Privacy Rights in Canada

Privacy and Privacy Rights

• There is a need for greater protection for personal information and other privacy rights
• The right to privacy has historically not been a separate right under Canadian common law

Electronic Age Paramount Privacy Concerns

• Privacy concerns are paramount because personal information can be compiled and transferred quickly
• Legislation and legal decisions now safeguard personal information privacy
• Legislation and legal decisions restrict admissibility of evidence gained through electronic means
• Canada's original privacy legislation pertained to personal information held by governments only
• British Columbia (BC) and Alberta passed legislation in the 1990s covering personal information held by the provincial government and other public bodies like hospitals

Freedom of Information and Protection of Privacy Act (FIPPA)

• Enacted by BC in 1992, it allows individuals to request information held by the BC government and other public bodies
• The Alberta legislature passed a parallel statute in 1994 with a similar function
• Every province and territory has privacy legislation for the collection, use, and disclosure of personal information held by government agencies
• The federal government and several provincial governments, including BC and Alberta, passed the first private sector privacy legislation in 2000

Personal Information Protection and Electronic Documents Act (PIPEDA)

• Federal law covers personal information held by organizations in the private sector
• In BC and Alberta, the statute is called the Personal Information Protection Act (PIPA) and is the provincial equivalent of the federal PIPEDA
• Both provincial Acts were enacted in 2004
• PIPEDA balances an individual's right to have personal information kept private with an organization's need to collect, use, and disclose personal information where necessary
• It applies to all organizations—both federally and provincially regulated—in Canada that collect, use, or disclose personal information in commercial activities, unless the province has comparable legislation

Alberta's Personal Information Protection Act (PIPA)

• The Supreme Court of Canada struck down PIPA in November 2013 and gave the province one year to align its law with the Canadian Charter of Rights and Freedoms (Alberta (Information and Privacy Commissioner) v United Food and Commercial Workers, Local 401)
• In a 9–0 decision,Alberta's privacy law was ruled unconstitutional in a dispute over the right of a union to photograph people crossing a picket line
• Amendments to PIPA came into force on December 17, 2014, addressing collection, use, and disclosure of personal information by unions during lawful labor disputes

Privacy Rules

• Employers and employees should be aware of potential liability for the tort of invasion of privacy beyond FIPPA, PIPA, and PIPEDA
• Ontario courts first recognized a common law privacy tort affecting employers
• Other provinces, including Nova Scotia and Alberta, have followed suit
• The information captured by the common law privacy tort includes private data that employers may collect about their employees, such as financial and health records, and relationship details
• In ES v Shillington, the Court determined a plaintiff must prove four conditions to establish liability for the tort

Shillington Test

• The plaintiff's private life was publicized by the defendant
• The plaintiff did not consent to the publication
• The publicized matter was highly offensive to a reasonable person in the plaintiff's position
• The publication was not of legitimate concern to the public

BC Privacy Act

• BC courts do not recognize a common law privacy tort because of the BC Privacy Act, which has been in place since 1968 and creates a statutory tort of violation of privacy
• Section 1 permits suing for invasion of privacy, even without specific harm ("actionable without proof of damage")
• Employers can be vicariously liable for employee privacy invasions

Freedom of Information and Protection of Privacy Act (British Columbia and Alberta)

• British Columbia's FIPPA applies to government ministries, Crown corporations, local governments, universities, colleges, school boards, municipal police forces, health boards, hospitals, and self-governing professions
• Alberta’s FIPPA applies to public bodies listed in section 1(p) of the Act
• BC section 2 states the legislation aims to increase public body accountability and protect personal privacy by granting public access to records
• The philosophy in both provinces is that free access to government records ensures fair, transparent, and credible government
• FIPPA limits the type and amount of information that provincial government and other public bodies can collect from individuals
• The legislation puts very definite limits on what information about individual citizens can be obtained, stored, or passed on to third parties and how it can be used
• FIPPA provides citizens with numerous opportunities to gain access to their information held by agencies and government bodies
• The Atwell report is an example of FIPPA’s application to workplace privacy, in the case of a public body as employer

