountability." 4 It
has continued to serve as a critical mechanism for governments to regulate
themselves and be held accountable for their actions. In Canada, several provinces
have instituted dedicated ombuds offices to ensure fairness and accountability
in the general administration of their public bodies and the provision of services
to the people whom they serve. 5 At
the federal level, the ombuds-model has been adopted to monitor specialized
areas of government activity. For example, the Offices of the Commissioner
of Official Languages, the Access to Information Commissioner and the Privacy
Commissioner were specifically designed as ombuds offices to oversee the federal
government's compliance with its obligations under the Official Languages Act, 6 the
Access to Information Act 7 and
the Privacy Act, 8 respectively.
In more recent years, the ombuds model has been adopted by the private sector
as a mode of self-regulating the quality and fairness of its own client services.
In the financial services sector, for instance, ombuds persons serve as in-house
complaints officers for individual companies; complainants not satisfied with
the response given by their financial service provider can refer the matter
to the Ombudsman for Banking and Financial Services that serves an ombuds-like
function for the industry. In a 1999 Discussion paper, the Canadian Ombudsman
Association questioned whether these emerging bodies, particularly in private
sector organizations, meet the test of independence and impartiality required
of an ombudsman. 9 Nonetheless,
what we see as unifying characteristics of the ombuds-model generally, across
all of its various applications, has been described by Carolyn Steiber as follows:
Common threads run through the conceptual fabric of every ombudsman's office — all
aim to humanize administration, to support fairness, accountability, and
equity. All ombudsmen can be approached in confidence. No ombudsman has enforcement
or disciplinary powers. All depend on the power of persuasion, as well as
the credibility of the office which leads individuals to trust it. Although
the process in achieving objectives of fairness and accountability may differ,
the product is the same: a chance for ordinary people, those without power,
to be heard and to get fair treatment. 10
When the Personal Information Protection and Electronic Documents Act 11 (hereinafter, "PIPEDA")
came to pass in 2000, the policy choice was made to adopt the same ombuds-model
as was used to administer the Privacy Act. 12 As
a result, the Privacy Commissioner is vested with the powers and duties of
an ombudsman in overseeing the information management practices of private
sector organizations covered by the Act.
For instance, under section 11 of PIPEDA, the Commissioner is mandated to
launch investigations on receipt of complaints; she is also granted the power
to initiate her own complaint where there are reasonable grounds to do so.
Under section 12, the Commissioner is granted extensive powers to investigate
complaints, including the authority to attempt to resolve complaints by means
of dispute resolution mechanisms. Under section 13, she is mandated to prepare
and deliver a report outlining her findings, recommendations, any settlement
reached by the parties, or otherwise, and further recourse available to the
complainant. Finally, under section 25, the Commissioner must report to the
government and legislature on the activities of the Office.
Indeed, these powers and functions constitute the hallmark characteristics
of the ombudsman role. As Reif explains:
An ombudsman has the power to launch investigations on receipt of a complaint
or on her own motion, conduct an impartial investigation into the administrative
conduct in question, make recommendations to eliminate the illegality or
unfairness if faulty administration is found, and report to the government
and legislature on the activities of the office. 13
Though typically characteristic of an ombudsman office, the Privacy Commissioner's
powers and duties under PIPEDA are quite unique in their application. Whereas
the ombudsman model has traditionally been employed by governments to regulate
public administration, PIPEDA represents a novel application of the ombuds-model
by government as a means of regulating private sector activity. And, unlike
the use made of the ombuds-model by private sector organizations to regulate
themselves individually or collectively by industry, the ombudsman role envisaged
by PIPEDA extends to all private commercial activity, across a wide variety
of sectors and industries.
Given the novelty of this approach, it is perhaps unsurprising that the adoption
of the ombuds-model to oversee PIPEDA has given rise to misunderstanding. This
misunderstanding seems to be rooted in a fundamental mismatch between the conceptual
nature and characteristics of the ombudsman role and the regulatory-type controls
governments are expected to wield over "nefarious" private sector activity.
As Howard Gadlin has remarked, "[a]lthough the study and practice of negotiation
and dispute resolution have grown enormously over the past thirty years, the
ombudsman is arguably the least well understood part of this field." 14 Throughout
the remainder of this paper, I will elaborate on four central themes around
which much of the confusion appears to revolve in current debates about the
use of the ombudsman model in administering PIPEDA. These themes are: flexibility,
procedural fairness, transparency and effectiveness.
I.
FLEXIBILITY
a. Structure of the Act
In PIPEDA's early days, criticism of the Act focused on the structure itself
and critiqued what was seen as an overly general focus. Teresa Scassa, for
instance, noted two issues of generality that she saw as inherently problematic
for PIPEDA: "first, it is not a model in which more detailed or sector-specific,
formalized elaboration of the law is provided for, either through regulation-making
or through the mechanism of formal approval of sectoral codes. Second, the
incorporation of the Canadian Standards Association ( CSA ) Code in its entirety
introduced into the law a further level of generality." 15
More recently, John Lawford has raised similar concerns, arguing that "standards
may work as the basis for regulation under an act, but their non-prescriptive
nature makes them a poor fit for the prescriptive requirements of an act." 16
Calls for greater specificity of language and more prescriptive requirements
seem to be at complete odds with a scheme based on the ombuds approach to resolving
disputes. Flexibility is key to the proper functioning of an ombudsman. Indeed,
flexibility is an essential feature of the Privacy Commissioner's role and
an integral theme throughout PIPEDA itself.
