Developing a Canadian Approach to Privacy

The 2004 Isaac Pitblado Lectures

November 19, 2004
Winnipeg, Manitoba

Address by Jennifer Stoddart
Privacy Commissioner of Canada

These are troubling times for privacy. Inquisitive governments, data-hungry corporations and increasingly intrusive technologies are threatening to suffocate this fundamental right.

But all is not lost. Canada has the good fortune to have developed a robust sense of privacy that reflects our unique history and legal traditions.

I wish to take this occasion to reflect upon the different values of privacy that are, or should be reflected in our Canadian legal system. After almost a year in the position of Privacy Commissioner, I feel somewhat like one of our former Governor-Generals, John Buchan, Lord Tweedsmuir, author of The Thirty-Nine Steps¹, among many other works a novel which Alfred Hitchcock famously made into a classic spy movie. In November 1935, Tweedsmuir, newly arrived in Ottawa, wrote to George V: "The Ottawa people are most cordial and I do not think I have yet become a victim of the celebrated Ottawa gossip, though I do not know with what private vices I may presently be credited".

Canada is blessed with a bijural legal tradition, a common law system in the provinces and territories other than Québec, and a civil law system in Québec. As well as enriching Canada's legal framework generally, these two systems, through their different approaches to privacy, offer a real opportunity to strengthen this right. Federal law draws its inspiration from both legal sources and I would like to take this opportunity to highlight on the contribution of both to our Canadian privacy framework.

Let me explain the distinction between civil and common law visions of privacy. And let me begin with a caveat that there are no hard and fast rules. Civil law approaches share some elements with common law concepts of privacy. But there are broad differences between the two approaches.

In his recent study of what he terms the two Western cultures of privacy, those of the United States and Europe, Professor James Q. Whitman of Yale University Law School argues that there are unmistakable differences in sensibilities between these two cultures about what ought to be kept "private."² Whitman argues that Europeans may engage in practices that seem intuitively objectionable to Americans sense of privacy the public nudity for example. Europeans, on the other hand, may be appalled at the willingness of Americans to discuss their personal financial affairs. "Why is it," he said, "that French people won't talk about their salaries, but will take off their bikini tops on the beach or on the banks of the Seine?" "Why is it," he asks, "that Americans comply with court discovery orders that open essentially all of their documents for inspection, but refuse to carry identity cards? Why is it that Europeans tolerate state meddling in their choice of baby names? Why is it that Americans submit to extensive credit reporting without rebelling?"³

Professor Whitman argues that continental privacy norms are founded on European notions of personal honour, while American concepts of privacy are focused on protecting liberty against intrusions by the state. The exercise of privacy protection by Europeans shows less distrust of government, and more distrust of commercial interests. The opposite, he says, is true of Americans. Continental privacy, he says, was originally a vehicle for protecting the honour of the privileged classes, but it has since evolved. The core continental privacy rights are rights to one's image, name and reputation, and informational self-determination.⁴

He recounts that some Europeans found an effective, if somewhat dramatic way to protect their privacy even before that protection was legislated. Whitman notes that one's private affairs were a matter of one's honour. For men, the primary means of protecting one's honour, including one's private life and the honour and reputation of one's womenfolk, in the middle decades of 19^th century France was the duel.

I believe, however, that Whitman stereotypes honour as being a largely European concern. "Gone with the Wind" in book or film version, hugely popular in 20^th century America, also portrays honour as an integral part of Southern values. Alexander Hamilton, one of the Founding Fathers, was mortally wounded in a duel.

In Canada, we can see the difference between common law and civil law in the underlying language of our own different privacy laws. Look at the Civil Code of Québec,⁵ for example, where Article 3 states that every person is the holder of personality rights, including the right to integrity of his person and the right to the respect of his name, reputation and privacy. Article 35 elaborates on the rights to respect of reputation and privacy. No one may invade the privacy of a person without the consent of the person, unless authorized by law. Article 36 specifies the actions that can be considered invasions of privacy. These include keeping a person's private life under observation by any means. Article 37 requires that every person who establishes a file on another person must have a serious and legitimate reason for doing so. The Québec Charter of Human Rights and Freedoms⁶ states that every person has a right to respect for his private life. Any unlawful interference enables the victim to obtain the cessation of such interference and compensation for the moral or material prejudice resulting from the act.

