On November 15, 2013, the Supreme Court
of Canada released its decision in Alberta (Information
and Privacy Commissioner) v. United Food and Commercial
Workers, Local 401 (“UFCW”),
in which the Court determined
that the Alberta Personal Information Protection Act
(PIPA)
violated the right to freedom of expression under section
2(b) of the Canadian Charter of Rights and Freedoms
and was therefore unconstitutional. Although the case is
specific to the legislation in Alberta, the decision may
impact other provincial privacy statutes, as well as the
federal Personal Information Protection and Electronic
Documents Act,
which applies in most provinces, including Ontario.
Additionally, in another recent case
that will also be of interest to charities and non-profits,
the Alberta Office of the Information and Privacy Commissioner
(the “IPC”) confirmed in Project Porchlight (Re)
(“Project Porchlight”)
that Alberta’s privacy legislation applies to out-of-province
non-profit organizations that operate in the province. Although
declared unconstitutional by the Supreme Court, the striking
down of PIPA was postponed for one year to allow
the province of Alberta to revise the legislation. This
means that organizations are not relieved of their privacy
obligations in Alberta, and organizations must therefore
continue to comply with PIPA.
This Charity Law Bulletin reviews
these two important cases regarding privacy regulation in
Canada, and discusses their relevance to the privacy
practices of charities and non-profits.
A. SUPREME COURT DECLARES ALberta’s PIPA UNCONSTITUTIONAL
1.
History and Facts of the
Case
The Supreme Court of Canada’s decision
in UFCW arose in the context of a labour dispute, in which
both the union and a security company hired by the employer
had taken photographs and videos of individuals that crossed
the picket line. This resulted in several complaints being
filed with the Alberta Information and Privacy Commissioner
regarding the use, collection and disclosure of individuals’
personal information without the individuals’ consent, as
some of the images were displayed in signs and posters at
the picket site, and signs indicated that individuals’ photos
might also be posted on a website operated by the union. The
IPC concluded that the collection, use and disclosure of
personal information was not permitted under PIPA.
However, on judicial review it was determined that PIPA
was violating the union’s right to freedom of expression
under s. 2(b) of the Canadian Charter of
Rights and Freedoms (“Charter”). The Alberta Court of
Appeal agreed and granted the union a constitutional exemption
from the application of PIPA. On further appeal,
the Supreme Court of Canada agreed with the Court of Appeal
and declared PIPA to be invalid in its entirety.
The declaration of invalidity was suspended for a period
of 12 months to give the legislature time to decide how
best to make the legislation constitutional.
2.
The Court’s Analysis
Like other Canadian privacy legislation,
PIPA is designed to allow individuals some measure
of control over how their information is collected, used
and disclosed by others. The decision in UFCW required the
Supreme Court to balance the privacy interests protected
by PIPA against the right to freedom of expression
protected under section 2(b) of the Charter.
In this regard, the Supreme Court acknowledged
that “insofar as PIPA seeks to safeguard
informational privacy, it is ‘quasi-constitutional’ in nature”,
and that “the importance of the protection of privacy
in a vibrant democracy cannot be overstated.”
However, in the Court’s opinion, satisfying this objective
was in this case not of sufficient importance to justify
a restriction of the union’s constitutional right to freedom
of expression. In its analysis, the Court states:
PIPA’s
objective is increasingly significant in the modern context,
where new technologies give organizations an almost unlimited
capacity to collect personal information, analyze it, use
it and communicate it to others for their own purposes.
There is also no serious question that PIPA is rationally
connected to this important objective. As the Union acknowledges,
PIPA directly addresses the objective by imposing
broad restrictions on the collection, use and disclosure
of personal information. However, in our view, these broad
restrictions are not justified because they are disproportionate
to the benefits the legislation seeks to promote. In other
words, ‘the Charter infringement is too high a price
to pay for the benefit of the law.’
The broad application of PIPA
and the legislation’s lack of sensitivity to context appear
to be an important factor in the Court’s decision, as the
Court concludes in its reasoning that:
The breadth of PIPA’s
restrictions makes it unnecessary to examine the precise
expressive activity at issue in this case. It is enough
to note that, like privacy, freedom of expression is not
an absolute value and both the nature of the privacy interests
implicated and the nature of the expression must be considered
in striking an appropriate balance. To the extent that PIPA
restricted the Union’s collection, use and disclosure of
personal information for legitimate labour relations purposes,
the Act violates s. 2(b) of the Charter and cannot be justified
under s. 1.
Because the restriction of the union’s
Charter right could not be justified under s.1, the Court
declared PIPA to be invalid but suspended the declaration
of invalidity for a period of 12 months to give the legislature
time to decide how best to make the legislation constitutional.
3.
Commentary
Privacy regulation in Canada includes
the co-ordination of several different statutes enacted
by federal and provincial governments. In the private sector,
non-government organizations are generally subject to the
federal PIPEDA whenever they collect, use, or disclose
individuals’ personal information in the course of commercial
activities (which can and often does include the activities
of charities and non-profits).
An exception is in those provinces that have been exempted
from the application of PIPEDA because the provincial
legislature has enacted legislation deemed to be “substantially
similar” to PIPEDA. So far, substantially similar
legislation has been passed in Alberta, Quebec and British
Columbia (with Manitoba soon to follow),
and in Ontario with respect to personal health information.
