Vol. 139, No. 47 — November 19, 2005

Regulations Amending the Regulations Specifying Investigative Bodies

Statutory authority

Personal Information Protection and Electronic Documents Act

Sponsoring department

Department of Industry

REGULATORY IMPACT
ANALYSIS STATEMENT

(This statement is not part of the Regulations.)

Description

Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA) establishes rules to govern the collection, use and disclosure of personal information by organizations in the course of commercial activity. The legislation requires an organization, which is disclosing personal information, to obtain the individual's consent in most circumstances. An exception to this rule is found in paragraphs 7(3)(d) and (h.2) of the Act which permit the disclosure of personal information to and by a private investigative body, without the knowledge or consent of the individual, if the investigative body is specified by the Investigative Bodies Regulations. The purpose of this amendment to the Investigative Bodies Regulations is to name additional investigative bodies for the purposes of paragraph 7(3)(d) or (h.2) of the Act.

Many investigations into frauds and breaches of agreement are conducted by private sector organizations, either acting as or making use of independent, non-governmental investigative bodies. Should the investigation reveal grounds for suspecting that a fraud has been committed or a law contravened, the organization may then turn the findings over to a police or other law enforcement agency for further action or (as in the case of professional regulatory bodies such as a provincial association of professional engineers) may take appropriate disciplinary action pursuant to its own statutory authority. Paragraph 7(3)(d) of the Act allows an organization to disclose personal information, without the consent of the individual, to a private investigative body in order to instigate or facilitate an investigation. Paragraph 7(3)(h.2) of the Act allows an investigative body to disclose personal information to another private organization, including the client organization on whose behalf it is conducting the investigation. The disclosures are circumscribed as they must be related to investigations of a breach of an agreement or a contravention of the law and be reasonable.

Paragraph 7(3)(h.2) of the Act completes the exception provided in paragraph 7(1)(b) of the Act for collection without consent for the purposes of the prevention of fraud by extending it to disclosure. Collection alone would be of limited use to those combatting fraud and other breaches of agreement, unless the information could be disclosed to the parties that need the information. However, without paragraph 7(3)(h.2) of the Act, the flow of information could only go in one direction—from the organization to the investigative body. The investigative body would be unable to disclose the results of its investigation back to its client or other interested parties without consent.

The ability to exchange personal information without consent for investigative purposes between or among private organizations is the only exception granted to these organizations by the Regulations. Organizations and investigative bodies which exchange personal information will remain responsible for compliance with all other requirements of the Act for this information and will be subject to oversight by the Privacy Commissioner of Canada and the ability of individuals to seek redress in the Federal Court of Canada. More particularly, the general requirement that the Act imposes on all organizations to obtain consent before disclosing personal information is not altered by virtue of granting an organization status as an investigative body. Organizations with investigative body status would be able to disclose personal information in their investigations without the consent of the individual only in those exceptional circumstances in which obtaining consent is impossible, impractical or undesirable because it would frustrate the conduct of the investigation.

During the initial preparation of the Regulations, Industry Canada developed a set of criteria that would be used in the assessment of candidates for investigative bodies. These criteria were intended to cover privacy concerns associated with allowing organizations to disclose personal information without consent for investigative purposes. All of the criteria would not necessarily be applicable to each investigative body. The criteria include

• the specific contraventions of law or breaches of agreements against which the investigative activities are directed;
• the specific personal data elements which are disclosed by other organizations to the body; the specific personal data elements which flow back to the organizations from the body; the uses and disclosures made of the information by the body; whether audit trails are maintained; the length of time the information is kept; and the security standards and practices in place for retention and disposal of the information;
• whether the operational structure of the body or process is fully documented and formalized and the authority, responsibility and accountability centres are identified;
• whether there are specific legal regime, licensing requirement, regulation or oversight mechanisms to which it is it subject and whether sanctions or penalties for non-compliance exist;
• the privacy protection policies and procedures, such as a privacy code, followed by the body and the extent to which the policies and procedures comply with Part 1 of the Act;
• the extent to which the investigative body is independent from the association of members or client organizations that it serves;
• the extent to which all alternative methods of complying with the Act, such as contract or consent, have been exhausted; and
• the amount of information provided to individuals about the existence and operation of the body and about how to make a complaint or seek redress.