The very purpose of PIPEDA is to establish in light of modern information
technology:
rules to govern the collection, use and disclosure of personal information
in a manner that recognizes the right of privacy of individuals with respect
to their personal information and the needs of organizations to collect,
use and disclose personal information for purposes that a reasonable person
would consider appropriate in the circumstances. 17
This has been colloquially referred to as a "balancing" clause, but the term
is not an entirely apt one. Unlike an adjudicative mode of enforcement, where
the appropriate balance would be determined by a judge through an adversarial
process based on the application of prescriptive standards and a determination
of who's right and who's wrong, the ombuds-model envisaged in PIPEDA enables
the Privacy Commissioner to assist individuals and organizations in
arriving at an appropriate balance so that the needs of all are met and respected
through consensus.
As Stephen Owen notes, one of the benefits of the consensual resolution model
is that "because various interests will value aspects of a public issue differently,
resolution packages can be crafted to satisfy each party's major concerns while
trading off less vital ones." 18
Yet, even before the Privacy Commissioner becomes involved in the resolution-making
process, the inherent flexibility of the CSA Code in PIPEDA enables individuals
and private sector organizations to resolve potential conflicts themselves
through the application of general fair information principles to specific
fact situations. Through its principles, PIPEDA offers the necessary tools
and guidance of a self-correcting scheme. Private sector organizations are
called upon to have in place the accountability structures, policies and practices
for responding to and dealing with privacy complaints from individuals. For
their part, individuals are empowered to challenge compliance by organizations
and to seek corrective measures in accordance with the spirit and intent of
the CSA principles. As Colin Bennett has recognized,
The innovation of including a certifiable standard within the body of the
statute was deliberately intended to provide a built-in mechanism for self-regulation.
A standard is more than a code of practice, because it also embraces a common
conformity assessment methodology, by which compliance can be independently
and regularly tested. 19
The very structure of PIPEDA, especially the inclusion of the CSA Code and
validation of its principled methodology based on flexibility, would seem to
be wholly appropriate and consistent with the ombuds-model.
b. Commissioner's Findings
Part of the Privacy Commissioner's role as an ombudsman, as we have seen,
is to investigate the subject matter of disputes and report on her findings
and recommendations, all with a view to assisting parties at arriving at consensual
resolution. Critics have argued that the Privacy Commissioner's practice of
releasing only anonymized and abbreviated summaries of cases makes it impossible
to develop a coherent body of emerging norms for interpreting and applying
PIPEDA. For instance, Berzins suggests that:
The reliance on complaint summaries prevents parties from obtaining a detailed
understanding of the approach taken by the Commissioner in individual cases,
and the problem is exacerbated by the refusal to link investigation findings
to other cases involving similar issues, including investigations involving
the very same respondents. 20
But once again, this criticism must be considered in light of the very nature
and purpose of the ombuds-model, as opposed to what one expects to find in
an adjudicative model typically governing private sector activity. The call
for the development of precedents is rooted in a traditional, rule-bound analysis.
Yet, it must be realized that the ombuds-model is not one which results in
normative precedents that will necessarily be binding on all future parties
in similar circumstances. Such a form of stare decisis would obviate
some of the essential underpinnings of an effective ombuds-model. In order
for this latter model to work, parties must come to the process secure in the
knowledge that their individual circumstances will be addressed and confident
that they can participate in, and help drive the outcome towards their own
negotiated resolution. As Owen has pointed out:
[I]t is essential that all significant interests voluntarily involve themselves
in the process through the participation of an authorized representative.
Each party must believe that its particular interest will be better served
by a negotiated settlement than by an imposed one. If any one party believes
it can win a dispute outright, judicially or politically, the process will
fail. The process requires each party to define its objective in positive
terms. By thinking in terms of what it wants to achieve, each group becomes
better disposed to accommodating apparently competing interests by concentrating
on creative ways of reconciling them. 21
It must be underscored that the ombuds-role is not simply remedial, but transformative
in nature. The aim is the resolution of individual complaints, but it is also
the development of a lasting culture of privacy sensitivity among the parties
through their willing and active involvement in the process itself. In order
to achieve these twin goals, the process must necessarily be flexible, participative
and individuated in its approach. To pre-determine the solution based on precedents
of what other parties have negotiated as appropriate and workable for them
in different -- and even similar -- circumstances, would be at odds
with this approach, completely circumventing its aims. Owen has crystallized
it best in the following excerpt from his seminal article describing the major
characteristics of the ombuds-model:
Fundamentally, consensual resolution is a reasoning process rather than
a coercive one; as such, it is immensely more powerful. A reasoning process
stimulates a voluntary change in the way of thinking which endures to the
benefit of all parties in the future. By building understanding and respect
among the parties, it generates productive energy. 22
II.
