Media Centre

Clarifying PIPEDA for your clients

Ontario Bar Association, Privacy Law Section

October 28, 2004
Toronto, Ontario

Address by Jennifer Stoddart
Privacy Commissioner of Canada

Introduction

Good evening.

Thank you for inviting me to speak with you this evening. It is always a pleasure to be in a roomful of hungry lawyers — I trust I can give you something to chew on.

Perhaps you will indulge me if I start off with the following joke, just to get you into the mood for a discussion of PIPEDA, our role in the interpretation of privacy legislation and yours: It goes like this:

A physician, an engineer and a lawyer were arguing about whose profession was the oldest. The surgeon announced, "Remember how God removed a rib from Adam to create Eve? Obviously, medicine is the oldest profession."

The engineer replied, "But before that, God created the heavens and the earth from chaos, in less than a week. You have to admit that was a remarkable feat of engineering, and that makes engineering an older profession than medicine."

And the lawyer said, "So who do you think created the chaos?"

I would like to particularly salute your Privacy Law Section, the organizers of this event.

Co-chairs Priscilla Platt and Jeffrey Kaufman have been diligent in providing members with educational materials and tools to cope with the growing area of privacy law. I was interested to note that there are over 1,000 members in the new Privacy Law Section, which started up in 2003. It's an indication of just how significant this particular specialty of law is becoming.

I'll will talk today the interpretation of PIPEDA, the function of the Office of the Privacy Commissioner and the role of lawyers.

PIPEDA came fully into force for the private sector, with all the attendant confusion and anxiety in the business world, during a time of crisis for our Office.

As you may know, the Chinese ideogram for "crisis" contains characters for "danger" and "opportunity". I believe our Office is trying to respond to the opportunity for change in a strong and positive way. We have emerged with innovative approaches, and with better relationships in the private sector and with our provincial counterparts.

Interpreting the regulatory framework PIPEDA sets out is a challenge, as is the interpretation of the substantive issues dealt with in our findings. I'll first highlight some important PIPEDA interpretations both by the Courts and by us in 2004. Then I'll deal with our role and yours in enforcing privacy legislation.

I think it's fair to say that the Eastmond¹ decision, released in June 2004, is a germinal decision in PIPEDA jurisprudence for a variety of reasons.

First, there is the recognition of the status of PIPEDA. Justice Lemieux wrote "I have no hesitation in classifying PIPEDA as a fundamental law of Canada just as the Supreme Court of Canada ruled the federal Privacy Act enjoyed quasi-constitutional status.² "

Concurrent with the recognition of the importance of the law there is also important recognition of the role of the Privacy Commissioner's Office and of our findings. Eastmond cites Justice Blais³ in Englander to the effect that:

While it is true that he is granted no statutory authority to impose his conclusions or recommendations, I believe that as a statutorily created administrator with specialized expertise, the PCC is entitled to some deference with respect to decisions clearly within his jurisdiction.⁴

Eastmond also constitutes judicial acknowledgement of the four-part inquiry into reasonableness, and makes some excellent comments on the concurrent jurisdiction model. I'm not going to spend my time talking about Eastmond though — I'm sure all of you know it at least as well as I do. I'd rather use it as a starting point, a place from which to talk about the pervasiveness of privacy in general and PIPEDA specifically in legal culture these days.

PIPEDA and our office are popping up all over the place. For instance, a recent Ontario Superior Court of Justice case⁵ went beyond the Commissioner's findings and relied on information from a fact sheet on the Office's website when seeking to interpret the term "commercial activity". And how about Justice von Finckenstein's decision in BMG⁶ which explicitly recognized the PIPEDA privacy rights at stake and then went further and discussed the enactment of PIPEDA as indicative of the need to protect privacy.⁷ We've also seen a number of Superior Court cases⁸ where PIPEDA concerns are raised (albeit unsuccessfully) — I believe this clearly shows a privacy and PIPEDA-consciousness which has pervaded our legal culture at a deep level. Our Office is pleased and proud to be a part of that.

