Canadian Privacy Rights and Legislation

Okay, I've updated the study notes with the content you provided. Here are the updated notes.

• Understanding privacy rights and legislation is crucial in today's electronic age.

Introduction

• Privacy has not historically been a separate right under Canadian common law, it was protected by the difficulty of record compilation, but now concerns over increased electronic compilation and transfer are paramount.
• Canadian privacy legislation originally related to personal data held by governments.
• British Columbia (BC) and Alberta passed laws in the 1990s covering personal information held by the government agencies, and public bodies like hospitals.
• BC's Freedom of Information and Protection of Privacy Act (FIPPA) enacted in 1992, permits individuals to request information held by the BC government.
• Alberta legislature passed a parallel statute in 1994, performing a similar function to BC's FIPPA.
• Every province and territory has privacy legislation governing the collection, use, and disclosure of personal information held by government agencies. (Office of the Privacy Commissioner of Canada, 2014)
• In 2000, the federal government, followed by some provinces including BC and Alberta, passed the first privacy legislation covering personal information held by private sector organizations.
• The federal law is called the Personal Information Protection and Electronic Documents Act (PIPEDA).
• In BC and Alberta, the statute is called the Personal Information Protection Act (PIPA).
• BC & Alberta's PIPA acts are the provincial equivalents of the federal PIPEDA and were both enacted in 2004.

FYI: Alberta’s Personal Information Protection Act Amended

• In November 2013, the Supreme Court of Canada struck down Alberta’s PIPA.
• A one-year period was provided to bring the law in line with the Canadian Charter of Rights and Freedoms due to a dispute over photographing picket lines. (Alberta (Information and Privacy Commissioner) v United Food and Commercial Workers, Local 401)
• In a 9-0 decision, Alberta's privacy law was ruled unconstitutional in a dispute over the right of a union to photograph people crossing a picket line.
• The Court considered Alberta's privacy law to be overly broad and imposing an undue restriction on union's right to communicate during a legal strike. Abella and Cromwell JJ noted that Alberta’s PIPA “imposes restrictions on a union’s ability to communicate and persuade the public of its cause, impairing its ability to use one of its most effective bargaining strategies in the course of a lawful strike”.(at para 37).
• Alberta’s privacy legislation was changed following this, with amendments to PIPA effective on December 17, 2014.
• These amendments address the collection, use, and disclosure of personal information by unions during a lawful labor dispute.
• No other changes were made to the legislation at the time.
• A comprehensive review of Alberta's PIPA was performed in 2016, yielding ten recommendations, but the Act has not been substantially amended further since.

Potential Liability of Tort of Invasion of Privacy

• Employers and employees should be aware of potential liability for the tort of invasion of privacy, in addition to privacy rules in FIPPA, PIPA and, PIPEDA - laws that are the focus of this chapter.
• Ontario courts first recognized the common law privacy tort with other provinces following suit, including Nova Scotia and Alberta.
• Alberta recognized a common law privacy tort in 2021 in the case of ES v Shillington outside of an employment law context.
• The common law privacy tort includes private information that employers may collect about their employees of financial records, health records, and even relationships.
• To establish liability for the tort, a plaintiff must prove:
  • the defendant publicized an aspect of the plaintiff’s private life
  • the plaintiff did not consent to the publication
  • the matter publicized/publication would be highly offensive to a reasonable person
  • the publication was not of legitimate concern to the public
• BC courts do not recognize a common law privacy tort, since 1968, the BC Privacy Act has created a statutory tort of violation of privacy.
• Section 1 of the BC statute permits a person to sue for invasion of privacy, even without specific harm (referred to as “actionable without proof of damage”).
• Employers can be vicariously liable for privacy invasions committed by their employees during their duties involving employees, customers, or the public.

Freedom of Information and Protection of Privacy Act (British Columbia and Alberta)

• BC's FIPPA applies to provincial government ministries, Crown corporations, local governments, universities, colleges, school boards, municipal police forces, health boards, hospitals, and self-governing professions. (A detailed list of these public bodies and professions is provided in Schedules 2 and 3 at the end of the Act.)
• Alberta's FIPPA applies to public bodies listed in section 1(p) of the Act.
• Section 2 of the BC Act aims to make public bodies accountable and protect personal privacy by giving the public access to records. "make public bodies more accountable to the public and to protect personal privacy by … giving the public a right of access to records"
• The underlying philosophy in both provinces involves providing citizens with access to government/public body records; it compels fairness, transparency, and credibility.
• FIPPA limits the type and amount of information provincial governments/bodies can collect; there are restrictions on obtaining, storing, or passing citizen information.
• Individual citizens are provided with access to data held by government agencies/bodies.
• The Atwell report exemplifies FIPPA's application to workplace privacy in a public body employer context.
• FIPPA of BC was amended in February 2023 including new requirements to report privacy breaches (unauthorized access, theft, loss, collection, use, or disclosure)
• It also requires public bodies to develop privacy management programs (privacy officer, impact assessments, complaint response, awareness education, policies/processes, service provider obligations, program monitoring/updating)
• Despite FIPPA's importance, PIPA (provincial private sector legislation) is more relevant to cases involving employment privacy disputes.