PROCEDURAL FAIRNESS 23
As a non-adjudicative body, the Privacy Commissioner is not subject to formal
rules of natural justice. Some have leaped to the conclusion that this means
there is no assurance of fair and due process. For instance, Lawford has suggested
that,
[a]s a result of the ombudsman model, the absence of traditional administrative
tribunal structures and the lack of clear enforcement powers, the federal
OPCC has developed more unorthodox procedures for dealing with complaints. 24
Yet, as is any other administrative body, the Office of the Privacy Commissioner
is bound by the duty of procedural fairness. The Canadian Ombudsman Association
has also emphasized the importance of independence and impartiality to the
effectiveness of a "true" ombuds-office. 25 Far
from being a model which eschews procedural fairness then, procedural fairness
is in fact central to the effective performance of the ombuds-role.
What may sometimes be overlooked is that the content of this duty, as described
by the Supreme Court of Canada, is necessarily "flexible and variable, and
depends on an appreciation of the context of the particular statute and the
rights affected." 26 In this
case, the extent of the Privacy Commissioner's duty of procedural fairness
in conducting investigations must be evaluated in terms of the express statutory
restrictions that PIPEDA itself places on the investigation process. For instance,
the desire to be publicly open and transparent about her investigation process
must necessarily be curtailed by the statutory obligation imposed on the Commissioner
and her staff "not to disclose any information that comes to their knowledge
as a result of the performance or exercise of any of the Commissioner's duties
or powers" in the course of an investigation. 27
As well, the boundaries of the Commissioner's duty must be assessed in light
of the purpose and intent of the ombudsman model, which is not to
make binding determinations of the rights and obligations of the parties, but
rather to try to assist the parties to reach a mutually acceptable solution.
While it may be argued that Commissioner's investigators have the duty to conduct
an adequate and thorough investigation, disclose information to both parties,
be neutral throughout their enquiry, and avoid inordinate delay that can cause
prejudice to the parties, the extent of those duties will necessarily be nuanced.
These formal requirements may well be more exacting under the adversarial model,
with its litigious fact-finding process, culminating in determinative decisions
that affect the rights and obligations of the parties. This is in contrast
to the ombuds-model, where such requirements need be moderated by an inherently
different process which calls for flexibility, consensus building and non-binding
recommendations.
III.
TRANSPARENCY
Critics of the OPC have loudly decried the Commissioner's "failure" to name
names of organizations against which complaints have been brought. These criticisms
range from the suggestion that the Commissioner has the power to name every
organization and complainant, to the suggestion that her discretion to name
should be exercised more often even while recognizing that it remains relatively
exceptional.
On this issue, section 20 of PIPEDA is very explicit in binding the Commissioner
and her staff to a statutory obligation of confidentiality in respect of any
information that comes to their knowledge in the course of exercising their
duties or powers, particularly in the context of complaint investigations.
Surely, this is not an accident of legislative drafting. The obligation of
confidentiality is integral to an ombuds approach, where it is intended to
encourage parties to engage in a conciliatory process aimed at reaching resolution.
To enable complainants to be forthcoming, open and vulnerable, on the one hand,
and respondent organizations to be self-critical and willing to espouse a change
of practice, on the other, they must reach a mutual state of trust. Indeed,
as Owen reminds us,
[t]he consensual resolution of public interest disputes requires a recognition
by all major private and public interests that the best chance of achieving
their individual objectives will occur through the enhancement rather than
at the expense of apparently competing interests. This is a building process,
not a destructive one… (it) is a negotiated process, not an adversarial one,
and the assistance of a trusted and neutral facilitator or mediator is often
necessary to ensure free communication, full disclosure, and balanced participation. 28
The Commissioner's statutory duty of confidentiality owed to the parties has
been recognized by the courts as an essential feature of the ombuds-model.
The Federal Court of Canada referred precisely to this point in Rubin v.
Canada (Clerk of the Privacy Council) 29 in
respect of the Access to Information Commissioner, whose investigative powers,
functions and duties are similar to those of the Privacy Commissioner:
While he has no power to order disclosure, a credible and effective Commissioner
should have significant persuasive power to encourage voluntary resolution
of requests for information under government control. An important aspect
of the development of that credibility and effectiveness is, in my view,
the maintenance of strict confidentiality of information that is given to
the Commissioner. Indeed, the provisions of the Act that require that the
Information Commissioner maintain strict confidentiality on a continuing
basis over information given to him support this conclusion. Parties must
have confidence that the Information Commissioner will not divulge the information
given to him.