In the early stages of PIPEDA, an informal survey of our findings would have shown, I think, a number of complaints resulting from situations where either an organization was not aware of PIPEDA at all or where it had developed PIPEDA- compliant policies and procedures but had not meaningfully implemented them. I think it's fair to say that this is less of an issue these days. Instead, we're seeing situations which call for a more nuanced approach. Again, I would point to this as symptomatic of privacy and PIPEDA concerns becoming embedded in our approach to things — at issue these days is not so much whether PIPEDA applies but how to interpret and apply it.

In our view, section 3 of the Act is a keystone of interpretation. As you're all aware, it is s. 3 which calls for a balancing approach to PIPEDA, recognizing the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances. To put it another way, as we stated in one of our findings, the loss of privacy must always be weighed against the benefits, and the purposes for the measure must always be grounded in a defensible need. We could tie everything up nicely at this point and refer back to Eastmond for a discussion of how to conduct that weighing/balancing process. Instead though, I'd rather take you through a few recent case summaries which demonstrate our Office's approach to striking the PIPEDA balance. I have chosen the theme of employee privacy to illustrate this.

In a recent finding, the Office received complaints from employees of a telecommunications provider. The organization had instituted a new system which used a voice-print (biometric) as an access/identifier to its system, and employees were concerned about being forced to provide a biometric identifier. This was a case where we found that the needs of the organization were sufficient and thus the intrusive collection of information was justified. We looked at the employer purposes for the new system — they'd claimed efficiency and cost-effectiveness, which we didn't think were sufficient justifications, but they also made a strong argument for security needs. On the other side, we considered the fact that the voice print could only be used for the limited purpose of one to one authentication. We concluded that given that the voice-print does not appear to be unduly invasive, an appropriate balance between the employees' right to privacy and the employer's needs has been struck.

Employee surveillance questions occupy a strong position in complaints received in 2004, with many organizations struggling to achieve the appropriate PIPEDA balance. In a recent finding, the Assistant Commissioner wrote that the use of video cameras to monitor employee productivity or to manage the employer/employee relationship will have a chilling effect on employee morale if it goes unchecked. It is imperative to achieve an appropriate balance between the privacy rights of the individual and the informational needs of organizations. How does this balance play out in real situations?

Let's look at case summary # 279, a good example of failure to strike the balance. An internet service provider had installed two web cameras to monitor the performance of its employees. The webcams streamed this surveillance video 24/7 to a secure web site which senior managers could access. The organization offered a number of reasons why the cameras were necessary, but it eventually became clear that the purpose for the cameras was deterrence of all employees from engaging in behaviour the employer did not like/want/approve of.

While privacy-intrusive measures can certainly achieve that end and at minimal cost, we believe that PIPEDA in general and specifically s. 3 mandates that the cost to human dignity of such measures be factored in. When human dignity of employees was considered, we concluded that continuous, indiscriminate surveillance of employees is based on a lack of trust and treats all individuals with suspicion when the underlying problems may rest with a few individuals or with a management plan that may not be entirely sound. The effect of such omnipresent observation is stifling. While it may prevent undesirable behaviour, it also forces the employee to call into question every potential action, every potential comment no matter how benign. The goal of ensuring adherence to the company's vision comes at too high a price to our individual autonomy and freedom. Thus, in this situation, the balance had been tipped too far towards the organization's needs and not far enough towards the privacy rights of the employee. The complaint was determined to be well-founded.

