2006 December 21

Order P06-06, Tsatsu Shores Homeowners Corporation

The BC Commissioner held that BC PIPA authorized the organization to collect and use certain information that it received (solicited or unsolicited) about the job performance of the complainants (now ex-employees) without their consent. “Information about how well the complainant’s were performing their tasks, and information about specific concerns regarding performance, is personal information ‘reasonably required’ within the meaning of BC PIPA’s definition of ‘employee personal information’ “. Further, the Commissioner ruled, the information was (as required by BC PIPA ss. 13(1)(b) and 16(1)(b)) “reasonable for the purposes of managing ‘the employment relationship’ “.

Nevertheless, the organization breached its duty under ss. 13(4), 16(4) and 19(4) of BC PIPA to notify the individual complainants that it would be collecting, using and disclosing their employee information and the purposes for doing so before the information was collected.

The Commissioner rejected the submission of the complainants that s. 33 of BC PIPA (requirement to ensure personal information is accurate and complete) obligated the organization to complete their job performance evaluations.

With respect to complaints that the organization inappropriately disclosed the complainants’ person information in the minutes of board meetings, the Commissioner stated, among other things:

It is one thing for the minutes of a meeting of a board of directors to contain personal information for which the directors have a reasonable need to know and another for those minutes to be made available to residents and others. Disclosure of personal information in this way can fall afoul of PIPA’s definition of employee personal information and of s. 19(2)(b). … Subject to any statutory or other rules about the holding of meetings and publication of meeting minutes, it seems to me this organization should consider discussing personal information of employees and residents in private, with minutes of the private portions not being made generally available.

In the particular circumstances of this case, the Commissioner also ruled that is was not reasonable to place the complainants’ personal information in an unlocked filing cabinet in a basement room with ready access to any number of individuals, regardless of whether that room was locked. This constituted a violation of s. 34 of BC PIPA, which requires organizations to protect personal information “by making reasonable security arrangements.”

2006 December 14

Order P06-05, Langley Cruiseshipcentres Ltd.

The BC Commissioner dismissed complaints by three individuals who once had a business relationship with the organization which was governed, at least in part, by an Independent Contractor Agreement which contained certain obligations relating to “Confidential Information.” The Commissioner found as a fact that “the organization had cause to investigate, and was investigating, whether the complainant’s had breached their agreements when it reviewed and copied their email communications.” The Commissioner also found that “there was a reasonable basis for the organization to expect that, had it sought consent to collection, use or disclosure of personal information, seeking their consent would have compromised the availability or accuracy of personal information in the emails.”

Accordingly, the organization complied with ss. 12(1)(c), 15(1)(c) and 18(1)(c) of BC PIPA [which authorizes collection, use or disclosure without the individual’s consent, or from a source other than the individual, if it is reasonable to expect that obtaining consent would compromise the availability or the accuracy of the personal information and the collection is reasonable for an investigation or proceeding.” The BC Commissioner also held that the notice of collection otherwise required under s. 10 of BC PIPA does not apply to such cases.

The BC Commissioner noted in passing that “every organization that gives its employees and agents authority to use its email and internet systems is well advised to have clear policy on the limits to that use and to communicate that policy to those employees. Policy that clearly spells out that employee email or internet use may be monitored will go a long way to countering arguments that the employee had an expectation of privacy respecting use of the employer’s email system or the internet.”

In this course of this decision, the BC Commissioner also determined that “work product information” (which is excluded from the definition of personal information in BC PIPA) includes information about other business activities, including activities which are outside any employment or business responsibilities or activities of the individuals or third parties in relation to the organization which is the subject of a complaint under BC PIPA. The Commissioner stated that BC PIPA’s “definition of ‘work product information’ is not restricted to information prepared or collected as a part of the responsibilities or activities related to an individual’s employment or business relationship with the organization in question.”