The Personal Information Protection and Electronic Documents Act and the Personal Information Protection Act

• PIPEDA affects how federally regulated organizations collect, use, disclose, and retain personal information of employees, customers, patients, and suppliers.
• PIPEDA does not directly affect employee information held by provincially regulated employers, however, the federal government has authority over provincially regulated organizations for commercial purposes.
• PIPEDA requirements do not apply to organizations in provinces with substantially similar legislation.
• The federal government agreed to this upon PIPEDA passage.
• Because both BC and Alberta have implemented similar legislation (their respective PIPAs), PIPEDA's application is narrower in those provinces.
• The PIPAs of BC and Alberta are "comparable".
• PIPEDA's principles in handling personal employee information apply, and employers in BC and Alberta must be aware of and follow those principles.

FYI: Key Features of the Federal PIPEDA

• PIPEDA balances an individual's right to personal information privacy against an organization's need to collect, use, and disclose personal information.
• Unless the province has comparable legislation, PIPEDA applies to all Canadian organizations (both federally and provincially regulated) that collect, use, or disclose personal information during commercial activities. (s 4)
• PIPEDA also applies to interprovincial and international transactions involving personal information during commercial activities.
• PIPEDA does not directly apply to personal employee information in provincially regulated workplaces, being federal legislation.
• Personal information under PIPEDA is broadly defined as any factual or subjective information about "an identifiable individual.” (s 2)
• PIPEDA generally requires individual's consent before collecting, using, or disclosing their personal information and information can only be used for the purpose for which consent was obtained
• Organizations must take precautions to safeguard personal information in their possession.
• Individuals have the right to access personal information and challenge its treatment.
• Individuals may complain about how an organization handles personal information to the Office of the Privacy Commissioner of Canada.

What Is Personal Information?

• Personal information broadly includes any factual or subjective information about "an identifiable individual".
• Protected personal information includes:
  • age, home address, and identification numbers (including social insurance number)
  • residential telephone numbers and personal email address
  • sex, religion, ethnicity, social status, and marital status
  • employee files, performance appraisals, disciplinary actions, and evaluations
  • photographs, opinions, and income
  • relevant dates (e.g., birth date)
  • credit records, loan records, purchasing and spending habits, and
  • blood type, genetic information, and medical records
• Personal information includes pay/benefit records, video/audiotapes, and web browsing/email/keystroke records.
• In BC's PIPA, personal information is defined as: information about an identifiable individual, including employee personal information but excludes contact/work product information.
• Alberta's PIPA defines personal information as information about "an identifiable individual".
• Although no exceptions are articulated for “work product information" or for “contact information,” “business contact information” arises as a specific exception to the application of the Act to personal information held by all organizations (s 4(3)(d)).
• Collection, use, protection, and disclosure should adhere to PIPEDA principles, regardless of personal information.

FYI: Amendments to PIPEDA: Bill S-4, the Digital Privacy Act

• The Digital Privacy Act (Bill S-4) was proclaimed on June 18, 2015.
• The act amended PIPEDA and included these key changes:
  • Organizations must report and record security breaches involving unauthorized access to personal information, security safeguard breaches, or failure to establish such safeguards if it risked significant harm to individual.
  • Elimination to personal information exception for employee name, title, business address, or telephone number.
  • PIPEDA covers job applicants beyond employees.
  • Business contact information is exempt regarding its collection, use, and disclosure only for communication in employment, business, or profession contexts.
  • Broadening of scenarios involving the disclosure of personal information without individual knowledge/consent for illegality, fraud, agreement breaches, and financial abuse
  • The privacy commissioner can enter into compliance agreements with terms for statutory compliance.
• (Jacobs, 2014) (Emond Harnden, 2014)*