Does the appropriate balance change when the surveillance is not ordinarily targeted at the employees but is incidental? In case summary #265, employees complained that their employer had used video cameras (ordinarily used for operational purposes rather than employee surveillance) to determine that they were leaving company property during work hours without permission. The employees were subsequently penalized for leaving without permission. The Assistant Commissioner first distinguished between the ordinary purpose of the cameras (enhancing the safety of the workplace, an appropriate purpose under PIPEDA) and the purpose to which they were put in this situation. We noted that the employer had failed to contextualize the necessity for using the cameras to manage workplace performance — no evidence of persistent problems with these or any employees was raised nor were any less intrusive measures attempted to manage the problem. In language reminiscent of summary # 279, the finding keys on the relationship of trust between an employer and employee, and remarks that cameras are highly privacy intrusive and thus a decision to use them must be taken with great care and deliberation. Where there is a less intrusive method of achieving the same result, it should be the first avenue of recourse. Again, this complaint was well-founded.

What about when the surveillance takes place off company grounds? In case summary #269 we reported on a situation where an employer hired a private investigator to conduct surveillance (including video) on an employee who was off work on disability. The company ultimately used the videotaped footage to terminate the employment. At the outset, the Assistant Commissioner expressed concerns about video surveillance, noting that it is extremely privacy-invasive and that resorting to video surveillance, especially on employees away from the worksite, must be considered only in the most limited cases. The organization here had invoked s. 7(1)(b) to justify the surveillance, and the Assistant Commissioner reminded them that an organization must have substantial evidence to support the suspicion that the relationship of trust has been broken, must be able to show that it has exhausted all other means of obtaining the information that it requires in less privacy-invasive ways, and must limit the collection to the purposes to the greatest extent possible. In this case, we felt that in all the circumstances the company had acted appropriately, and the complaint was considered to be not well-founded.

The role of the Privacy Commissioner is that of an ombudsman — an ombudsman "plus" — with power to take cases to Federal Court in specific circumstances, both under the Privacy Act and PIPEDA.

The pre-existing structure of the office of the Privacy Commissioner meant that Parliament presumably found it convenient to graft new legislation onto it. An ombudsman is a rather solitary figure in the landscape of the regulation of commercial activity in Canada. Indeed, the dominant model for the regulation of personal information in the provincial sector is that of a multi-functional administrative tribunal, such as those existing for some time now in Quebec, Ontario, British Columbia and Alberta.

I have observed in the time I have been federal Privacy Commissioner, which has coincided with the final phase of PIPEDA roll out to all types and sizes of commercial activities, that the traditional mode of operation of an ombudsman's office puzzles many members of the Bar. Thus I hear repeated queries and criticisms of the policy which permits anonymity of parties when cases are identified on our web site only by number. The absence of the use of sanctions has also been raised in recent months, comparing our regime with what is characterized as a more transparent, punitive system present in the United States.

Many of you have asked why we do not release the full text of the finding for each case but only the summary and why there is such a time lag between the date of a finding and the date of the posting of the summary And the removal of case summaries from the site without prior notice brought vociferous protest from members of the Bar. Finally, the fate of findings that are challenged in Federal Court are not on the website as they perhaps should be, a leading scholar has recently pointed out.

All of these criticisms and suggestions are valid ones and reflect, to my mind, the tension between habitual practices in the commercial law world and provincial information regulating bodies on one hand, and the adaptation of the federal ombudsman model to the new world of pan-Canadian business activity.

That being said, what is our response to these observations?

First of all, as to the content of our website.

Clearly we need to continue our work to make our site a more practical tool for lawyers. The Assistant Commissioner, PIPEDA, and I plan to add a new section in our site where relevant legal information would be pooled. This could include, for example, the ulterior proceedings at the Federal Court level for both acts, leading cases of any Canadian courts where the Privacy Act or PIPEDA are mentioned, as well as cases relevant to the interpretation of our acts. I am thinking, for example, of the recent Federal Court decision confirming the power of the Information Commissioner to examine material in order to decide whether exemptions to access apply.

I have asked our staff to change procedures so that the gap between the finding and the case summary is narrowed. I am also examining the possibility of adapting the procedures used by other federal institutions whose findings, or decisions, are published simultaneously in both official languages.

