PRIVACY LEGISLATION INCREASINGLY APPLIED TO CHARITABLE AND NON-PROFIT ORGANIZATIONS

By U. Shen Goh, LL.B., LL.M.

A. INTRODUCTION

As of January 1, 2004, the federal Personal Information Protection and Electronic Documents Act¹("PIPEDA") applied to every organization in Canada that collects, uses and discloses personal information in the course of commercial activities. Since then, the Federal Privacy Commissioner and an Ontario court have shed light on the definition of "commercial activities" and the issue of whether charitable and non-profit organizations are subject to PIPEDA. However, PIPEDA also provides that an organization may be exempted from PIPEDA if the province that the organization is located in has enacted privacy legislation that is substantially similar. Since PIPEDA has come into force, the Federal Privacy Commissioner has declared provincial privacy legislation in Alberta, B.C. and Quebec to be substantially similar to PIPEDA. Also on January 1, 2004, Alberta and B.C.'s own respective Personal Information Protection Acts ("PIPA") came into force. The latter applies to every organization that collects, uses and discloses personal information, regardless of whether or not it is for commercial purposes. This Charity Law Bulletin ("Bulletin") discusses the implications for charities and non-profit organizations of these developments and anticipated privacy legislation in other provinces.

B. FEDERAL PRIVACY LEGISLATION AND ITS APPLICATION TO CHARITABLE AND NON-PROFIT ORGANIZATIONS

Since the coming into force of PIPEDA, on January 1, 2004, many charitable and non-profit organizations have asked whether PIPEDA applies to them, i.e., whether the activities they engage in constitute commercial activities. Commercial activity is defined by PIPEDA as "any particular transaction, act or conduct of any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or fundraising lists." While it is obvious that the legislators consider charitable and non-profit organizations capable of engaging in commercial activities, it is not obvious which activities charitable and non-profit organizations engage in will be considered commercial and which will not. For a full discussion of this issue, see Charity Law Bulletin No. 28.²

1. Office of the Privacy Commissioner of Canada

In response to this confusion, the Federal Privacy Commissioner released a fact sheet entitled "The Application of the Personal Information Protection and Electronic Documents Act to Charitable and Non-Profit Organizations" on March 31, 2004.

The fact sheet made it clear that "[t]he bottom line is that non-profit status does not automatically exempt an organization from the application of [PIPEDA]." This affirmed the legal community's opinion that if charitable and non-profit organizations are not subject to PIPEDA, it is not because they are exempted as a class, but because they do not engage in commercial activities per se.

The fact sheet then made the general statement that, "[m]ost non-profits are not subject to [PIPEDA] because they do not engage in commercial activities. This is typically the case with most charities, minor hockey associations, clubs, community groups and advocacy organizations." In order to provide greater clarity, the fact sheet lists specific examples of what the Federal Privacy Commissioner does not consider commercial activities by stating that, "[c]ollecting membership fees, organizing club activities, compiling a list of members' names and addresses, and mailing out newsletters are not considered commercial activities. Similarly, fundraising is not a commercial activity."

However, the fact sheet also made it clear that to the extent that charitable and non-profit organizations did engage in commercial activities, they would be subject to PIPEDA, "for example, many golf clubs and athletic clubs, may be engaged in commercial activities."

2. Ontario Superior Court of Justice

Many of the Federal Privacy Commissioner's statements in the fact sheet were later affirmed by the Ontario Superior Court in Rodgers v. Calvert³ ("Rodgers"), the first case in which a court in Canada analyzed the meaning of "commercial activity" under PIPEDA.