2006 October 26

Order P06-04, Twentieth Century Fox Film Corporation

The BC Commissioner dismissed a complaint that Fox breached BC PIPA and violated mobility rights guaranteed by the Canadian Charter of Rights and Freedoms by requiring proof of British Columbia residency as a condition of employment. Fox collected proof of BC residency during the year immediately before filming in order to qualify for film production tax credits from the British Columbia government under the provincial Income Tax Act.

Although the Commissioner held that residency information is “undoubtedly” personal information under BC PIPA, the Commissioner held that it qualified as “employee personal information” because (i) Fox collected it to manage or terminate an employment relationship and (ii) the purpose for collecting the information was reasonably required to establish, manage or terminate the particular employment relationship.” Significantly, the Commissioner held in this connection:

Fox’s purpose in collecting the information is in one sense related to its business decision to avail itself of tax benefits. It is not collecting the personal information to comply with a specific, or explicit, statutory or other legal obligation or duty. It cannot, however, plausibly be suggested that the Legislature intended to restrict the words “reasonably required” to capture only situations where an organization is “required” by law – statute or otherwise – to collect, use or disclose personal information for employment purposes. Nor can it persuasively be argued that employee personal information is restricted to personal information that is inherently or such a kind that the employer must, practically, collect it for employment purposes.

Again, Fox has decided to take advantage of certain benefits available under federal and provincial tax laws. It has a business purpose for collecting, and a need to collect, personal information from employees to prove its entitlement to tax benefits to the CRA’s auditors. When Fox requires individuals to provide personal information to establish their place of residency, that personal information is for a purpose reasonably required to maintain a qualifying employment relationship, i.e., an employment relationship of a nature that qualifies Fox to claim tax benefits for remuneration paid to the employee.

The Commissioner warned, however, that an employer cannot also have a collateral purpose for collecting, using or disclosing personal information and still claim it is “employee personal information.” If the organization also collects personal information for the purpose of marketing products to employees, the “marketing purpose taints the exercise and the employer must otherwise be on side with PIPA as regards its marketing use of the information.”

The Commissioner also rejected a complaint that Fox violated BC PIPA by declining to provide the complainant with a copy of its privacy policy, stating: “There is … no duty under s. 5(c) [of BCC PIPA] for an organization to provide anyone a copy of any written policies and procedures, on request or otherwise. The legislative language is clear. It only requires organizations to make ‘information about’ policies, practices and processes available on request.”

Noting that Fox is not collecting information such as health information, financial information, educational information or information about employment history, and that the non-sensitive personal information about residency in British Columbia or Canada is stored in the USA under lock and key, that access to it is limited, and that it is shredded after Canadian government audits, the Commissioner concluded that Fox complied with its security obligations under s. 34 of BC PIPA. Further, there was no obligation in these circumstances for Fox to notify employees that their personal information may be located in the United States or elsewhere.

With respect to the complainant’s allegation that once personal information is in the United States, it is subject to the Patriot Act, the Commissioner noted that the “risk of personal information being disclosed to government authorities is not a risk unique to U.S. organizations.” “The nature or degree of risk of access to personal information by national security or law enforcement authorities is not necessary greater outside British Columbia. Various PIPA provisions authorized organizations to, without notice or consent, disclose personal information to law enforcement agencies.”

2006 September 18

Order P06-03, Tally-Ho Motor Inn

The BC Commissioner ruled that a manager breached BC PIPA by revealing to co-workers that it was the complainant who made an allegation to WorkSafeBC that a bar and lounge at a hotel which then employed the complainant was unsanitary, provoking an inspection by WorkSafeBC. At the time of the incident and the inspection, the hotel operated by a different company than the organization which was named in the complaint. [WorkSafeBC inspected the bar and concluded the conditions were not unsanitary].

The Commissioner held that the employees to whom the information about the complainant’s identity was disclosed did not reasonably need that information in order to address concerns about sanitation.