FIPPA Amendments (BC, February 2023)

• Public bodies must report privacy breaches to individuals and the Office of the Information and Privacy Commissioner (OIPC)
• Privacy breaches include unauthorized access, theft, loss, collection, use, or disclosure of personal information
• Public bodies must develop privacy management programs
• Such programs should include a privacy officer, privacy impact assessments, complaint response processes, privacy awareness education, policy availability, service provider obligations, and program monitoring/updating
• PIPA, the provincial private sector legislation, is more relevant to employment disputes involving privacy than FIPPA in most cases

PIPEDA Principles

• The principles adopted in the PIPA of BC and Alberta
• PIPEDA directly affects how these organizations collect, use, disclose, and retain personal information concerning employees, customers, patients, and suppliers,
• Federal law of PIPEDA does not directly affect personal employee information held by provincially regulated employers because the federal government doesn't have jurisdiction over the employment relationship in those workplaces
• On the other hand, the federal government can directly apply PIPEDA to all personal information collected, used, or disclosed by provincially regulated organizations in the course of commercial activity

PIPEDA Application

• The federal government agreed it wouldn't apply its requirements in provinces with substantially similar legislation when PIPEDA was passed
• BC and Alberta have implemented substantially similar legislation (their respective PIPAs) giving PIPEDA narrower application in those jurisdictions
• The PIPAs of BC and Alberta are "comparable" pieces of legislation, so PIPEDA's principles in handling personal employee information apply
• Employers in these provinces must be aware of those principles

Key PIPEDA Features

• Balance an individual's privacy right with an organization's need to collect, use, and disclose information when necessary
• Apply to federally and provincially regulated organizations in Canada that collect, use, or disclose personal information for commercial activities, unless provincial law applies
• For interprovincial and international transactions, apply to ones involving personal information that occur in the course of commercial activities
• Not directly apply federal legislation to personal employee information in provincially regulated workplaces
• Broadly define "personal information" to include any factual or subjective information about an identifiable individual
• Requires consent from individuals before personal information is collected, used, or disclosed, and can only be used for the purpose the consent was obtained (unless further content is obtained)
• Organisations take precautions to safeguard personal information in their possession.
• There are exceptions to individuals rights to gain access to their information but challenge an employer's treatment of it or its accuracy
• An individual may make a complaint to the Office of the Privacy Commissioner of Canada regarding how information is handled. The individual or the Commissioner may apply to the Federal Court for an order requiring the organization to change its practices or award damages

"personal information" (PIPEDA Section 2)

• Any factual or subjective information about an identifiable individual, whether recorded or not

• Age, home address, identification numbers (including social insurance number), and residential telephone and email addresses

• Sex, religion, ethnicity, social status, and marital status

• Employee files (formal and informal), performance appraisals, disciplinary actions, and evaluations

• Photographs, opinions, and income

• Relevant dates, such as birth date

• Credit records, loan records, purchasing and spending habits

• Blood type, genetic information, and medical records

• According to the Office of the Privacy Commissioner:

• Also include pay and benefit records, video and audiotapes, websites visited, emails, and keystrokes

• Collected in many forms including on paper, electronically, in a recording, or on a fax machine

BC, Alberta and Personal Information

• In section 1 of BC's PIPA, "personal information" is defined as Information about an identifiable individual and includes employee personal information, but exclude contact/work product information
• Section 1(k) of Alberta's PIPA means information about an identifiable individual, though no exceptions exist for work products or contact information business information does arise with specific exception under section 4(3)(d)
• Collection, use, protection, and disclosure should adhere to the ten PIPEDA principles regardless of definition or form of personal information

Recent Amendments to PIPEDA

Digital Privacy Act (Bill S-4, June 18, 2015)