However, given that our findings must be edited and summarized to avoid identifying the parties inadvertently, we will continue to use our editorial prerogative to choose which ones will be posted based on their unique educational value. I must state that after three years, certain fact situations reoccur in our complaints, although not with the same respondents. Our web site is an educational tool and as such, has content different from that of an administrative tribunal.

The anonymity of the parties involved in a complaint file stems from several factors.

First of all, the modus operandi of an ombudsman, which is to mediate, resolves conflict and suggests ways to prevent conflict from occurring.

When she was President of the Law Commission of Canada, Nathalie Des Rosiers gave and address entitled "Balance and Values - the Many Roles of an Ombudsman"⁹ which stated at the outset that "...whether responding to citizen complaints about their government, students complaining about a university administration or consumers regarding a large organization, an ombudsman is focused first and foremost on the protection of certain values, values of equity and accountability." We often have to ensure certain social values are promoted by crating an ombudsman, the Office of the Commissioner of Official Languages, the Office of the Privacy Commissioner, etc."

Surveying the academic literature of ombudsmen and referring to the organizational contexts where the ombudsman works, she noted :

"The ombudsman is therefore a regulatory agent in this power relationship, with respect to certain values. Often, he or she focuses on balancing this relationship." The three aspects of the ombudsman role she finds significant are conflict resolution, prevention and change.

A year previously, the Supreme Court of Canada, speaking unanimously in the Lavigne case, had said:

"The Privacy Commissioner and the Official Languages Commissioner follow an approach that distinguishes them from a court. Their unique mission is to resolve tension in an informal manner: one reason that the office of ombudsman was created was to address the limitations of legal proceedings... An ombudsman is not counsel for the complainant. His or her duty is to examine both sides of the dispute, assess the harm that has been done and recommend ways of remedying it. The ombudsman's preferred methods are discussion and settlement by mutual agreement."¹⁰

Another factor influencing our anonymous procedure is the fact that Parliament chose an ombudsman plus system for the enforcement of its new private sector personal information protection scheme. This choice is reflected in the statements made at the time the legislation was adopted. It was a deliberate choice.

Whatever the merits of a litigation model for the enforcement of privacy principles may be and they are doubtless many, it would be impossible to contort Parliament's intent in order to obtain the kind of court activity that we have seen south of the border. However, the question is open for lawyers and legal scholars and stakeholders to prepare for the 2006 PIPEDA review — would a more public, more tribunal- like model be appropriate for the enforcement of privacy rules?

In the meantime the coming year, 2005, should see our office using the full range of enforcement tools the law provides us with. This would include releasing names of respondents when it is in the public interest, as the statute allows us to do. In the public interest means , minimally , that there is more than an avowed slip up of regular privacy — protecting procedures or a mistake that had implications for a contained group of customers. Public interest means, to my mind, that citizens and consumers should know about persistent privacy invasive acts and serious policy shortcomings which have gone unchecked in spite of the interventions of our office.

Other tools for enforcement include applying to the Federal Court for redress on behalf of a complainant. As well, complainants can take our findings to Federal Court either to contest them or to obtain the damages we cannot order. Until now, there have been no awards of damages by the Court.

And I have already spoken of the follow up to the well-founded complaints of the previous years. We are now actively reviewing some 40 files where we do not have knowledge that corrective actions have been taken. We plan to audit the practices of those organizations where we have reasonable grounds to believe that compliance with privacy principles has not been followed.

Statistics on PIPEDA enforcement for 2004 so far suggest that the use of mediation and alternate dispute resolution has been welcomed by complainants and respondents. We are currently examining those settlements which have a clear educational value and will post the descriptions of some of them on our site.

Overall of 271 PIPEDA files closed in 2004, 50 percent have been settled and only 21 percent are well founded.