Amendments to PIPEDA: Bill C-27, the Digital Charter Implementation Act, 2022

• On June 16, 2022, Bill C-27 was introduced by the federal government,
• Although Bill C-27 had not been proclaimed when the text was published, the Digital Charter Implementation Act of 2022 proposed substantial changes to PIPEDA:
  • part 1 of PIPEDA entitled “Protection of Personal Information in the Private Sector" would be replaced by The Consumer Privacy Protection Act
  • appeals of decisions from the privacy commissioner, administrative appeals for the privacy commissioner of Canada, would be heard in a administrative tribunal established by the Personal Information and Data Protection Tribunal Act and would impose penalties for the contravention of certain.
  • a code of conduct to regulate international and interprovincial commerce in artificial intelligence while prohibiting certain conduct in relations to AI by enacting the Artificial Intelligence and Data Act

Ten Fair Information Principles

• PIPEDA recognizes individuals have a right to privacy and organizations require personal data for appropriate purposes and The aim of legislatures is to achieve a fair balance between these two valid requirements.
• Schedule 1 of PIPEDA sets out ten fair information principles ( fair information principles) underlying personal information collection, use, protection, and disclosure, with reasonableness as a standard.
• An organization may collect, use, or disclose personal information only for purposes considered appropriate by a reasonable person. (Section 5(3))
• The BC and Alberta PIPAs retain the fair information principles, explicit or apparent within their legislation.
• One of the the "Privacy Guide for Businesses" (Office of the Privacy Commissioner of Canada, 2020) is discussed as:
  • Be accountable, an organization that collects personal information must appoint one person to oversee its legislative compliance
  • Identify the purpose of collection, and an organization should only use this information for the designated purpose
  • Obtain valid, informed consent and there are some number of exceptions to the need to obtain consent
  • Limit collection, collect only information that is necessary for its stated purposes
  • Limit use, disclosure, and retention, Subject to the exceptions noted below, organizations cannot use the information collected for any purpose other than the one stated
  • Be accurate if use or disclosure of out-of-date or incomplete information would harm the individual, the employer should ensure that the information is accurate
  • Provide safeguards
  • Be open
  • Give individuals access
  • Provide recourse
• Valid, informed consent must be obtained, and is a requirement unless: Collection is in the interests of the individual and consent cannot be obtained in a timely manner (medical emergency); obtaining the individual’s consent would compromise the availability or accuracy of the information, which is relevant to an investigation of a breach of law/agreement. The information is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim; the information was produced by the individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced; collection is for journalistic, artistic, or literary purposes; the information is publicly available. the collection is made for the purpose of making a disclosure to a government institution in specific circumstances related to national security or enforcing the law, or is required by law. Providing consent should not be made a condition for supplying a product or service, unless the information is necessary to meet a legitimate purpose that is specifically identified

Role of the Federal Privacy Commissioner and the BC and Alberta Information and Privacy Commissioner

• The Office of the Privacy Commissioner of Canada (OPC) oversees PIPEDA, reporting to the House of Commons and Senate.
• The OPC has powers to conduct audits and investigations into an organization's handling of personal information and can summon witnesses, compel evidence, and demand records
• The OPC makes reports with recommendations after investigations, but does not have the power to issue binding orders; matters can be referred to the Federal Court.
• In BC and Alberta, the OIPC is separate from government monitoring and enforcing FIPPA (public bodies) and PIPA (private organizations).
• The OIPC in BC was established in 1993. It monitors the right of citizens to gain access to records held by more than 2,900 public agencies and over 380,000 businesses with the authorities and duties of the commissioner are set out in part 10 of PIPA and part 4 of FIPPA.
• The Alberta OIPC was established in 1995 with the powers and duties of the commissioner are set out in part 4 of PIPA and part 4 of FIPPA.
• In both provinces, the OIPC ensures that both statutes are administered so as to achieve their objectives of investigating and resolving complaints, mediates and resolves appeals, conducts research, and educates the public.
• Both PIPEDA Case Summary #2003-226, Eastmond v Canadian Pacific Railway, and PIPEDA Findings #2022-006 illustrate issues that privacy commissioners may be called upon to investigate. These cases all involve federally regulated employers, to which PIPEDA applies; however, as noted above, the principles for handling personal employee information are similar under the provincial legislation, so these decisions are also relevant to privacy situations in BC and Alberta. PIPEDA Case Summary #2003-226 involved a telecommunications industry employer’s allegedly casual treatment and eastmond involved an employer’s use of non-surreptitious video surveillance. PIPEDA Findings #2022-006 involved an employer’s use of non-surreptitious dash cameras which may be found in its safety documentation of an employee
• Eastmond involved an employer’s use of non-surreptitious video surveillance in its work yard to deter theft and vandalism. PIPEDA Findings #2022-006 involved an employer’s use of non-surreptitious dash cameras that recorded both audio and video in its vehicles to protect the company’s assets and ensure the safe operation of company trucks.