More recently, the Federal Court had occasion to reiterate the importance
of this statutory obligation of confidentiality in a case directly involving
the Privacy Commissioner. In Blood Tribe Department of Health v. Canada
(Privacy Commissioner), 30 the
respondent organization challenged the Commissioner's right to issue an order
of production for documents the organization claimed were subject to solicitor-client
privilege. The Court ruled that it was necessary for the Commissioner to review
the documents to fulfill her investigative duty. Noting subsection 20(1) of
the Act which obligates the Commissioner to keep the documents confidential 31,
Mr. Justice Mosley held that "(a)n assurance of confidentiality was
offered at the outset of the investigation in respect of all of the information
sought from the applicant. That assurance is, in my view, supported by the
scheme of the Act." 32
Despite this obligation of confidentiality, general information about the
handling of complaints can be revealed. For example, by anonymizing case summaries,
the Commissioner is able to disclose details about cases which raise issues
of interest to the public without breaching her confidentiality to the complainants
or respondent organizations. This approach has served a vital function in terms
of fulfilling the Commissioner's public education mandate. 33
Alternatively, the Commissioner could, perhaps, simply list the names of organizations
against which complaints had been brought. Without breaching her duty of confidentiality,
she could not however, on a systematic basis, link those names with the outcomes
of the cases or specific details about the organization's information management
practices that led to the complaints. One might question, therefore, what purpose
a simple list of names, without more information, would helpfully serve. In
fact, such a list might misrepresent organizations to the public. Larger, national
organizations are more likely than a small or solely regional organization
to receive complaints, but this is not necessarily indicative of a less compliant
organization.
That being said, the legislation does recognize that there may be exceptional
situations where the obligation of confidentiality concerning the personal
information management practices of organizations is outweighed by the public
interest in being made aware of those practices. 34 A
review of the language of the Act, as well as the practices and jurisprudence
from other jurisdictions suggests a number of criteria would apply. 35
First, a clear record should be developed and retained. As Coughlan v.WMC
International Ltd. 36 underscores, such
a record will establish the Commissioner's decision-making process as to
why disclosure was in the public interest.
Part of the development and maintenance of such a record will be to demonstrate
that the decision to disclose was made on a case-specific basis. The structure
of section 20 makes it clear that the decision to disclose is an exceptional
one, and as such cannot be part of an overarching policy of universal disclosure
but rather must be considered and justified on its individual merits.
Next, to support the decision to exercise her discretion, the Privacy Commissioner
should be able to justify how disclosing the information in the "public interest" helps
advance the purposes of PIPEDA. As the Supreme Court of Canada set out in Dagg
v.Canada (Minister of Finance) 37 there
must be "some reason which is rationally connected to the purpose for which
the discretion was granted." 38
This Commissioner must then balance the general duty of confidentiality under
s. 20 against the public interest exception set out in s 20(2) in order to
determine whether or not there are overriding factors justifying disclosure
of information.
Finally, even when the Commissioner's discretion is exercised in favour of
exceptionally disclosing information to meet a public interest need, the extent
of the disclosure should be limited to only that information necessary to meet
the specified purpose.
IV.
EFFECTIVENESS
a. Complaint-Driven Model
Some commentators have criticized the individual complaints-based model which
has been incorporated into PIPEDA. For instance, John Lawford, concerned about
the quality of individual complaints and unequal power between the parties,
has written that "the absence of the usual adversarial approach in an administrative
tribunal means the companies respond more formally and legalistically, while
the complainants never get this chance and consequently their complaints seem
unsophisticated." 39
However, we must examine this criticism in light of the nature and intent
of the ombudsman approach. The Office of the Privacy Commissioner is not an
administrative tribunal, and should not be measured against such a model. She
is not a passive bystander who hears two ready-made, well-packaged, and well-rehearsed
sides of a story, on the basis of which she renders a decision. Rather, she
is a neutral third-party mandated to communicate openly with both parties and
work actively with them to resolve their dispute, achieve a fair outcome and
develop a transformative culture of privacy. As a function of the office she
holds, therefore, the Privacy Commissioner is expected to have the requisite
experience and expertise to assist and understand the 'unsophisticated' complainant.
She ensures that the complaint is fully and appropriately investigated and
addressed from both sides, in a fair and impartial manner, with a view to mediating
towards a mutually satisfactory solution.
