Canadian Privacy Commissioner Issues Guidance under PIPEDA

Posted by Mike Nonaka on May 15, 2012

Last week, the Office of the Privacy Commissioner in Canada (OPC) issued important guidance under Canada’s national privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA).  The guidance highlights various scenarios in which PIPEDA applies based on judicial opinions and previous OPC interpretations.  In general, PIPEDA applies to the personal information that an organization collects, uses or discloses in the course of “commercial activities.”  The term “commercial activities” is defined broadly in PIPEDA to mean “any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”

The guidance outlines scenarios in which PIPEDA applies or does not apply based on the conduct of commercial activities, including:

  • An intermediary who relays financial information into and out of Canada for international transactions involving Canadian banks is engaged in a commercial activity.
  • A non-profit daycare organization partially subsidized by a municipal government is engaged in a commercial activity. 
  • A landlord who collects, uses or discloses tenants’ personal information to administer a lease or for insurance purposes is an organization engaged in a commercial activity.
  • An educational institution is not engaged in a commercial activity if the institution’s core activity is the provision of educational services and the institution does not have as one of its objectives the goal of earning a profit for the owners of the institution.

Organizations with Canadian business operations or seeking to do business in Canada should be aware of PIPEDA’s broad-based applicability and requirements, which include customer consent provisions, limitations on information use, disclosure, and retention, and obligations to safeguard personal information.

Ontario Recognizes Intrusion Upon Seclusion Privacy Tort for the First Time in Canada

Posted by Laura Brookover on January 23, 2012

The Ontario Appeals Court last Wednesday recognized—for the first time in Canada—the intrusion upon seclusion privacy tort.  In Jones v. Tsige, 2012 ONCA 32, the plaintiff sued a coworker for looking through her financial records.  The motion judge granted summary judgment for the defendant on the ground that Ontario law does not recognize plaintiff’s claim.  The Court of Appeal for Ontario reversed, resolving a question that “has been debated for the past one hundred and two years”—namely, whether to recognize a tort for the invasion of privacy.

The court concluded that the time had come to recognize the cause of action.  Acknowledging “the problem posed by the routine collection and aggregation of highly personal information that is readily accessible in electronic form,” the court stated that “technology change has motivated the legal protection of the individual’s right to privacy.” 

Ontario’s new cause of action adopts the elements of the intrusion upon seclusion tort in the Restatement (Second) of Torts, which requires that a defendant intentionally act to invade, without lawful justification, a person’s private affairs or concerns, and that a reasonable person would find the invasion highly offensive.  The court declined to impose an economic harm requirement, noting that “given the intangible nature of the interest protected, damages for intrusion upon seclusion will ordinarily be measured by a modest conventional sum.”

The new privacy right is not absolute.  Competing claims—such as “claims for the protection of freedom of expression and freedom of the press”—may in some circumstances override individual privacy rights.

Health Information Privacy Law Enacted in Nova Scotia

Posted by Shamma Iqbal on January 07, 2011

On December 10, 2010, Nova Scotia's Personal Health Information Act, which regulates the collection, use, disclosure and disposal of personal health information, was granted royal assent.  The purpose of the new legislation is to better protect citizens’ health data, while also facilitating the use of electronic medical records by provincial health institutions.  Nine of Canada’s 10 provinces have legislation specifically regulating the health information sector. 

New Canadian Law Regulates Spam

Posted by Shamma Iqbal on December 27, 2010

After much mulling, the Canadian Parliament passed, on December 16, Bill C-28, the Fighting Internet and Wireless Spam Act, which creates a new regime for businesses engaged in online marketing.  The legislation regulates commercial “electronic messages,” a term defined broadly to include e-mail, instant messaging, text messages, and messages on “any similar account” -- a catch-all category that potentially could include messages on Facebook and Twitter.  The law also provides a new private right of action, modeled on the CAN-SPAM Act in the United States.

No date has been set for the legislation to come into force.  The federal cabinet will establish implementation timelines. 

Canadian Court Orders Consumer Credit Agency To Pay Damages Under PIPEDA

Posted by Libbie Canter on December 27, 2010

On December 20, 2010, the Federal Court of Canada fined consumer credit agency TransUnion of Canada Inc. under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).  TransUnion was ordered to pay approximately $5,000 to a consumer who was unable to secure a loan after TransUnion reported inaccurate credit information to his bank. 

The negative information should have been attributed to a different individual with a similar name and similar address.  The court held that even though the error may have been caused by a “commercially sensible” matching system, the reported credit information was not “sufficiently accurate, complete, and up-to-date” for the purposes for which it was used.

The damages award is the first under the applicable section of PIPEDA in the statute’s ten-year history.  The court found that while damages are discretionary under the statute, they were appropriate as to TransUnion:  “Where the credit reporting service has failed to take prompt, reasonable steps to correct the record and to therefore ameliorate the embarrassment of the individual, it should expect that it will be ordered to compensate him for the humiliation it has caused.”

Older Posts