Industry Canada will continue to exercise care in the naming of additional investigative bodies because these bodies are allowed to collect, use and disclose personal information without consent in certain circumstances, contrary to the general regime of the Act. Generally, only an organization which actually conducts investigations will be considered for investigative body status—those that do not will not be considered. Applications that seek investigative body status for an organization when only some of the organization's work is investigative will raise concerns about the potential for the misuse of the authority. Applications that seek to grant investigative body status to a large number of small organizations will raise concerns about effective oversight.

Industry Canada would also like to emphasize that the current criteria for investigative body status are meant to be read within the overall compliance regime of the Act. This means that an investigative body would be expected to conduct its operations with the minimum privacy impairment that is necessary for the carrying out of its investigative function. It also means that the public interest in the organization's investigative activity should outweigh the harm caused to associated privacy interests. Finally, organizations that are specified by name or by class in the Regulations as investigative bodies should understand that the designation applies only to the part of the organization that requires the exception and only to the investigative activities conducted by that part of the organization. For example, when the designation is granted to a professional regulatory body such as a provincial association of professional engineers, only the corporately defined entities and activities that relate directly to the investigation functions of the association have investigative body status, and the status applies only to the investigative work that they do.

Part 1 of the Act was implemented in two stages. On January 1, 2001, it applied to the personal information of the customers and employees of the federally regulated private sector, including telephone and transportation companies, broadcasters, and banks. It also applied to organizations that sell personal information across provincial borders, e.g. companies selling or renting mailing lists. On January 1, 2004, the Act applied to all personal information collected, used or disclosed in the course of commercial activity.

Due to the phased introduction of the legislation and the fact that it is new to the private sector, it was expected that additions to the list of investigative bodies in the Regulations would be necessary. For this reason, the Department has indicated that it would continue to consider applications on a case-by-case basis in the future. The Department would also like to underline the fact that the behaviour of organizations receiving investigative body status will continue to be monitored by Industry Canada once the designation has been given. Should concerns be raised regarding the compliance of an investigative body with all of the requirements of PIPEDA, e.g. through findings issued by the Privacy Commissioner of Canada, then the investigative body designation will be withdrawn by an amendment to the Regulations.

Industry Canada has now completed its review of new applications. The applicants consist of various professional regulatory bodies with a statutory authority to investigate professional misconduct on the part of their members. These include the organizations representing the engineers and insolvency and restructuring professionals of Canada, the land surveyors, architects, foresters, teachers and veterinarians of Ontario and other organizations in Ontario which regulate the funeral service, motor vehicle, real estate and travel industries and various industry safety standards. The professional bodies which regulate the dentists and the real estate industry of Alberta, the physicians and surgeons of Manitoba and the registered nurses of Nova Scotia have also applied.

On the basis of the documentation submitted describing their operation and investigative activities, Industry Canada has concluded that the Regulations should be amended by adding the organizations listed. Copies of their submissions may be obtained by contacting Industry Canada or by visiting the Electronic Commerce Web site at http://e-com.ic.gc.ca/epic/internet/inecic-ceac.nsf/ en/h_gv00206e.html.

Alternatives

The legislative framework in Part 1 of the Act provides that an investigative body, for the purposes of paragraph 7(3)(d) or (h.2) of the Act, must be specified by regulation. There are no alternatives to deal with the collection, use and disclosure of this information without consent.

Benefits and costs

The professional disciplinary bodies investigate the conduct of their members to prevent incompetent, unethical and unauthorized practices, which is to the general benefit of all persons who make use of their professional services.

Costs

The Regulations should not impose significant additional costs on the organizations to which they apply, as they merely permit the continuation of previous information sharing relationships between organizations and the specified investigative bodies. For some of the organizations which are not themselves subject to PIPEDA, such as the professional regulatory bodies, there could be some administrative costs associated with, for example, developing a Canadian Standards Association (CSA) compliant privacy code.

The Regulations will have no impact on Department resources.

Consultation

Following the prepublication of the new investigative bodies in the Canada Gazette, Part I, in 2000 and 2003, Industry Canada has not received any complaints or expressions of concern regarding the operation of these organizations or of the Regulations themselves.

Industry Canada has engaged in extensive discussions with the applicants concerning their investigative activities and the need for an amendment to the Regulations in order to add them to the list of investigative bodies. Consultations with the Office of the Privacy Commissioner have also taken place.