I'll conclude my remarks about our approach to enforcement by saying that we are very committed to interjurisdictional co-operation and seamless privacy protection for individuals and organizations in spite of the complexities of our constitution. To this end, we have set up a working group with lawyers from Commissioner Ann Cavoukian's office and are actively seeking the same type of arrangements which have proved to be practical and useful in dealing with the period between the coming into force of legislation in British Columbia and Alberta and its designation as substantially similar. We are happy to direct complainants and persons seeking information to the office of the Ontario Information and Privacy Commission and allow them to handle the complaint wherever possible. However, should individuals wish to complain to us as well, PIPEDA directs that we must take those complaints. After all, matters not be resolved amicably, more serious legal proceedings such as investigations would have to take into account the fact that PIPEDA does still apply to the commercial health sector in Ontario until such time as the Ontario legislation may be deemed substantially similar. the publication of the substantially similar designation.

The importance of the Privacy Bar

The annual meeting of the Canadian Bar Association in Winnipeg this summer gave us a hint of the important role in the shaping of public and legal policy this newly formed and influential group can play. The contribution of privacy jurists to the review of our anti-terrorism legislation, slated for this winter and to debates on issues like the influence of the PATRIOT Act on Canadians' personal information or the storage of e-mails by internet service providers for periods of up to six months is crucial to the shape our democracy will take in the months and years ahead.

As lawyers and specialists, you help to set the tone for discussing the regulation of personal information and your advice is taken seriously. Use your influence thoughtfully and carefully, mindful not only of your client's needs billable hours but the direction you may be setting for important sectors of our society. I must mention that my colleague, Commissioner Ann Cavoukian, has drawn my attention to a plague of 14 page (or thereabouts) privacy notices which apparently confuse patients and clients and do not do justice to the principle of informed consent or the important of the protection of personal information in a technologically sophisticated democracy. Let us, as lawyers, demonstrate that we are good at creating other things than chaos.

I'll conclude by mentioning a project on our drawing board which should involve several members of the privacy bar across Canada. It is the publication of a succinct guide, in both official languages, to the jurisprudence developed under Quebec's private sector legislation, in force for almost ten years now and still the only legislation in Canada to have actually been designated substantially similar. The Office of the Privacy Commissioner hopes this may help to promote consistent interpretation of provincial and federal legislation where the same principles are involved. We hope to publish this guide in early 2005.

Privacy and the protection of personal information will present us, as lawyers, with moral and professional challenges for many years to come. I hope we can successfully rise to this challenge and use this as an opportunity to participate in shaping the values of business, citizens and consumers. We must not forget that personal dignity and autonomy are core values of Canadian society while personal and commercial freedoms are our hallmark.

¹ Eastmond v. Canadian Pacific Railway , [2004] F.C.J. No. 1043

² Ibid para 100.

³ Although the passage was cited with approval, Justice Lemieux did qualify it slightly, writing in para 123 that "I do not accord any deference on the Commissioner's finding of fact because I am satisfied the evidence before me is considerably different than that gathered by the Privacy Commissioner's investigation."

⁴ Englander v. TELUS Communications Inc. , [2003] F.C.J. No. 975 (T.D.), para 33.

⁵ Rodgers c. Calvert , [2004] O.J. No. 3653 (Q.L.)

⁶ BMG Canada Inc. v. John Doe 2004 FC 488

⁷ Ibid para 38

⁸ see for example Rodgers v. Calvert , [2004] O.J. No. 3653 (Q.L.); Ferenczy v. MCI Medical Clinics , [2004] O.J. No. 1775 (Q.L.); Clustercraft Jewellery Manufacturing Co. Ltd. V. Wygee Holdings , [2004] O.J. 2877 (Q.L.); international Brotherhood of Electrical Workers, Local 213 and 258 v. BCT Telus Communications Inc. , [2002] B.C.J. No. 918 (Q.L.).

⁹ see http://www.lcc.gc.ca/en/pc/speeches/sp20030401.asp

¹⁰ Lavigne v. Canada (Office of the Commissioner of Official Languages) , [2002] 2 S.C.R. 773, para 38