Another commentator, Christopher Berzins, has identified what he perceives
to be a number of problems with an "overly complaint-driven model", namely:
the difficulty of an individual knowing that they have been affected and the
lessened likelihood therefore of receiving complaints; the difficulty in identifying
which organization a complaint should be targeted against; the discouraging
impact of the personal time and effort necessary to file a complaint; the prevalence
of trivial and/or frivolous complaints; and a fear that a paucity of "quality" complaints
will prevent the Privacy Commissioner from being able to address systemic problems
with personal information management practices. 40
Once again, reference to the aims of the ombuds-model makes clear the intent
of the complaint process. The desired cultural change is not something which
can be imposed, but rather must be the result of education and sensitization
of the affected communities. As Owen comments, "the interdependence of interests
empowers even relatively minor stakeholders to be valued partners in the resolution
rather than bothersome but defeatable opponents." 41 The
complaint-driven system allows for individuals to become empowered with respect
to their own personal information and organizations to become reflexively conscious
of their personal information management practices. Moreover, the individual
complaint serves as an important trigger for uncovering broader issues that
might otherwise never come to light. As Nathalie des Rosiers has noted, "the
ombudsman's role in preventing interventions is well known: an individual complainant
is the catalyst for an analysis of systemic difficulties." 42
As important as it is, the individual complaint is certainly not the only
tool PIPEDA offers to address privacy issues. Section 11(2) of PIPEDA allows
the Privacy Commissioner to initiate a complaint of her own accord if she is
satisfied that there are reasonable grounds to do so. The "reasonable
grounds" threshold
could arguably be met where the Commissioner believes in good faith and on
the basis of some credible evidence that there is a serious possibility that
an investigation could reveal a contravention or intended contravention of
the Act. 43 As such, the
Commissioner is not restricted to complaints received from individuals, but
rather, is free to instigate an investigation where she considers the requisite
criteria have been met.
Furthermore, as Berzins himself remarks, PIPEDA offers a much broader suite
of innovative, privacy-enhancing tools than just individual complaints. Unlike
its public sector companion, the Privacy Act 44 which
remains based solely on the individual complaint mechanism, PIPEDA's larger
tool-kit has opened up a whole new chapter of privacy protection in Canada
and has paved the way towards a far more pro-active, multi-faceted approach
to managing Canadians' personal information. Public education, research and
audit are among those complementary mechanisms in PIPEDA that respond to concerns
about an overly complaints-driven model. Even the Information Commissioner
of Canada has recently called for similar powers in his proposed amendments
to the Access to Information Act, recognizing the vital importance of these
additional functions. 45 It
is perhaps trite to add, though far from trivial, that to be able to fulfill
these functions in any meaningful and coherent way, while still continuing
to accomplish the critical function of providing timely response to individual
complaints, requires adequate resources.
b. Lack of Order-Making Power
Perhaps the most commonly heard critique of PIPEDA has been the suggestion
that the Commissioner is "ineffective" because she lacks the power to make
orders and thus force organizations into complying with her findings.
However, an isolated critique of the lack of order-making power neglects to
take into account a number of factors.
The Commissioner's extraordinary investigatory powers (including her power
to receive any evidence she sees fit whether or not it would be admissible
in a court of law 46) are,
at least in part, the correlative of her lack of order-making powers. This
is wholly consistent with the ombuds-model. Indeed, the Privacy Commissioner's
role is that of a trusted "truth-finder" striving to elicit, through her enquiry,
all the necessary facts and considerations in order to reach lasting solutions.
Such solutions are beneficial both for resolving an immediate complaint, and
more importantly, for furthering systemic transformation towards an enduring
and sustainable culture of privacy. As Owen has written:
Because solutions are voluntarily entered into, they will be self-regulating
and enduring. Because they have been designed through a process based on
openness and respect, the positive relationship between the parties will
allow for the flexible adjustment of terms to meet changing circumstances. 47
In contrast, the adversarial, litigious and less flexible approach, which
is a necessary adjunct to the order-making model with more exacting procedural
fairness requirements 48, may
not have the same effect in resolving privacy disputes. Owen goes to quite
some length to describe why litigation is almost always the least appropriate
way to resolve public interest disputes.
…(C)ourts do not provide solutions that are flexible, self-regulating, enduring
and mutually productive. Social harmony, political consensus, and economic
competitiveness are essential objectives in public interest disputes. All
are poorly served by an adversarial process that imposes settlements, drains
resources, and creates winners and losers." 49
At the time PIPEDA was adopted, it was likely the view that litigation would
fare no better in resolving privacy disputes in the private sector either,
particularly at a time of learning and cultural change in respect of personal
information management practices generally. Such was the policy choice made
when considering the most appropriate mode of regulating this type of activity,
in this particular sector, at that particular time. As Colin Bennett notes:
For the most part, the regulation of privacy is not marked by highly public
conflicts with resistant and non-compliant organizations…Any resistance to
the implementation of privacy tends to focus on these more subtle issues
of interpretation, which then lead to some quite complicated and technical
debates about the balancing of risks within certain organizational and technical
practices. 50
Hence, it was perhaps thought that such debates about interpretation are best
had in a context which promotes open dialogue, education and sector-specific
application through adapted policies and practices, rather than one which restricts
the contours of such debates through narrow and protracted litigation. This
policy choice will likely be re-explored in the context of the five-year review
of PIPEDA mandated by Parliament at section 29(1).
c. Unfair Burden on Complainants
Under s. 14 of PIPEDA, the complainant 51 may,
after receiving the Commissioner's report, apply to Federal Court for a hearing.
Some critics have raised concerns that having to proceed to Federal Court for
a de novo hearing is unfair to complainants, burdensome and time consuming.