• Organizations must report security breaches involving loss or unauthorized access to personal information that carries a risk of significant harm and keep records of the breach
• The definition of "personal information" has been changed to eliminate the exception regarding the name, title, business address, or telephone number of an employee
• PIPEDA now covers job applicants as well as employees
• Business contact information is exempt where it is collected, used, and disclosed solely for the purpose of communicating with the individual for purposes related to their employment, business, or profession
• Circumstances allowing personal information disclosure without individual knowledge or consent have broadened to illegality, fraud, and financial abuse, and can disclose to third-party organizations
• The privacy commissioner can enter compliance agreements that include terms necessary for statutory compliance

Amendments to PIPEDA: Digital Charter Implementation Act, 2022 (Bill C-27, June 16, 2022)

• Includes enacting the Consumer Privacy Protection Act (replaces part 1 of PIPEDA entitled "Protection of Personal Information in the Private Sector")
• enacting the Personal Information and Data Protection Tribunal Act (establishes an administrative tribunal to hear appeals and imposes penalties)
• Includes enacting the Artificial Intelligence and Data Act, which would regulate international and interprovincial trade and commerce in artificial intelligence and prohibit certain conduct

Ten Fair Information Principle Breakdown

Be Accountable

• Orgs that collect personal information must appoint an individual to oversee legislative compliance, give the appointee authority to intervene when a privacy issue arises, and ensure employees know their name and title
• The appointee is responsible for analyzing information handling practices such as what and how information is being collected, used, secured, accessed, disclosed, and disposed of
• Develop and implement policies and procedures to protect personal information
• Front-line staff must be trained about the procedures and respond to inquiries
• When transferring information to a third party, ensure the level of comparable protection is maintained

Purpose Identification

• An organization must let an individual know why personal information is being collected
• Include forms that explain why the information is needed and how it will be used as well as a list with explanation of all those who the data will be disclosed to
• Only use this information for the designated purpose

Informed Consent

• The individual to whom the personal information relates must consent to its collection, with limited exceptions
• Consent must be voluntary and the individual must be aware of what is being collected and for what reason
• Clauses should be easy to find and understand
• Typically, the more sensitive informaton the more formal the consent
• To continue using or disclosing information collected before the legislation, the organization must go back to the individual and obtain consent

Consent Exceptions

• The information collection would be for the best interest of the individual and consent cannot be attained in a timely manner
• The individual is unable to give consent through compromise and accuracy of information
• Information is contained and related to witness statement to settle an insurance claim
• Collection is for artistic, literary or journalistic purposes and is publicly available

Limited Collection

• Organizations must only collect the necessary data with the intention to accomplish its stated purposes
• For example, when processing a credit check, an organization should not consider collecting information pertaining to an individual's religious affiliation
• For example, the Privacy Commissioner in Alberta ordered Mark's Work Warehouse (MWW) to not process personal credit information for job applicants

Limited Use, Disclosure, and Retention

• Organizations can only utilize the information collected for the expressed intention that it was authorized to disclose to third parties
• Disclosure of certain information can not occur unless it authorizes a new consent
• After an information is no longer needed, it must be disposed of

Exceptions to the Organization May Not Use Personal Information

• Contravation or breach of law
• Information is used in an emergency
• The information is used for statistics or scholarly purposes in which the Commissioner notified by Canada
• The information is published
• When an individuals consent, the availability or accuracy of obtaining the information that is disclosed will cause a breach of an agreement

Exceptions to Disclosures

• To a lawyer with representing for the organization
• To conduct the debt that is owed to the organization by that individual
• Meet a subpoena or a court order.

Accuracy

• If the use or disclosure of incomplete or out-of-date information of any employees being harmed and the employer will verify and correct errors in information
• Employers must give opportunity for corrective actions of individuals information

Providing Safeguards

• An organization that is being responsible must protect the data from loss, theft unauthorized access.
• Sensitive information should receive top level protection

Openness

• Transparency of practices and policies from the business

Individual Access

• Organization must supply detail of the retained data from request of its employees

Federal Privacy Commissioner and BC and Alberta information

• Role is to enforce/oversee laws
• created in both BC and Alberta from the government

FIPPA and PIPA

• FIPPA Applies to bodies of public
• Monitor and information collection