Compliance and enforcement

Individuals may make complaints about the practices of an organization to the Privacy Commissioner of Canada who will investigate the matter and deliver a report to the parties. The Commissioner may make recommendations to an organization concerning its practices and whether they are considered to comply with Part 1 of the Act, but the Commissioner does not have the power to issue binding orders on the organization. The individual or the Privacy Commissioner, or both acting together, may take unresolved complaints to the Federal Court of Canada which has the power to order an organization to change a practice and to pay damages to the individual.

Contact

Mr. Richard Simpson, Director General, Electronic Commerce Branch, Industry Canada, 300 Slater Street, Room D2090, Ottawa, Ontario K1A 0P8, (613) 990-4292 (telephone), (613) 941- 1164 (fax), simpson.richard@ic.gc.ca (email).

PROPOSED REGULATORY TEXT

Notice is hereby given that the Governor in Council, pursuant to paragraph 26(1)(a.01) of the Personal Information Protection and Electronic Documents Act (see footnote a), proposes to make the annexed Regulations Amending the Regulations Specifying Investigative Bodies.

Interested persons may make representations with respect to the proposed Regulations within 30 days after the date of publication of this notice. All such representations must cite the Canada Gazette, Part I, and the date of publication of this notice, and be addressed to Richard Simpson, Director General, Electronic Commerce Branch, Industry Canada, 300 Slater Street, Ottawa, Ontario K1A 0C8 (tel.: (613) 990-4292; fax: (613) 941-1164; e-mail: simpson.richard@ic.gc.ca).

Persons making representations should identify any of those representations the disclosure of which should be refused under the Access to Information Act, in particular under sections 19 and 20 of that Act, and should indicate the reasons why and the period during which the representations should not be disclosed. They should also identify any representations for which there is consent to disclosure for the purposes of that Act.

Ottawa, November 14, 2005

DIANE LABELLE 
Acting Assistant Clerk of the Privy Council 

REGULATIONS AMENDING THE REGULATIONS SPECIFYING INVESTIGATIVE BODIES

AMENDMENT

1. Section 1 of the Regulations Specifying Investigative Bodies (see footnote 1) is amended by striking out the word "and" at the end of paragraph (z.22) and by adding the following after paragraph (z.23):

(z.24) Alberta Dental Association and College;

(z.25) Association of Ontario Land Surveyors;

(z.26) Board of Funeral Services;

(z.27) Canadian Association of Insolvency and Restructuring Professionals;

(z.28) College of Physicians and Surgeons of Manitoba;

(z.29) College of Veterinarians of Ontario;

(z.30) Ontario Association of Architects;

(z.31) Ontario College of Teachers;

(z.32) Ontario Motor Vehicle Industry Council;

(z.33) Ontario Professional Foresters Association;

(z.34) Association of Professional Engineers of Yukon;

(z.35) Association of Professional Engineers and Geoscientists of the Province of British Columbia;

(z.36) Association of Professional Engineers, Geologists and Geophysicists of Alberta;

(z.37) Association of Professional Engineers, Geologists and Geophysicists of the Northwest Territories;

(z.38) Association of Professional Engineers and Geoscientists of Saskatchewan;

(z.39) Association of Professional Engineers and Geoscientists of the Province of Manitoba;

(z.40) Association of Professional Engineers of Ontario;

(z.41) Ordre des ingénieurs du Québec;

(z.42) Association of Professional Engineers and Geoscientists of New Brunswick;

(z.43) Association of Professional Engineers of the Province of Nova Scotia;

(z.44) Association of Professional Engineers of Prince Edward Island;

(z.45) Association of Professional Engineers and Geoscientists of Newfoundland;

(z.46) Real Estate Council of Alberta;

(z.47) Real Estate Council of Ontario;

(z.48) Technical Standards & Safety Authority;

(z.49) Travel Industry Council of Ontario; and

(z.50) College of Registered Nurses of Nova Scotia.

COMING INTO FORCE

2. These Regulations come into force on the day on which they are registered.

[47-1-o]

Footnote a

S.C. 2000, c. 5

Footnote 1

SOR/2001-6

NOTICE:
The format of the electronic version of this issue of the Canada Gazette was modified in order to be compatible with hypertext language (HTML). Its content is very similar except for the footnotes, the symbols and the tables.

	Top of page
Maintained by the Canada Gazette Directorate	Important notices