Lawford, for instance, speaks of "the high hurdles faced by any average citizen
in attempting to effectively re-litigate a process that was meant to be transparent,
accessible and low-cost under PIPEDA." 52
Such critiques fail to recognize the Commissioner's powers, under s. 15, to
proceed to Federal Court. By virtue of this section she may (with the consent
of the complainant) apply to court herself for a hearing of the issue, appear
before the court on behalf of any complainant who has applied for a hearing
under s. 14 or, with leave of the court, simply appear as a party to any hearing
of an application under s. 14. Critics who suggest that a complainant taking
the matter to Federal Court is the only way to proceed there have missed this
important clause of PIPEDA and failed to consider its implications. 53
Even where the Privacy Commissioner opts not to become directly involved as
a party to a court application, the ombuds-model has positive implications
for the complainant. As Colin Bennett points out, "because the Commissioner
does not make binding decisions, [s]he has a great deal of latitude to assist
and advise a complainant who wishes judicial review." 54
At another level, critiques that focus on Federal Court at all necessitate
again a return to the notion of what an ombuds-model strives to achieve. The
choice of the ombuds-model for PIPEDA signals an intent to alleviate, wherever
possible, the need to proceed to Federal Court and instead to make redress
possible via a relatively informal and inexpensive way. To presume
that all (or even most) complainants must bear the burden of proceeding to
Federal Court is to discount the role of the Privacy Commissioner in brokering
effective, mutually-agreed upon solutions in order to avoid the need to go
to Court at all. In her Annual Report to Parliament accounting for activities
related to PIPEDA in 2004, the Privacy Commissioner reported that 47% of complaints
under PIPEDA were settled or resolved through mediation and early resolution. 55
Colin Bennett has commented that both the Privacy Act and PIPEDA "rely
on an assumption that an ounce of prevention is better than a time-consuming
and costly process of reactive investigation and enforcement." 56 This
pro-active and prophylactic approach is consistent with what he describes as "the
received wisdom from the analysis of the experience of many privacy and data
protection agencies, in Canada and overseas…that the most important powers
are those that are general rather than specific, and proactive rather than
reactive." 57 The choice
of an ombuds-model for the Office of the Privacy Commissioner of Canada was
a deliberate choice, intended to position the Office in the requisite proactive
way. Far from adding to the burden for complainants, the Commissioner's role
is intended to alleviate it.
Some critics are troubled by their assessment of the role of the Privacy Commissioner
vis à vis the Federal Court. As Berzins writes:
Implicit in this is that the Commissioner's office will be the repository
of significant privacy expertise. However, when it comes to defining the
meaning of the Act's core provisions, the Commissioner is relegated essentially
to the sidelines. Although a complainant must first go to the Commissioner,
enforcement, like interpretation of the legislation, is ultimately with the
Federal Court. In fact, an application to the court involves a full review
on the merits with no special significance being attached to the Commissioner's
investigation findings. 58
To date, this is an issue which has not been fully resolved by the Courts.
However, in a recent Federal Court decision 59 Mr.
Justice Simon Noël recognized that
While exercising its discretion de novo the Court will give less deference
to the decision of the Privacy Commissioner than it would otherwise, some
due regard is warranted toward the factors taken into consideration by the
Privacy Commissioner in balancing the privacy interests of the complainant
and the employer's legitimate interest in protecting its employees and property. 60
In these early days of judicial interpretation of PIPEDA, this is a very positive
step, indicating recognition that the expertise of the Privacy Commissioner
must not be disregarded at the Federal Court level as some critics have feared
could happen. Instead, the Privacy Commissioner is being accorded a status
analogous to that of an expert witness in Court — while not accorded complete
deference, the Commissioner's position is given particular weight in light
of her recognized expertise.
Conclusion
The ombuds-model was selected as the appropriate model to deal with public
sector privacy issues back in 1983 when the Privacy Act was enacted. The model
was again selected in 2000 as the appropriate model for overseeing PIPEDA at
an initial stage when individuals were setting out to learn more about their
privacy rights, and organizations were becoming increasingly sensitized to
their correlative responsibilities.
Throughout this article, I have attempted to respond to criticisms that have
been made about the effectiveness of the current model for overseeing the personal
information management practices of private organizations subject to PIPEDA.
I have done so by trying to enlighten the discussion with a fuller understanding
of the model itself. I have not attempted to argue for or against
the merits of the model. This is something that should more appropriately be
the subject of much broader, public debate in the coming year in the course
of the five-year review of PIPEDA mandated by Parliament at section 29(1).
This debate will also be of great interest for the purpose of reviewing the
Privacy Act, which I have argued elsewhere is long overdue for major reform
and modernization. In the context of each of these major legislative reviews,
the fundamental question must be: what is the most appropriate mode of regulating
public or private sector activity that will best serve the interests of Canadians?
It may be that the ombudsman continues to be the most effective approach. Or,
perhaps an alternative approach would now be deemed to be more optimal as we
enter a more mature phase of implementation and as we face complex challenges
of modern information technology and national security concerns that could
not even have been imagined five years ago. Indeed, we are arriving at a critical
juncture when many of Parliament's starting assumptions will need to be revisited
and enlightened by inclusive public dialogue to either confirm or improve the
current model.
