Majority of Alberta CA Slaps OIPC on Driver’s License Case

On March 28th, a majority of the Alberta Court of Appeal held that the OIPC erred in finding that receiving and recording driver’s license and license plate numbers for security-related purposes is a breach of Alberta PIPA. This is a significant and business-friendly judgement on how to interpret private sector privacy legislation. It also demonstrates a wide gap in values between our privacy commissioners and some members of the judiciary.

Justice Slatter wrote for the majority, with a concurrence by Justice Berger. Justice Slatter held that the OIPC erred in finding that license plate numbers are personal information and erred in finding that that Leon’s failed to comply with the standard for collecting personal information under Alberta PIPA by recording the driver’s license and license plate numbers of individuals who picked up furniture.

Notwithstanding that Leon’s used license plate numbers as a backup means of identifying individuals, Justice Slatter held that license plate numbers are not an individual’s personal information because license plate number are only information “about” or “related to” a vehicle. He said, “The Act is designed to regulate and protect information that is uniquely connected to one person.” He also interpreted the meaning of personal information in light of the normative “reasonable expectation of privacy” concept, noting that there is no reasonable expectation of privacy in a license plate number because it is displayed openly in public.

Regarding whether the recording of driver’s license and license plate numbers is justifiable under the standard for collection in Alberta PIPA, Justice Slatter held that the OPIC’s finding was improperly influenced by a belief that the Alberta PIPA makes privacy rights paramount to an organization’s need to collect information. He held that this was inconsistent with the purpose provision of Alberta PIPA, which expressly recognizes the need of organizations to collect personal information for purposes that are reasonable. In light of this recognized need, Justice Slatter stressed that the standard for collecting personal information under Alberta PIPA is not a strict necessity standard. He referred to a “reasonable necessity” requirement given section 7(2) of Alberta PIPA requires that a mandatory collection of personal information must be limited to “what is necessary to provide [a] product or service,” but Justice Slatter makes clear that the overall reasonableness of a collection should be the focus of the inquiry. This led him to state, “As long as fraud is a meaningful risk in the business, and the policies adopted have a meaningful effect on preventing or detecting fraud, those policies would be considered ‘appropriate in the circumstances’ by reasonable people.”

Justice Conrad wrote a lengthy and detailed dissent. She disagreed with the majority on whether license plate numbers are personal information and on whether the recording of driver’s license and license plate numbers is justifiable for security-related purposes.

Regarding the personal information issue, Justice Conrad relied heavily on Justice LaForest’s dissenting judgement in Dagg v. Canada and the Ontario Court of Appeal’s judgement in Ontario v. Pascoe. In Dagg, Justice LaForest argued that “the information about an identifiable individual” condition in the definition of personal information should be construed broadly. In Pascoe, the Ontario Court of Appeal held that information is about an identifiable individual if it is about and individual who can be identified when the information is combined with information from “sources otherwise available.” Justice Conrad also held that the reasonable expectation of privacy concept should not be applied in assessing whether information is protected under statute as “personal information.”

On the justification for collection issue, Justice Conrad stressed the governing reasonableness standard of review, though she did expressly disagree with the majority’s suggestion that necessity is not part of the standard for collection under Alberta PIPA.

The Court’s discussion of both these issues, especially the personal information issue, is very significant, but the context is also notable. The Alberta OPIC has had a tough go in the Alberta Courts lately, most recently having a decision quashed for reasonable apprehension of bias. It certainly did not go out on a limb here given its position against the recording of driver’s license numbers is shared (at least) by the federal and Ontario commissioners, yet it lost on the reasonableness standard of review in a manner that must feel like a good slap. Look for an appeal.

Leon’s Furniture Limited v. Alberta (Information and Privacy Commissioner), 2011 ABCA 94 (CanLII).