The Commissioner warned that this case does not mean that the name of a complainant can never be used or disclosed in the employment setting, noting as one example that “if an employee were to accuse another employee of harassment, the accused employee would be hard-pressed to defend himself or herself against the charges without knowing the particulars, which would very likely involve disclosing the accuser’s identity.”

2006 September 14

Order P06-02, Victory Square Law Office & British Columbia Nurses’ Union

The BC Commissioner upheld the organizations’ denial of access to information sought by the complainant, who was the subject of a nursing grievance that resulted in a mediation settlement, the terms of which were open-ended. The Commissioner concluded that with-holding disclosure was authorized by s. 23(3) of BC PIPA because the information was protected by “solicitor-client privilege” which covers both legal advice privilege and litigation privilege.

The Commissioner also accepted the submission by the Nurses’ Union that grievance arbitration proceedings under a collective agreement between an employer and a union are litigation for the purposes of litigation privilege, noting this was the first time that question had arisen under BC PIPA and stating:

There is no doubt that grievance arbitration proceedings under a collective agreement are adversarial in nature – the parties are adverse in interest in contested proceedings. There is no doubt, in my view, that having regard to the policy underlying litigation privilege, such proceedings qualify as litigation for the purposes of litigation privilege. This is certainly the view taken by labour arbitrators and it would at the very least be anomalous for a different approach to be taken under PIPA.

The Commissioner also found that disclosure of certain records was also excluded by s. 23(3)(e)(i) of BC PIPA, which protects information collected or created by a mediator or arbitrator in the conduct of a mediation or arbitration for which he or she was appointed to act …under a collective agreement.” This exemption applied to a document described as “Handwritten Notes re Mediation” which recorded information submitted during the mediation.

2006 March 24

Order P06-01, An Incorporated Dentist’s Practice

The BC Commissioner confirmed that the organization was authorized to refuse access to the records sought by the complainant. One record was exempt from disclosure pursuant to s. 23(3)(a) of BC PIA which protects information covered by solicitor-client privilege.

The other 15 records were protected by s. 23(3)(c) which exempts from disclosure “information that was collected without consent, as allowed under section 12 and 18 [of BC PIPA], for the purposes of an investigation and the investigation and associated proceedings and appeals have not been completed.

The complainant was a patient who sought access to the “College/Litigation file” relating to that patient’s complaint against the incorporated dental practice to the College of Dental Surgeons, which decided not to take any action against the organization after it investigated the complaint. The Commissioner states in his ruling:

The material before me indicates that the applicant’s “purported appeal” [to the BC Supreme Court] of [the College’s] disposition of her complaint was still ongoing at the time of this inquiry. Certainly, neither of the parties provided me with any evidence showing that the Supreme Court proceedings associated with this supposed appeal have since been concluded. I am therefore satisfied that there was an “investigation” for PIPA purposes and that the investigation and the proceeding associated with that investigation were not yet completed at the time of this inquiry.”

2005 May 27

Decision P05-03, Fasken Martineau DuMoulin LLP

The British Columbia Commissioner took the same approach as he adopted in Decision P05-02: Bull Housser Tupper and concluded that BC PIPA did not apply to personal information of the applicant held by the law firm. The personal information was under the control of public bodies – Provincial Health Services Authority and University of British Columbia – and therefore governed by the Freedom of Information and Protection of Privacy Act.

2005 May 27

Decision P05-02, Bull Housser & Tupper

The BC Commissioner concluded that personal information on the files of the respondent law firm was not governed by BC PIPA but instead by the Freedom of Information and Protection of Privacy Act, and therefore ruled that the respondent law firm was not required to divulge it to the applicant, who had applied under s. 3(2) (d) of BC PIPA.

The law firm successfully argued that because it held the personal information as a result of its retainer by the Provincial Health Services Authority (“PHSA”), the records were “under the control of a public body” within the meaning of s. 3(1) of the British Columbia Freedom of Information and Protection of Privacy Act.