In the meantime, however, what I have tried to do is separate out oranges
from apples. Throughout this paper, I have attempted to re-direct current criticisms
so that they focus more directly on the merits of the approach itself, rather
than denature the model in an effort to turn it into something that it is not.
The ombudsman model has its own set of attributes and benefits inherent in
its underlying philosophy. We should be examining whether that model in its
integrity continues to meet Canadians' needs for privacy protection. If not,
we should be thinking outside the box towards other more innovative and appropriate
approaches - not cherry picking among the essential features that made the
ombuds-model attractive in the first place, choosing to completely ignore some
of them while imposing other aspired attributes that would be wholly inconsistent
with its fundamental purpose. Let the arguments be focused on the right vision
for privacy protection in Canada, and the appropriate model should then be
allowed to follow in a consistent and coherent form to give meaningful effect
to that vision.
![Footnote](/web/20061028174513im_/http://www.privcom.gc.ca/images/hr_footnote.gif)
1 Privacy Commissioner of
Canada. I would like to thank my General Counsel, Patricia Kosseim, and Legal
Counsel, Jennifer Barrigar, without whose assistance this paper could not have
been written.
2 Linda C. Reif, "Building
Democratic Institutions: The Role of National Human Rights Institutions in
Good Governance and Human Rights Protection" (2000) 13 Harvard Human Rights
Journal 1 at 7.
3 Ibid., at 8.
4 Nathalie Des Rosiers, "Balance
and Values: The Many Roles of an Ombudsman", presentation delivered at the
Annual Conference of the Forum of Canadian Ombudsman, April 2003 at 3.
5 Alberta and New Brunswick
(1967), Quebec (1968), Manitoba and Nova Scotia (1970), Saskatchewan (1972),
Ontario (1975), Yukon (1996). Interestingly, provincial freedom of information
and/or protection of privacy models have incorporated both order making and
the ombuds-model. Manitoba, New Brunswick, Newfoundland, Nova Scotia, Saskatchewan,
the Yukon, the Northwest Territories and Nunavut have employed the ombuds-model,
while Alberta, British Columbia, Ontario, Prince Edward Island and Québec
have all incorporated some form of order-making power into their legislation.
6 R.S.C. 1985, c. 31 (4th
Supp.).
7 R.S.C. 1985, c. A-1.
8 R.S.C. 1985, c. P-21.
9 Canadian Ombudsman Association, "A
Federal Ombudsman for Canada : A Discussion Paper" (1999) http://204.101.252.150/home/FedOmbDiscussionPaper20May99.htm.
10 Carolyn Steiber, "57
Varieties: has the Ombudsman Concept become Diluted?" (2000) 16(1) Negotiation
Journal 49 at 56.
11 S.C. 2000, c. 5.
12 In Lavigne v. Canada
(Office of the Commissioner of Official Languages) [2002] 2 S.C.R. 773,
the Supreme Court of Canada reviewed the Privacy Commissioner's role as an
ombudsman as set out in the Privacy Act and commented at
paragraphs 37 to 39:
In many significant respects, the mandates of the Commissioner of Official
Languages and the Privacy Commissioner are in the nature of an ombudsman's
role (see M.A. Marshall and L.C. Reif, "The Ombudsman: Maladministration
and Alternative Dispute Resolution" (1995), 34 Alta. L. Rev. 215):
- They are independent of the government's administrative institutions
and hold office during good behaviour for a specified period. They receive
the same salary as a judge of the Federal Court. This independence is reinforced
by the fact that they may not, as a rule, be compelled to testify, and
no civil or criminal proceedings lie against them for anything done in
the performance of their duties;
- They examine complaints made by individuals against the government's
administrative institutions, and conduct impartial investigations;
- They attempt to improve the level of compliance by government institutions
with the Privacy Act and the Official Languages Act;
- As a rule, they may not disclose information they receive.
The Privacy Commissioner and the Official Languages Commissioner follow
an approach that distinguishes them from a court. Their unique mission is
to resolve tension in an informal manner: one reason that the office of the
ombudsman was created was to address the limitations of legal proceedings…
An ombudsman is not counsel for the complainant. His or her duty is to examine
both sides of the dispute, assess the harm that has been done and recommend
ways of remedying it. The ombudsman's preferred methods are discussion and
settlement by mutual agreement.
13 Reif, supra note
2 at 9.
14 Howard Gadlin, "The Ombudsman:
What's In a Name?" (2000) 16(1) Negotiation Journal 37, at 37.
15 Teresa Scassa, "Text
and Context: Making Sense of Canada's New Personal Information Protection Legislation" (2000-2001)
32(1) Ottawa Law Review 1 at 5.
16 John Lawford, " Consumer
Privacy Under PIPEDA: How Are We Doing?" (2004)( Ottawa : Public Interest
Advocacy Centre, November), at 13. Also available at http://www.piac.ca/PIPEDAReviewFinal.pdf.
17 PIPEDA, supra note
11, s. 3.