In this case, Mr. Rodgers brought a motion to compel The Peel County Game and Fish Protective Association (the "Association"), of which he was a member, to disclose the membership list to him so he may communicate his concerns regarding the Association to its other members. The Association refused to disclose the membership list on the grounds that such disclosure was barred by PIPEDA.
The court ruled that the Association must produce the membership list, as its activities did not constitute commercial activities to which PIPEDA would apply. In arriving at its decision, the court made the following points:

The test for commercial activity is not one of "preponderant purpose". The preponderant purpose test states that "if the preponderant purpose of the activity is the making of a profit, then the activity may be classified as a business. However, if there is another preponderant purpose to which any profit earned is merely incidental, then it will not be classified as a business." This test was rejected by the court.
The test for commercial activity requires more than a mere "exchange of consideration". The court found that although the Association collected membership fees in exchange for the services and benefits of membership in the Association, this exchange of consideration did not in itself constitute commercial activity for the purposes of PIPEDA.
The Federal Privacy Commissioner's statement that, "[c]ollecting membership fees, organizing club activities, compiling a list of members' names and addresses and mailing out newsletters are not considered commercial activities" is correct.

Although the court did not set out a clear test for interpreting the term "commercial activities", nor did it set out criteria or facts as to what constitutes a commercial activity for charitable and non-profit organizations, the court did shed light on what was not "commercial activity".

C. PROVINCIAL LEGISLATION AND ITS APPLICATION TO CHARITABLE AND NON-PROFIT ORGANIZATIONS

For some charitable and non-profit organizations, the above discussion may be merely academic if they are governed by provincial privacy legislation. This is because section 26(2)(b) of PIPEDA states that an organization may be exempted from PIPEDA if its province has enacted privacy legislation that is substantially similar.

At the time of this Bulletin's publication, three provinces had enacted privacy legislation that had been declared substantially similar to PIPEDA:

Quebec's An Act Respecting the Protection of Personal Information in the Private Sector was declared substantially similar on November 19, 2003;
B.C.'s Personal Information Protection Act was declared substantially similar on October 12, 2004; and
Alberta's Personal Information Protection Act was also declared substantially similar on October 12, 2004.

As such, charitable and non-profit organizations in these provinces will find themselves governed by their respective provincial privacy legislation. As Quebec's and B.C.'s provincial legislation apply to every organization that collects, uses and discloses personal information, regardless of whether or not it was for commercial purposes (Alberta has an exception for non-profit organizations), charitable and non-profit organizations must comply with privacy requirements.

However, charitable and non-profit organizations in these provinces should be aware that they may also be subject to PIPEDA under certain circumstances, as PIPEDA will continue to apply to all commercial activities relating to the exchange of personal information between provinces and territories and to information transfers outside of Canada.

Although Ontario has yet to enact its own privacy legislation equivalent to PIPEDA, it did enact the Personal Health Information Protection Act ("PHIPA") on November 1, 2004, which regulates the collection, use and disclosure of personal health information in Ontario. PHIPA is expected to be declared substantially similar to PIPEDA, thereby exempting health care providers in Ontario from PIPEDA. Further, it is anticipated that Ontario will eventually enact its own privacy legislation, at which time charitable and non-profit organizations in Ontario may also have to comply with privacy requirements.

D. CONCLUDING COMMENTS

Although some charitable and non-profit organizations not engaged in commercial activities may be exempt from privacy legislation at the moment, it is still important for those organizations to adhere to the underlying privacy principles. Not only is this the recommendation of the Federal Privacy Commissioner, it is also the expectation of donors and members that the charitable and non-profit organizations they support recognize their right to privacy as an essential issue. In light of the anticipated inclusion of charitable and non-profit organizations in provincial privacy legislation, it is highly recommended that all charitable and non-profit organizations review their personal information practices and policies and implement a privacy policy to provide all the necessary safeguards, as standardized in PIPEDA and respective provincial privacy legislation.

Endnotes:

¹ Mark J. Wong and U. Shen Goh, "Update on the Application of The Personal Information Protection and Electronic Documents Act (PIPEDA) to Charitable and Non-Profit Organizations" (2004) Charity Law Bulletin No. 42, www.charitylawbulletin.ca.
² Mark J. Wong, "Impact of the Personal Information Protection and Electronic Documents Act (PIPEDA) on Charitable and Non-Profit Organizations" (2003) Charity Law Bulletin No. 28, www.charitylawbulletin.ca.
³ [2004] O.J. No. 3653.