Some of these concepts are familiar to the common law world of privacy, but others — respect of reputation, and rights of personality, for example — are not. The concept of privacy — at least between individuals — is very fully developed in our one civil law jurisdiction. The common law would serve those within its grasp by extending similar rights. One can argue that the statutory privacy torts enacted in the four provinces of Saskatchewan, British Columbia, Manitoba and Newfoundland go part way towards meeting this level of privacy protection. However, there seems to be very little use of these torts, and most of common law Canada has not adopted them or the related privacy concepts that are so much a part of the Québec legal scene.

Some of the civil law principles expressed in the Civil Code and the Quebec Charter of Human Rights and Freedoms can be seen in the Supreme Court of Canada 1998 decision in Aubry v. Éditions Vice-Versa inc.⁷ In that case, a young woman brought an action in civil liability against a photographer and the publisher of a magazine for taking and publishing a photograph showing her sitting on the steps of a building on a Montreal street. The photograph was taken in a public place and was published without the young woman's consent.

The majority of the Court concluded that the right to one's image is an element of the right to privacy under section 5 of the Québec Charter of Human Rights and Freedoms. If the purpose of the right to privacy is to protect a sphere of individual autonomy, it must include the ability to control the use made of one's image. The Court spoke of the right to one's image as primarily a personality right. There is an infringement of a person's right to his or her image and, therefore, fault as soon as the image is published without consent and enables the person to be identified.

Remember that in the Vice-Versa case, the young woman was sitting in a public place. Some might argue that being in a public place involves a certain surrender of privacy, but that is clearly not what the Supreme Court determined — at least with respect to one's own image in a commercial context.

Contrast this with a statement made by Mr. Justice Binnie in a very recent 2004 Supreme Court of Canada decision, R. v. Tessling,⁸ involving the use of a surveillance technology — thermal imaging — in drug investigations. "A person can have no reasonable expectation of privacy," he said, "in what he or she knowingly exposes to the public, or to a section of the public, or abandons in a public place."

The Vice-Versa and Tessling cases are not strictly comparable. Vice-Versa dealt with interactions between two persons. Tessling dealt with the right to privacy vis-à-vis the state in the context of criminal investigations. But even so, one can see a difference between the Québec's more civilian approach to privacy in the Vice-Versa case, based on rights of personality, and a typical common law approach to privacy in Tessling, based to a much greater extent on territorial privacy.

Tessling also serves to illustrate another aspect of the common law approach to privacy. Much of the case law about privacy stems from the criminal law. The common law world needs to do more thinking about privacy in civil situations.

When the federal Privacy Act came into force 21 years ago, our bijural system was not as prominent in the minds of legal drafters. Now, two decades later, with privacy being assaulted from all fronts, should we not exploit the strengths of each component of that system, and make them work better together, in protecting this right? Let's take the strengths of the civil law system, with its concept of privacy as a vehicle for protecting (honour) reputation and dignity and explore how we can marry it more effectively with the common law concept of protecting privacy as a tool for ensuring autonomy and liberty. Let's take the civilian approach, focused more on the commercial and community exploitation of one's existence, and marry it with the concern about state intrusions that stands at the heart of common law approaches to privacy.

Attempting to bring together the best elements of our two concepts of privacy is not simply a marriage of convenience. It is one of necessity. A plethora of surveillance legislation, both in Canada and abroad, is now laying siege to privacy. The Anti-terrorism Act and the Public Safety Act, 2002, significantly increased the powers of the state to monitor Canadians. The USA PATRIOT Act, along with a host of transborder information-sharing agreements between Canada and the United States, and between Canadian and American corporations may expose the personal information of Canadians to a government that some argue has too readily sidelined privacy in the quest for greater national security.

