CHARITY LAW BULLETIN No.326

November 27, 2013
Editor: Terrance S. Carter

Printer Friendly PDF

ALBERTA PRIVACY LEGISLATION
FOUND UNCONSTITUTIONAL BY SCC

By Colin J. Thurston*

On November 15, 2013, the Supreme Court of Canada released its decision in Alberta (Information and Privacy Commissioner) v. United Food and Commercial Workers, Local 401 (“UFCW”),[1]  in[TSC1]  which the Court determined that the Alberta Personal Information Protection Act (PIPA)[2] violated the right to freedom of expression under section 2(b) of the Canadian Charter of Rights and Freedoms and was therefore unconstitutional. Although the case is specific to the legislation in Alberta, the decision may impact other provincial privacy statutes, as well as the federal Personal Information Protection and Electronic Documents Act,[3] which applies in most provinces, including Ontario.

Additionally, in another recent case that will also be of interest to charities and non-profits, the Alberta Office of the Information and Privacy Commissioner (the “IPC”) confirmed in Project Porchlight (Re) (“Project Porchlight”)[4] that Alberta’s privacy legislation applies to out-of-province non-profit organizations that operate in the province. Although declared unconstitutional by the Supreme Court, the striking down of PIPA was postponed for one year to allow the province of Alberta to revise the legislation. This means that organizations are not relieved of their privacy obligations in Alberta, and organizations must therefore continue to comply with PIPA.

This Charity Law Bulletin reviews these two important cases regarding privacy regulation in Canada, and discusses their relevance to the privacy practices of charities and non-profits.

A.     SUPREME COURT DECLARES ALberta’s PIPA UNCONSTITUTIONAL

1.      History and Facts of the Case

The Supreme Court of Canada’s decision in UFCW arose in the context of a labour dispute, in which both the union and a security company hired by the employer had taken photographs and videos of individuals that crossed the picket line. This resulted in several complaints being filed with the Alberta Information and Privacy Commissioner regarding the use, collection and disclosure of individuals’ personal information without the individuals’ consent, as some of the images were displayed in signs and posters at the picket site, and signs indicated that individuals’ photos might also be posted on a website operated by the union. The IPC concluded that the collection, use and disclosure of personal information was not permitted under PIPA. However, on judicial review it was determined that PIPA was  violating the union’s right to freedom of expression under s. 2(b) of the Canadian Charter of Rights and Freedoms (“Charter”). The Alberta Court of Appeal agreed and granted the union a constitutional exemption from the application of PIPA. On further appeal, the Supreme Court of Canada agreed with the Court of Appeal and declared PIPA to be invalid in its entirety. The declaration of invalidity was suspended for a period of 12 months to give the legislature time to decide how best to make the legislation constitutional.

2.      The Court’s Analysis

Like other Canadian privacy legislation, PIPA is designed to allow individuals some measure of control over how their information is collected, used and disclosed by others. The decision in UFCW required the Supreme Court to balance the privacy interests protected by PIPA against the right to freedom of expression protected under section 2(b) of the Charter.

In this regard, the Supreme Court acknowledged that “insofar as PIPA seeks to safeguard informational privacy, it is ‘quasi-constitutional’ in nature”, and that “the importance of the protection of privacy in a vibrant democracy cannot be overstated.[5]  However, in the Court’s opinion, satisfying this objective was in this case not of sufficient importance to justify a restriction of the union’s constitutional right to freedom of expression. In its analysis, the Court states:

PIPA’s objective is increasingly significant in the modern context, where new technologies give organizations an almost unlimited capacity to collect personal information, analyze it, use it and communicate it to others for their own purposes. There is also no serious question that PIPA is rationally connected to this important objective. As the Union acknowledges, PIPA directly addresses the objective by imposing broad restrictions on the collection, use and disclosure of personal information. However, in our view, these broad restrictions are not justified because they are disproportionate to the benefits the legislation seeks to promote. In other words, ‘the Charter infringement is too high a price to pay for the benefit of the law.’[6]

The broad application of PIPA and the legislation’s lack of sensitivity to context appear to be an important factor in the Court’s decision, as the Court concludes in its reasoning that:

The breadth of PIPA’s restrictions makes it unnecessary to examine the precise expressive activity at issue in this case. It is enough to note that, like privacy, freedom of expression is not an absolute value and both the nature of the privacy interests implicated and the nature of the expression must be considered in striking an appropriate balance. To the extent that PIPA restricted the Union’s collection, use and disclosure of personal information for legitimate labour relations purposes, the Act violates s. 2(b) of the Charter and cannot be justified under s. 1.[7]

Because the restriction of the union’s Charter right could not be justified under s.1,  the Court declared PIPA to be invalid but suspended the declaration of invalidity for a period of 12 months to give the legislature time to decide how best to make the legislation constitutional. 

3.      Commentary

Privacy regulation in Canada  includes the co-ordination of several different statutes enacted by federal and provincial governments. In the private sector, non-government organizations are generally subject to the federal PIPEDA whenever they collect, use, or disclose individuals’ personal information in the course of commercial activities (which can and often does include the activities of charities and non-profits[8]). An exception is in those provinces that have been exempted from the application of PIPEDA because the provincial legislature has enacted legislation deemed to be “substantially similar” to PIPEDA. So far, substantially similar legislation has been passed in Alberta, Quebec and British Columbia (with Manitoba soon to follow[9]), and in Ontario with respect to personal health information.

This regulatory framework means that the different federal and provincial privacy statutes affecting the private sector are generally very similar. Therefore, while the Supreme Court’s decision in UFCW addressed only the legislation in Alberta, it is of significance because the Court’s reasons could apply so as to call into question the constitutionality of other Canadian privacy laws to the extent that they might similarly restrict freedom of expression. The decision may in this regard be a catalyst for other similar cases challenging privacy legislation on Charter grounds, and may lead to legislative reform in jurisdictions other than Alberta to pre-empt such challenges.

As such, charities and non-profits will need to monitor further developments with respect to Canadian privacy legislation as they occur.  Changes to privacy legislation may affect operational privacy practices and may also result in changes being needed to an organization’s privacy policy. For the time being, charities and non-profits should continue efforts to comply with existing privacy legislation and regularly review and update the organization’s privacy policies and procedures with respect to the organization’s collection, use and disclosure of personal information.

B.     OUT-OF-PROVINCE NON-PROFITS NOT EXEMPT FROM ALBERTAS PIPA

The other recent case from Alberta’s IPC mentioned above confirmed that a non-profit organization based in Ontario was subject to Alberta’s PIPA with respect to the personal information of an employee in the province. The decision of the IPC is relevant for all non-profit organizations that have operations or employees in Alberta.

1.      Facts of the Case

On September 13, 2013, the IPC released its decision in Project Porchlight, which resulted from a complaint by an individual employed in Calgary, Alberta by an Ontario non-profit incorporated under Ontario’s Corporations Act. The individual alleged that his employer, Project Porchlight, contravened Alberta’s PIPA by tracing personal telephone calls that he had made using a Blackberry device provided to him by the organization. He also alleged that the organization failed to secure his personal information contained in his employment offer letter and tax forms, as required by the Act. A preliminary issue argued by Project Porchlight was whether it was subject to Alberta’s PIPA, since that legislation contains exemptions for non-profits incorporated under Alberta corporate legislation that are not engaged in commercial activities. Project Porchlight argued that since it was a non-profit organization incorporated pursuant to equivalent legislation in Ontario, it should be entitled to the same exemptions. The IPC adjudicator was sympathetic to the argument, but concluded that:

...the definition of “non-profit organization” set out in section 56(1)(b) is clear and unambiguous. I find that there is no latitude to expand its scope on the basis of arguable policy rationale or purpose. The Organization in this inquiry is not incorporated under Alberta’s Societies Act or Alberta’s Agricultural Societies Act, and is not registered under Part 9 of Alberta’s Companies Act. Moreover, as indicated by sections 56(1)(b)(ii) and 56(4)(a), the Legislature expressly contemplated that other entities might qualify as non-profit organizations by virtue of criteria established under regulations. Criteria could very readily have been established in order to qualify particular extra-provincial entities as non-profit organizations for the purposes of PIPA, but no such criteria have been established. I therefore find that the Organization is not a non-profit organization for the purposes of PIPA. It is unnecessary to consider whether or not it was carrying out a commercial activity when it collected and used the Complainant’s personal information.

