BC Personal Information Protection Act
Cases published to November 27, 2006
Click on a Case Name for full text (links off site).2006 December 21
Order P06-06, Tsatsu Shores Homeowners Corporation
The BC Commissioner held that BC PIPA authorized the organization to collect and use certain information that it received (solicited or unsolicited) about the job performance of the complainants (now ex-employees) without their consent. “Information about how well the complainant’s were performing their tasks, and information about specific concerns regarding performance, is personal information ‘reasonably required’ within the meaning of BC PIPA’s definition of ‘employee personal information’ “. Further, the Commissioner ruled, the information was (as required by BC PIPA ss. 13(1)(b) and 16(1)(b)) “reasonable for the purposes of managing ‘the employment relationship’ “.
Nevertheless, the organization breached its duty under ss. 13(4), 16(4) and 19(4) of BC PIPA to notify the individual complainants that it would be collecting, using and disclosing their employee information and the purposes for doing so before the information was collected.
The Commissioner rejected the submission of the complainants that s. 33 of BC PIPA (requirement to ensure personal information is accurate and complete) obligated the organization to complete their job performance evaluations.
With respect to complaints that the organization inappropriately disclosed the complainants’ person information in the minutes of board meetings, the Commissioner stated, among other things:
It is one thing for the minutes of a meeting of a board of directors to contain personal information for which the directors have a reasonable need to know and another for those minutes to be made available to residents and others. Disclosure of personal information in this way can fall afoul of PIPA’s definition of employee personal information and of s. 19(2)(b). … Subject to any statutory or other rules about the holding of meetings and publication of meeting minutes, it seems to me this organization should consider discussing personal information of employees and residents in private, with minutes of the private portions not being made generally available.
In the particular circumstances of this case, the Commissioner also ruled that is was not reasonable to place the complainants’ personal information in an unlocked filing cabinet in a basement room with ready access to any number of individuals, regardless of whether that room was locked. This constituted a violation of s. 34 of BC PIPA, which requires organizations to protect personal information “by making reasonable security arrangements.”
2006 December 14
Order P06-05, Langley Cruiseshipcentres Ltd.
The BC Commissioner dismissed complaints by three individuals who once had a business relationship with the organization which was governed, at least in part, by an Independent Contractor Agreement which contained certain obligations relating to “Confidential Information.” The Commissioner found as a fact that “the organization had cause to investigate, and was investigating, whether the complainant’s had breached their agreements when it reviewed and copied their email communications.” The Commissioner also found that “there was a reasonable basis for the organization to expect that, had it sought consent to collection, use or disclosure of personal information, seeking their consent would have compromised the availability or accuracy of personal information in the emails.”
Accordingly, the organization complied with ss. 12(1)(c), 15(1)(c) and 18(1)(c) of BC PIPA [which authorizes collection, use or disclosure without the individual’s consent, or from a source other than the individual, if it is reasonable to expect that obtaining consent would compromise the availability or the accuracy of the personal information and the collection is reasonable for an investigation or proceeding.” The BC Commissioner also held that the notice of collection otherwise required under s. 10 of BC PIPA does not apply to such cases.
The BC Commissioner noted in passing that “every organization that gives its employees and agents authority to use its email and internet systems is well advised to have clear policy on the limits to that use and to communicate that policy to those employees. Policy that clearly spells out that employee email or internet use may be monitored will go a long way to countering arguments that the employee had an expectation of privacy respecting use of the employer’s email system or the internet.”
In this course of this decision, the BC Commissioner also determined that “work product information” (which is excluded from the definition of personal information in BC PIPA) includes information about other business activities, including activities which are outside any employment or business responsibilities or activities of the individuals or third parties in relation to the organization which is the subject of a complaint under BC PIPA. The Commissioner stated that BC PIPA’s “definition of ‘work product information’ is not restricted to information prepared or collected as a part of the responsibilities or activities related to an individual’s employment or business relationship with the organization in question.”
2006 November 27
The British Columbia Supreme Court (Master) ordered that a plaintiff in a motor vehicle lawsuit disclose to the defence her appointment book containing contact information (names and addresses) for her clients. The plaintiff was not required, however, to disclose telephone numbers. The Master applied Shilton v Fassnacht, 2006 BCSC 431, in arriving at the conclusion that the BC PIPA does not limit the defendant’s right under Rule 27(22) of the British Columbia Supreme Court Rules to obtain the names and addresses of relevant witnesses.
2006 October 26
Order P06-04, Twentieth Century Fox Film Corporation
The BC Commissioner dismissed a complaint that Fox breached BC PIPA and violated mobility rights guaranteed by the Canadian Charter of Rights and Freedoms by requiring proof of British Columbia residency as a condition of employment. Fox collected proof of BC residency during the year immediately before filming in order to qualify for film production tax credits from the British Columbia government under the provincial Income Tax Act.