Canada's federal Privacy Act and other laws that seek to protect privacy are simply not up to the task of countering the thrust for greater surveillance. First, calling our federal law the "Privacy Act" is misleading. It deals only with data protection, a subset of privacy, and is at best a regulatory statute with little bite. Among many other failings, it is powerless in the face of data matching. It is full of exceptions that allow secondary disclosures of information for purposes that have nothing to do with the original reason it was collected, as both the Federal Court of Appeal and Supreme Court of Canada decisions showed in Re Privacy Act (Can.).⁹

The privacy regime in Canada needs to be overhauled. It is not up to the expectations of Canadians, nor the needs of a democracy.

And lawyers have a major part to play in strengthening that privacy regime. We are the trustees of our legal world, including the troubled world of privacy. If we simply allow intrusive surveillance and other activities that diminish privacy, if we fail to harness the strengths of both the civil law and common law systems to make a whole greater than the sum of its parts, it won't be long before we are all sitting at the graveside of privacy.

Yes, as lawyers we are paid to advise clients on how to comply with the privacy rules that regulate their activities. In that role, you are advisers about privacy, not advocates for privacy.

You may have an obligation to represent the client's best interests in advising them. But beyond that, you are also protectors of the fundamental rights of the legal system.

You as lawyers are also able to make things happen, if not through your clients, then through your individual efforts and your collective organizations, such as the Canadian Bar Association or provincial bars. We already see a number of advances in the legal system in support of privacy, the development of privacy courses in law faculties, funding programs such as that established by Industry Canada through my office, and the development of a privacy bar, among them. We are seeing the emergence in case law of the notion of a reasonable expectation of privacy.

We want to do business; we are obliged to serve the interests of our clients; at the same time, we need to practice our craft with a humanistic thrust. In some ways, the issue of individual privacy is a contest between the individual and global business. Personal information is a globally traded commodity, but global standards are lacking, and there is pressure to make whatever standards emerge into a "race to the bottom."¹⁰ In this race to the bottom, the lowest common denominator of privacy protection may prevail. We may make the world safe for global business, and for surveillance by the state, but not for the commodified and much-watched individual.

We have little excuse for not taking the best elements of our bijural system and putting them to work in the name of privacy and other elemental rights. We have no excuse for not trying to prevent a race to the bottom. And we have a sober duty to reflect on how we can protect privacy from being dismantled completely if we experience another event like that of September 11, 2001.

We cannot simply rely on the good graces of privacy commissioners to do the job for us. I would like to think that privacy commissioners can help light the path. But privacy commissioners in Canada and abroad need the assistance of an interested legal profession that will use its creativity and sense of commitment to help secure this fundamental human right. I hope, for the sake of us all, that this is what the profession will do.

¹ Louwnie, Andrew, John Buchan The Presbyterian Cavalier, Toronto: McArthur and Company, 2004, p. 252

² James. Q. Whitman, "The Two Western Cultures of Privacy: Dignity versus Liberty," Research Paper No. 64, Public Law & Legal Theory Research Paper Series, 113 Yale L.J. (April 2004) at 3: paper available online at http://papers.ssrn.com/abstract=476041

³ Ibid. at 9-10.

⁴ Ibid. at 11.

⁵ S.Q., 1991, c. 64.

⁶ R.S.Q., c. C-12, sections 5 and 49.

⁷ [1998] 1 S.C.R. 591.

⁸ 2004 SCC 67 at para. 40.

⁹ Re Privacy Act (Can.) [2000] 3 F.C. 82. The Supreme Court of Canada "agreed substantially" with the reasons given in the Federal Court of Appeal judgment: Privacy Act (Can.) (Re), [2001] 3 S.C.R. 905, 2001 SCC 89.

¹⁰ Professors Colin Bennett and Charles D. Raab discuss this concept in their analysis in The Governance of Privacy: Policy instrument in global perspective (Aldershot: Ashgate Publishing Company (2003)), chapter 10.