The concept of “control”, agreed the Commissioner, is to be given a liberal and purposive meaning that promotes the objectives of BC’s access and privacy legislation concerning public bodies. The control need not be exclusive. The Commissioner was persuaded that common law principles regarding ownership of documents in a lawyer’s client files supported the view that its client had “control” over such documents. The evidence before the Commissioner showed that the contractual retainer between the PHSA and the law firm required the law firm to deliver the documents to PHSA on request.

2005 May 27

Decision P05-01, Dives Grauer & Harper

The BC Commissioner ruled that an individual’s request for access to his own personal information held by the law firm was vexatious for the purposes of s. 37(b) of BC PIPA. That section provides that, if asked by an organization, the Commission may “authorize the organization to disregard requests under section 23 or 24 that …are frivolous or vexatious.”

The BC Commissioner stated the decisions involving a comparable provision in the British Columbia Freedom of Information and Protection of Privacy Act [s. 43(b)] will be helpful in considering the application of s. 37(b) of BC PIPA.

In the instant case, the Commissioner noted that because of the litigation disclosure process invoked in litigation involving the applicant and the law firm’s clients, the applicant knew what personal information the respondent law firm had about him and that further disclosure under BC PIPA would merely duplicate what the applicant already had, save for documents subject to solicitor-client privilege which is protected in any event by s. 23(3) (a) of BC PIPA.

2005 May 25

Order P05-01, K.E. Gostlin Enterprises Limited

The BC Commissioner ordered that BC PIPA permitted a Canadian Tire store to require an individual to provide his or her (1) name, (2) address and (3) telephone number when returning goods to the store for the purpose of protecting itself from loss due to fraud by requiring customers to identify themselves.

The Commissioner ruled that such information is “necessary” for that purpose within the meaning of s. 7(2) of BC PIPA, which provides that an “organization must not, as a condition of supplying a product or service, require an individual to consent to the collection, use or disclosure of personal information beyond what is necessary to provide the product or service.” “I find that the personal information the organization requires its customers to provide in order to return goods is, considered in a searching yet reasonable manner, ‘necessary’ for that particular transaction.”

The Commissioner concluded that personal information may be “necessary” under s. 7(2) even if it is not “indispensable … in the sense that it is not possible to supply the product or service without the personal information.”

On the other hand, the Commissioner concluded that collecting that information for the purpose of customer satisfaction follow-up, albeit appropriate, was not “necessary” as contemplated by s. 7(2) and therefore required the consent of the individual.

The Commissioner expressed a “preliminary view” that asking for the individual’s date of birth should be optional and must be clearly so as it was not clear to him that it would be “necessary” within the meaning of s. 7(2).

The Commissioner also expressed a “preliminary view” that asking for photo identification such as a driver’s licence would be “necessary” within the meaning of s. 7(2).

The Commissioner rejected submissions by the store that it was entitled to retain the name, address and telephone number of customers indefinitely pursuant to s. 35(2) of BC PIPA on the grounds this was necessary to prevent fraud. The Commissioner declined, however, to specify a retention period, merely directing the store to formulate a schedule for retention which complies with s. 35(2).

In this ruling, the Commissioner rejected as the test adopted by the Federal Court in Eastmond v Canadian Pacific Railway, 2004 FC 852 as applicable generally to s. 11 of BC PIPA, which provides that “an organization may collect personal information only for purposes that a reasonable person would consider appropriate in the circumstances…”

The Commissioner held that s. 11 of BC PIPA invokes on objective test of “a reasonable person”. “The idiosyncrasies, likes, dislikes or preferences of a particular individual do not determine the outcome … Under s. 11, one has to decide whether the hypothetical reasonable person, knowing the purposes for collection and the surrounding ‘circumstances’ would consider the purposes for collection to be ‘appropriate’. Relevant circumstances may include the kind and amount of personal information being collected, the uses to which it will be put and any disclosures the organization intends at the time of collection.”