This regulatory framework means that
the different federal and provincial privacy statutes affecting
the private sector are generally very similar. Therefore,
while the Supreme Court’s decision in UFCW addressed only
the legislation in Alberta, it is of significance because
the Court’s reasons could apply so as to call into question
the constitutionality of other Canadian privacy laws to
the extent that they might similarly restrict freedom of
expression. The decision may in this regard be a catalyst
for other similar cases challenging privacy legislation
on Charter grounds, and may lead to legislative reform in
jurisdictions other than Alberta to pre-empt such challenges.
As such, charities and non-profits will
need to monitor further developments with respect to Canadian
privacy legislation as they occur. Changes to privacy legislation
may affect operational privacy practices and may also result
in changes being needed to an organization’s privacy policy.
For the time being, charities and non-profits should continue
efforts to comply with existing privacy legislation and
regularly review and update the organization’s privacy policies
and procedures with respect to the organization’s collection,
use and disclosure of personal information.
B. OUT-OF-PROVINCE
NON-PROFITS NOT EXEMPT FROM ALBERTAS PIPA
The other recent case from Alberta’s
IPC mentioned above confirmed that a non-profit organization
based in Ontario was subject to Alberta’s PIPA with
respect to the personal information of an employee in the
province. The decision of the IPC is relevant for all non-profit
organizations that have operations or employees in Alberta.
1.
Facts of the Case
On September 13, 2013, the IPC released
its decision in Project Porchlight, which resulted from
a complaint by an individual employed in Calgary, Alberta
by an Ontario non-profit incorporated under Ontario’s Corporations
Act. The individual alleged
that his employer, Project Porchlight, contravened Alberta’s
PIPA by tracing
personal telephone calls that he had made using a Blackberry
device provided to him by the organization. He also alleged
that the organization failed to secure his personal information
contained in his employment offer letter and tax forms,
as required by the Act. A preliminary issue argued by Project
Porchlight was whether it was subject to Alberta’s PIPA,
since that legislation contains exemptions for non-profits
incorporated under Alberta corporate legislation that are
not engaged in commercial activities. Project Porchlight
argued that since it was a non-profit organization incorporated
pursuant to equivalent legislation in Ontario, it should
be entitled to the same exemptions. The IPC adjudicator
was sympathetic to the argument, but concluded that:
...the definition of
“non-profit organization” set out in section 56(1)(b) is
clear and unambiguous. I find that there is no latitude
to expand its scope on the basis of arguable policy rationale
or purpose. The Organization in this inquiry is not incorporated
under Alberta’s Societies Act or
Alberta’s Agricultural Societies Act,
and is not registered under Part 9 of Alberta’s Companies Act. Moreover,
as indicated by sections 56(1)(b)(ii)
and 56(4)(a), the Legislature
expressly contemplated that other entities might qualify
as non-profit organizations by virtue of criteria established
under regulations. Criteria could very readily have been
established in order to qualify particular extra-provincial
entities as non-profit organizations for the purposes of
PIPA, but no such criteria have been established. I therefore
find that the Organization is not a non-profit organization
for the purposes of PIPA. It is unnecessary to consider
whether or not it was carrying out a commercial activity
when it collected and used the Complainant’s personal information.
On that basis, the IPC adjudicator concluded
that PIPA applied to the organization with respect
to the collection, use and disclosure of the employee’s
personal information. On the facts of the case, it was found
that the organization had improperly collected
and used his personal information by tracing the telephone
numbers that he had dialed using a Blackberry device provided
to him by the organization, so as to learn the identities
of the recipients of his personal calls and the nature of
those calls. The organization did not have a policy in place
that it could rely upon to justify its collection and use
of the information, and the organization did not notify
the employee or obtain his consent that would have provided
authorization for it to collect the information. As such,
the IPC adjudicator found that the organization had contravened
PIPA and ordered that it stop collecting and using
personal information in contravention of the Act. With respect
to the allegation that the organization had failed to secure the employee’s personal information contained in his
employment offer letter and tax forms, it was found that
the organization had in fact made reasonable security arrangements
to protect the complainant’s personal information, as required
by PIPA.
2.
Commentary and Analysis
The decision
of the Alberta IPC in Project Porchlight serves as a reminder
to charities and non-profits that they not only need to
comply with the laws of the jurisdiction in which they are
incorporated, but also with the laws of the jurisdictions
in which they operate. In the context of privacy laws, this
means that organizations that are familiar with their compliance
obligations under PIPEDA must also be aware
of the fact that several provinces have adopted substantially
similar privacy legislation that will apply in that province
instead of PIPEDA. While the provincial legislation
imposes many of the same requirements, charities and non-profits
should be aware that provincial legislation may apply in
situations where PIPEDA may not, thereby extending
the privacy obligations of organizations in some cases to
employee information or to personal information that is
collected in the course of non-commercial activity.
It is recommended that charities and
non-profits adopt privacy practices and policies that meet
the highest standards imposed by the provincial and federal
privacy legislation, to ensure compliance obligations are
met in every province that the organization operates in.
This includes adopting a clear and comprehensible privacy
policy and obtaining consent from individuals, including
employees, whenever the organization wishes to collect,
use or disclose their personal information.
C. CONCLUSION
The two cases of UFCW
and Project Porchlight serve as a reminder of
the often complex nature of privacy laws and regulation
in Canada, and of the need for charities and non-profits
to stay informed of developments in privacy laws to ensure
continued compliance. Adopting privacy policies and providing
employee training regarding the handling of personal information
are important first steps to ensuring compliance, and continued
monitoring and updating of the organization’s privacy practices
in response to changes in the law and changes in the scope
of a charity of non-profit’s operations is essential.