Although the Commissioner held that residency information is “undoubtedly” personal information under BC PIPA, the Commissioner held that it qualified as “employee personal information” because (i) Fox collected it to manage or terminate an employment relationship and (ii) the purpose for collecting the information was reasonably required to establish, manage or terminate the particular employment relationship.” Significantly, the Commissioner held in this connection:
Fox’s purpose in collecting the information is in one sense related to its business decision to avail itself of tax benefits. It is not collecting the personal information to comply with a specific, or explicit, statutory or other legal obligation or duty. It cannot, however, plausibly be suggested that the Legislature intended to restrict the words “reasonably required” to capture only situations where an organization is “required” by law – statute or otherwise – to collect, use or disclose personal information for employment purposes. Nor can it persuasively be argued that employee personal information is restricted to personal information that is inherently or such a kind that the employer must, practically, collect it for employment purposes.
Again, Fox has decided to take advantage of certain benefits available under federal and provincial tax laws. It has a business purpose for collecting, and a need to collect, personal information from employees to prove its entitlement to tax benefits to the CRA’s auditors. When Fox requires individuals to provide personal information to establish their place of residency, that personal information is for a purpose reasonably required to maintain a qualifying employment relationship, i.e., an employment relationship of a nature that qualifies Fox to claim tax benefits for remuneration paid to the employee.
The Commissioner warned, however, that an employer cannot also have a collateral purpose for collecting, using or disclosing personal information and still claim it is “employee personal information.” If the organization also collects personal information for the purpose of marketing products to employees, the “marketing purpose taints the exercise and the employer must otherwise be on side with PIPA as regards its marketing use of the information.”
The Commissioner also rejected a complaint that Fox violated BC PIPA by declining to provide the complainant with a copy of its privacy policy, stating: “There is … no duty under s. 5(c) [of BCC PIPA] for an organization to provide anyone a copy of any written policies and procedures, on request or otherwise. The legislative language is clear. It only requires organizations to make ‘information about’ policies, practices and processes available on request.”
Noting that Fox is not collecting information such as health information, financial information, educational information or information about employment history, and that the non-sensitive personal information about residency in British Columbia or Canada is stored in the USA under lock and key, that access to it is limited, and that it is shredded after Canadian government audits, the Commissioner concluded that Fox complied with its security obligations under s. 34 of BC PIPA. Further, there was no obligation in these circumstances for Fox to notify employees that their personal information may be located in the United States or elsewhere.
With respect to the complainant’s allegation that once personal information is in the United States, it is subject to the Patriot Act, the Commissioner noted that the “risk of personal information being disclosed to government authorities is not a risk unique to U.S. organizations.” “The nature or degree of risk of access to personal information by national security or law enforcement authorities is not necessary greater outside British Columbia. Various PIPA provisions authorized organizations to, without notice or consent, disclose personal information to law enforcement agencies.”
2006 March 21
The British Columbia Supreme Court held that BC PIPA did not limit the defendant’s right under Rule 27(22) of the British Columbia Supreme Court to obtain the names and contact information of relevant witnesses in a civil lawsuit for personal injury damages allegedly sustained as a result of a motor vehicle lawsuit. The Court noted that BC PIPA provides in s. 3(4): “This Act does not limit the information available by law to a party in a proceeding.” Further, s. 1 “specifies that ‘personal information’ does not include ‘contact information.’”
2006 February 7
The British Columbia Supreme Court upheld the validity of a City bylaw requiring pawnbrokers to provide police with detailed information concerning individuals who sell or pledge second hand goods. The Court rejected the petitioning pawnbroker’s submission that the bylaw violated privacy rights under BC PIPA, stating: “ If the PIPA applies, then I am satisfied the petitioner may collect the personal information, even without consent, where the information “is required or authorized by law”, as provided by s. 12(1)(h) of that Act. Further, I note that Section 17 of the PIPA allows for disclosure of such personal information ‘for purposes that a reasonable person would consider appropriate in the circumstances and that …. are otherwise permitted under this Act’. Section 18(1)(j) allows for disclosure to a public body of personal information without consent, provided the disclosure concerns ‘an offence under the laws of Canada or a province, to assist in an investigation or the making of a decision to undertake an investigation’ (my emphasis). Once again, s. 18(1)(o) allows such disclosure without consent provided ‘the disclosure is required or authorized by law’.”
2005 December 8
Although this decision of the British Columbia Court of Appeal concerns the public sector statute (Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165 (“FOIPPA”)), the unanimous reasons of the Court may provide guidance concerning the relationship between the provisions of collective agreements and privacy statutes.
The Court of Appeal held that provision in the union’s collective agreement with the employer must comply with the privacy protections defined in FOIPPA. Accordingly, in the circumstances of this case, the employer could only disclose personal information to the union if the limitations imposed by FOIPPA permitted such disclosure.
The Court of Appeal concluded that the union was entitled to certain information sought, because it would be consistent with the lawful purpose of disclosure, namely to evaluate the employer’s selection of a suitable candidate for employment.
The Court noted, however, that once the union collects the personal information, “the Personal Information Protection Act, R.S.B.C. 2003, c. 63 (the “PIPA”) applies to any subsequent use and disclosure by the union. PIPA also imposes obligations on the union to ensure that security arrangements are made to properly protect the information.”
2005 April 15
In this British Columbia Supreme Court interlocutory ruling in a personal injury case, the Court cautioned that a defendant who wishes to interview potential medical witnesses without first obtaining a court order “should examine the provisions of the Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, the Personal Information Protection Act, S.B.C. 2003, c. 63 and the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5.” The Court suggested that in the absence of a court order, those statutes may affect the process of interviewing such witnesses.