18 Stephen Owen, "The
Expanding Role of the Ombudsman in the Administrative State" (1990) 40 University
of Toronto Law Journal670 at 684. Stephen Owen held the office of Ombudsman
in British Columbia from 1986-1992, as well as functioning as President of
the International Ombudsman Institute from 1988-1992. While Mr. Owens' article
and experience are firmly situated in the public sector model where the ombudsman
regulates issues between citizens and the State, his insights into the benefits
of the ombuds-model help our understanding of the intent and functioning of
the ombuds-model in the private sector as well.
19 Colin J. Bennett, "The
Privacy Commissioner of Canada : Multiple Roles, Diverse Expectations and Structural
Dilemmas" (2003) 46(2) Canadian Public Administration 218 at 228.
20 Christopher Berzins, "Three
Years under the PIPEDA: A Disappointing Beginning" (2004) 3(3) Canadian
Journal of Law and Technology 113 at 116.
21 Owen, supra note
187 at 683.
22 Ibid.
23 I am indebted to Steven
Welchner, of the Welchner Law Office, for his review of recent case law on
principles of procedural fairness which he presented at the Privacy Investigators'
Conference, held February 2005, in Regina, Saskatchewan.
24 Lawford, supra note
16 at 8.
25 Discussion paper, supra note
9.
26 Baker v.Canada (Minister
of Citizenship & Immigration [1999] 2 S.C.R. 817 at para 22.
27 PIPEDA, supra note
11, s. 20(1). This provision and its exception will be discussed further in
the next section.
28 Owen, supra note
18, at 683.
29 [1994] 2 F.C. 707 at
para 65, aff'd [1996] 1 S.C.R. 6.
30 [2005]
F.C.J. No. 406, 2005
FC 328, currently being appealed to the Federal Court of Appeal.
31 PIPEDA, supra note
11, s.20(1) reads: "Subject to subsections (2) to (5), 13(3) and 19(1), the
Commissioner or any person acting on behalf or under the direction of the Commissioner
shall not disclose any information that comes to their knowledge as a result
of the performance or exercise of any of the Commissioner's duties or powers
under this Part."
32 Blood Tribe, supra note 31 at para. 45.
33 PIPEDA, supra note
11, s. 24.
34 Ibid. s. 20(2).
35 I am indebted to Dougald
E. Brown, of Nelligan O'Brien Payne LLP for his analysis of this question.
36 Coughlan [2000]
O.J. No. 5109 ( Div. Ct. )
37 [1997] 2 S.C.R. 403
38 Ibid. at para
110.
39 Lawford, supra note
16 at 8.
40 Berzins, supra note 20
at 115.
41 Owen, supra note
18 at 683.
42 Des Rosiers, supra note
4 at 3.
43 Canada v. Jolly (1975)
F.C. 216 (F.C.A.); Chiau v. Canada, (1998) 2 F.C. 642 (F.C.).
44 R.S.C. 1985, c. P-21.
45 See clause by clause
proposed changes document at http://www.infocom.gc.ca/specialreports/pdf/Access_to_Information_Act_-_changes_Sept_28_2005E.pdf.
46 PIPEDA, supra note 11,
s. 12(1)(c).
47 Owen, supra note
18 at 684.
48 See discussion above
under Part II, Procedural Fairness.
49 Owen, supra note
18 at 684.
50 Colin Bennett, "The Office
of the Privacy Commissioner of Canada : Regulator, Educator, Consultant and
Judge", paper prepared for a conference on "Two Sides of the Same Coin: Relations
between Parliamentary Agencies and the Public Service", organized by the Canadian
Centre for Management Development ( March 20, 2002 ) at 20.
51 It is important to recognize
that under PIPEDA only the complainant may apply to Federal Court, not the
organization. This decision represents the flexibility and accessibility of
the ombuds-model for individuals. Organizations need not resort to litigation
as the report of the Privacy Commissioner is not binding on them.
52 Lawford, supra note
16 at 22.
53 Elsewhere, I have referred
to this power as one which transforms the Privacy Commissioner from a pure "ombudsman" model
to the "ombuds-plus" model, where by virtue of section 15 the Privacy Commissioner
does have the ability to seek remedies for complainants. See http://www.privcom.gc.ca/speech/2004/sp-d_041028_e.asp.
54 Bennett, supra note 51
at 10. Presumably when Mr. Bennett speaks here of: "judicial review" he
intends to reference a proceeding under section 14 of PIPEDA. Should an actual
judicial review proceeding be initiated by a complainant or organization under
s. 18.1 of the Federal Court Act against the Privacy Commissioner, it would
of course be inappropriate for the Commissioner to actively assist or advise
on the process.
55 See http://www.privcom.gc.ca/information/ar/200405/2004_pipeda_e.asp#015 at
36.
56 Bennett, supra note
51 at 13.
57 Ibid. at 19.
58 Berzins, supra note
20 at 121.
59 Morgan v. Alta
Flights (Charters) Inc. 2005 FC 421.
60 Ibid. at para
17.
|