Case in Point

• Regarding Employers' Practices Regarding Medical Reports Too Lax and relates to PIPEDA Case Summary #2003-226, Office of the Privacy Commissioner of Canada: With regards to an employees application for long-term disability benefits - The employer asked the employee to provide all the medical information necessary for the application, But, only the insurance company required the information
  • The employee objected to giving sensitive information (diagnosis) and the use of a fax machine to transmit her medical reports to its human resources office because employees who had no need for this in- formation might accidentally see it..
  • Ruling: The assistant privacy commissioner found that the employer contravened both PIPEDA requirements with Letters of notification concerning long-term disability for the company to state ensure that employees have the option of sending information directly to the insurance company And because of the sensitive nature of medical diagnoses, Keeping a fax machine that receives personal information in an unlocked, accessible room was inappropriate AND questioned hr staff receiving medical reports containing diagnoses and recommended the employer inform all employees that they have the right to ensure that diagnostic information be kept confidential and give the option of staff sending reports to medical staff in health or hr staff.
  • Key factors were the the limitations of limiting collection and the use of personal information to that which is necessary for the purposes identified by the organization; and (2) ensure that the information is properly secured, with more sensitive information being safeguarded by a higher level of protection.
• Video Surveillance Cameras Justified in Work Yard (Eastmond v Canadian Pacific Railway, 2004 FC 852):
  • A 4-part test is used to determine reasonableness of the placement of cameras: Is the measure demonstrably necessary to meet a specific need, Is it likely to be effective in meeting that need, Is the loss of privacy proportional to the benefit gained, Is there a way of achieving this benefit that involves less invasion of privacy?
  • Found to be serving a reasonable purpose based on the cameras not being hidden and there being limited privacy. The tapes were reviewed only if there was a reported incident.
• Regarding Employer’s Vehicle Dash Cam Deemed Overly Intrusive and PIPEDA Findings #2022-006 (Office of the Privacy Commissioner of Canada):
  • The employer, Trimac Transportation Services, deployed a dash camera system in employees’ truck cabins which recorded both audio and video and were active whenever the truck was on, even if the driver was off duty and not driving. A complaint followed and the privacy commissioner set out a four-part test with key considerations being weather the organization’s purpose represented a legitimate need/bona fide business interest; whether the collection, use, and disclosure would be effective in meeting the organization’s need; whether there were less privacy-invasive means of achieving the same ends at comparable cost and with comparable benefits; and whether the loss of privacy was proportional to the benefits. Found to be disproportionally intrusive
  • Ruling- Trimar was recommended that it limit the audio recording function of the dash camera system to drivers’on-duty hours and instances where they may be off duty but driving, and limit access to the clips transferred to and retained by Trimac. BUT then the commissioner found Trimac could have potentially relied on the exception to consent provided under section 7.3 of PIPEDA because the personal information at issue was collected and used in the context of the employment relationship. However, because Trimac was not transparent with its employees about the disciplinary purposes of the system, the commissioner found Trimac was in contravention of the Act.
  • Ultimately, Trimac issued clear guidance to its employees that the system may be used for performance management and progressive discipline, and the commissioner determined it could therefore rely on the exception to consent under section 7.3 of the Act.
• Section 57 of the BC PIPA states there if there is no further right of appeal, an individual affected by the order has a cause of action against the organization for damages for actual harm that the indi- vidual has suffered as a result of the breach by the organization of obligations under this Act and section 60 of the Alberta PIPA is almost identical. PIPEDA offers broader options for a lawsuit by those whose privacy has been violated. Section 14 allows them to file a complaint in court after the federal commissioner has released a report, regardless of its content, and even after the commissioner discontinues an investigation. And section 16 allows the court to award a range of remedies, including damages for actual loss or mere humiliation. In the employment context, although the PIPA provisions govern provincially regulated employees, PIPEDA applies this rule to federally