On that basis, the IPC adjudicator concluded that PIPA applied to the organization with respect to the collection, use and disclosure of the employee’s personal information. On the facts of the case, it was found that the organization had improperly collected and used his personal information by tracing the telephone numbers that he had dialed using a Blackberry device provided to him by the organization, so as to learn the identities of the recipients of his personal calls and the nature of those calls. The organization did not have a policy in place that it could rely upon to justify its collection and use of the information, and the organization did not notify the employee or obtain his consent that would have provided authorization for it to collect the information. As such, the IPC adjudicator found that the organization had contravened PIPA and ordered that it stop collecting and using personal information in contravention of the Act. With respect to the allegation that the organization had failed to secure the employee’s personal information contained in his employment offer letter and tax forms, it was found that the organization had in fact made reasonable security arrangements to protect the complainant’s personal information, as required by PIPA.

2.      Commentary and Analysis

The decision of the Alberta IPC in Project Porchlight serves as a reminder to charities and non-profits that they not only need to comply with the laws of the jurisdiction in which they are incorporated, but also with the laws of the jurisdictions in which they operate. In the context of privacy laws, this means that organizations that are familiar with their compliance obligations under PIPEDA must also be aware of the fact that several provinces have adopted substantially similar privacy legislation that will apply in that province instead of PIPEDA. While the provincial legislation imposes many of the same requirements, charities and non-profits should be aware that provincial legislation may apply in situations where PIPEDA may not, thereby extending the privacy obligations of organizations in some cases to employee information or to personal information that is collected in the course of non-commercial activity.

It is recommended that charities and non-profits adopt privacy practices and policies that meet the highest standards imposed by the provincial and federal privacy legislation, to ensure compliance obligations are met in every province that the organization operates in. This includes adopting a clear and comprehensible privacy policy and obtaining consent from individuals, including employees, whenever the organization wishes to collect, use or disclose their personal information.

C.     CONCLUSION

The two cases of UFCW and Project Porchlight serve as a reminder of the often complex nature of privacy laws and regulation in Canada, and of the need for charities and non-profits to stay informed of developments in privacy laws to ensure continued compliance. Adopting privacy policies and providing employee training regarding the handling of personal information are important first steps to ensuring compliance, and continued monitoring and updating of the organization’s privacy practices in response to changes in the law and changes in the scope of a charity of non-profit’s operations is essential.

 



* Colin J. Thurston, B.A., J.D. is an associate of Carters Professional Corporation and a registered trade-mark agent with the Canadian Intellectual Property Office. Colin practices at Carters’ Orangeville office in the areas of intellectual property, privacy and information technology.

[1] 2013 SCC 62.

[2] S.A. 2003, c. P‑6.5.

[3] S.C. 2000, c. 5.

[4] AB OIPC, Order P2013-03.

[5] Supra, note 1, para 22.

[6] Supra, note 1, para 20.

[7] Supra, note 1, para 38.

[8]Office of the Privacy Commissioner of Canada, The Application of the Personal Information Protection and Electronic Documents Act to Charitable and Non-Profit Organizations, online: http://www.priv.gc.ca/resource/fs-fi/02_05_d_19_e.asp.

[9] Legislative Assembly of Manitoba, 2nd Session, 40th Legislature, Bill 211, The Personal Information Protection and Identity Theft Prevention Act, online: http://web2.gov.mb.ca/bills/40-2/b211e.php.

 


DISCLAIMER: This Charity Law Bulletin is a summary of current legal issues provided as an information service by Carters Professional Corporation. It is current only as of the date of the Bulletin and does not reflect subsequent changes in the law. The Charity Law Bulletin is distributed with the understanding that it does not constitute legal advice or establish the solicitor/client relationship by way of any information contained herein. The contents are intended for general information purposes only and under no circumstances can be relied upon for legal decision-making. Readers are advised to consult with a qualified lawyer and obtain a written opinion concerning the specifics of their particular situation.
© 2013 Carters Professional Corporation