Employee Personal Information and the BC PIPA

• Section 13, 16 and 19 of the BC PIPA apply to when the are forms of communication forms while communicating. Employers should be aware of all 3 sections. For Example:
  • 13(2) An organization may not collect employee personal information without the consent of the individual unless …(b) the collection is reasonable for the purposes of establishing, managing or terminating an employment relationship between the organization and the individual…
  • 16(2) An organization may not use employee personal information without the consent of the individual unless …. (b) the use is reasonable for the purposes of establishing, managing or terminating an employment relationship between the organization and the individual …
  • 19(2) An organization may not disclose employee personal information without the consent of the individual unless …(b) the disclosure is reasonable for the purposes of establishing, managing or terminating an employment relationship between the organization and the individual. [emphasis added]
• Section 15(1), 18(1) and 21(1) of the Alberta PIPA are parallel to the sections of the BC PIPA. Also, the Alberta PIPA was broadened in 2014 to facilitate the use (s 17.1) and disclosure (s 20.1) of personal information by trade unions. Therefore, even in the absence of obtaining an employee’s express consent to collect, use, or disclose personal information about that employee, an employer in both provinces would be able to do any of those things if they were reasonable for the purposes of establishing, managing, or terminating the employment relationship.
• In BC, any employer using personal information for any decision relating to an employer must retain that knowledge to use personal information for any reason
• Section 34 of the PIPA of both provinces requires organizations, including employers, to make reasonable security arrangements to ensure that the information collected will be protected from improper access, use, disclosure, copying, modification, or disposal for AT LEaST one year after To further define the means of communication at the application of PIPA's is important
• Applying PIPA to Privacy Issues in the Workplace
• Privacy issues are increasingly being raised in the workplace. Technology makes it possible for employers to monitor employees’ activities in unprecedented ways—for example, by recording keystrokes, websites visited, and emails; by tracking mobile device usage; and by conducting video surveillance.
• As well, there continue to be infringement-of-privacy issues with respect to such ac- tivities as employers providing information to third parties for reference checks and their requesting that employees submit to drug or alcohol testing at work. In the case of the former, the law has to balance privacy with a long-established defence to defamation called “qualified privilege.” With respect to the latter, it has to determine whether privacy/human rights infringements or safety concerns are most applicable.

BC OIPC

• the OIPC in BC reported 361 complaints in 2023–24, an increase from 327 the year prior (Office of the Information and Privacy Commissioner for British Columbia, 2024).
  In Rv Cole (2012 SCC 53) - The Supreme Court of Canada's Ruled that an employee has a reasonable expectation of privacy with Rulings and employee devices for PIPA

Rv Cole (2012 SCC 53) Supreme Court of Canada

• ruled that an employee has a “reasonable expectation of privacy” in the information stored on employer-issued computer equipment
• Is useful to look at how few cases at present and in the means of communicating. in each is more useful for cases in law.

Tally-Ho Motor Inn (Re 2006 CanLII 32981)

• was a case in how one communicates with one's Work Safe BC (unsanitary conditions). A worker complained and the worker was later told to be on the compaint of a lack to be working in the company now due to information relating to him of a work lack or the personal with new business. However in the law of the PIPPA this ws not found actionable. - Re, 2006 CanLII 32981 as it will effect more due diligence at any work.

Tsatsu Shores Homeowners Corporation. 2006 CanLII 42695 (BCIPC)

• was again regarding privacy of being personal relating to PIPA and the rules not in order for the employee , was again not a violation for PIPPA requirements
• This can further define in more means now. With more cases rising regarding workers

Poliquin v Devon (2006ABCA) - Regarding using one's computers in one's work, this may have less meaning due to the case.

• Also there were cases relating with what is considered ok as not doing an email violation

BYOD: The Newest Frontier

BYOD—bring your own device—refers to the trend of employees using their own personal devices for work-related as well as personal purposes. (Dobson, 2012) While many employers are embracing this development, allowing employees to access corporate networks through their own smartphones, tablets, or laptops raises potential privacy and security issues. Many employers take the position that since the employee is connecting to the organization’s network, the same rules that apply to an employer-owned device should apply to an employee-owned device. However, as discussed above, courts have found that employees have a reasonable expectation of privacy when they are allowed to use work-issued devices for personal data, and this expectation is arguably even stronger where the employee owns the device. Therefore, an employer’s BYOD policy needs to clearly state that em- ployer monitoring is allowed on such devices, explain the reason for it, and indicate how the informa- tion collected might be used. Employees may also be asked to sign an agreement that consents to the “remote wiping” of data where an employee-owned device is lost or stolen. Such an agreement should also release the employer from liability for the loss of any data, including personal data, from wiping activities (Dobson, 2012, at 20) Some employers may decide that BYOD is more trouble than it is worth and prohibit the use of personal devices for work-related communication and data storage