“McNeil disclosure” is a form of Crown disclosure facilitated by a 2009 Supreme Court of Canada decision. The Court held that the Crown has a positive duty to build-out the Crown brief by making “reasonable inquiries” of other Crown agencies and departments. This duty, said the Court, includes a duty to collect and disclose records of police misconduct, at least where an officer is likely to be a witness at trial has record with some arguably relevant blemishes.

After McNeil was issued, the Ontario Ministry of Labour initiated a procedure for conducting CPIC checks on Ontario Occupational Health and Safety Act inspectors to support its disclosure duties. OPSEU grieved, and in March 2011 the Grievance Settlement Board held that the Ministry’s procedure did “not accord with an appropriate exercise of management rights under the [OPSEU/OPS] Collective Agreement.” The Toronto Star headline read, “Province slammed for secret criminal checks on labour inspectors.”

The Divisional Court has now held that the GSB erred in finding that an inspector’s criminal record should not be the subject of first party disclosure pursuant to McNeil. It explained:

A comparison of the role of the investigator in an OHSA prosecution with that of a police officer in prosecutions under the Criminal Code or Controlled Drug and Substances Act does not provide a sufficient basis upon which to differentiate the inspector from the police officer. Though the powers of police officers are broader, the essence of McNeil focuses on the role of police as investigator, accuser and witness. An OHSA inspector has the same role. Furthermore, these regulatory offences can engage severe penal consequences for an accused.

The Crown must exercise its own discretion in deciding what information falls within the parameters of McNeil and what does not, but in the first instance the Crown is obliged to at least obtain the information. Not all police records are relevant to the credibility or reliability of the inspector’s evidence and therefore relevant to the accused’s rights to make full answer and defence. However, there is no reason to think an inspector’s criminal record will have less bearing on the right to make full answer and defence in a regulatory proceeding than a police officer’s record in a criminal prosecution.

I agree with the Crown that McNeil does not just establish a conduit for the disclosure by the police through the Crown’s office; rather it establishes an obligation on the Crown to solicit readily obtainable information, like a CPIC record, or an internal record of misconduct in employment records. The obligation to disclose what is in the “possession and control” of the prosecution is not limited to what it has in its physical possession but also includes readily obtainable information or documents.

This is good news for POA defendants, who will receive the same treatment as criminal defendants based on this reasoning.

The Court also upheld part of the GSB order that imposed certain procedural safeguards to protect inspector privacy. The Court suggested (on a point that doesn’t appear to have been argued) that the GSB jurisdiction to make such a privacy-protective order arose out of its jurisdiction to interpret and apply the Freedom of Information and Protection of Privacy Act. This source of jurisdiction is highly questionable given FIPPA is a records-based statute that has a broad employment-related records exclusion. Indeed, the view that FIPPA does not protect employee privacy is reinforced by the Information and Privacy Commissioner/Ontario’s own position. The IPC has lobbied for elimination of the exclusion so Ontario public sector employees can enjoy statutory privacy rights (see 2004 Annual Report). It also routinely declines jurisdiction over employment-related privacy complaints.

OPSEU v. Ontario, 2012 CarswellOnt 6293, 2012 ONSC 207.

The issue: outsourcing business IT systems to the cloud may impede access to information for audit and investigatory purposes. Data security is front and center in most outsourcings, but audit and investigation capability is also a key concern and is subject to unique requirements. Business owners should recognize that security and audit departments are likely stakeholders in most outsourcing projects and support the best possible needs analysis and requirements definition process.

Here are my slides:

Here are some related resources, including some data security resources that came up in discussion.

• J. Cheng, “IBM’s Siri ban highlights companies’ privacy, trade secret challenges”
• Digital Forensics Laboratories, “Digital investigations in the Cloud”
• T. Harbert, “E-discovery in the Cloud? Not so easy”
• W. Manning, “Investigating in the Clouds” (good, but password required)
• Hogan Lovells, “A Global Reality: Governmental Access to Data in the Cloud”
• K. Ruan et al, “Cloud forensics: An overview”
• A. Savvas, “Cloud providers cave into more flexible contracts”
• T. Trappler, “In the Cloud, Your Data Can Get Caught Up in Legal Actions”
• K. Zetter, “FBI Uses ‘Sledgehammer’ to Seize E-Mail Server in Search for Bomb Threat Evidence”

Finally, here’s a link to my comment on the recent Calgary Police Service case, which I used as an intro to a segment on handling an evidence trail that leads to an employee’s personal cloud-based account.

I hope this content helps you approach a pressing issue for internal investigators.

The facts are simple. The service embarked on an internal sexual misconduct investigation that included a review of an employee’s work e-mail account. It conducted a search for the word “password” as a matter of protocol because the sending and receiving of passwords through e-mail is indicative of a number of common IT security problems. The service found a message to an outsider containing the employee’s password to her personal e-mail account, a communication the service said “seemed odd.” Given the employee had also sent “snippets” of confidential service records to others internally, the service accessed the personal account on a theory that the employee was leaking confidential information through the personal e-mail account. It happened to find evidence of work-related sexual misconduct and used it to discipline the employee. The employee later complained to the OPIC under Alberta’s public sector privacy legislation.

The OPIC was not impressed with the service’s professed basis for using the password to access the employee’s personal account, particularly given the investigator had no mandate to determine whether the employee had committed a breach of confidence. It upheld the employee’s complaint.

The result is no surprise. Taking a step in an investigation as intrusive as gaining unauthorized access to a personal e-mail account based significantly on the discovery of a communication that “seemed odd” is problematic. The record shows that the service was clearly on a fishing expedition, and despite the OIPC’s finding, its approach still signals respect for management’s right to investigate. The OIPC says, for example, “It might be policy to for IT to check for data leakage whenever a Public Body employee is being investigated for inappropriate email or computer use, but this cannot extend, without cause, to an employee’s personal email account.”

The simple lesson from the case for employers who are subject to employment privacy regulation – far from all employers – is to develop and implement controls to structure the process of searching work systems for evidence of misconduct. Who authorizes a search? What’s the scope? What routine searches should be conducted? What should the investigator do if he or she finds evidence of wrongdoing that is out of scope? Who is responsible for securing evidence and how? Organizations should have clear answers to these questions before embarking on an IT search.

Order F2012-07 (April 30, 2012).

This case involved University of Calgary students found guilty of non-academic misconduct in disciplinary proceedings for posting criticisms of a course and its instructor on Facebook. The Court unanimously upheld that part of a judicial review decision which found that the students should not have been found guilty of non-academic misconduct. However, the Court was sharply divided on whether the Charter would apply to this case.  Paperny J.A. found that the Charter applied to the disciplinary proceedings undertaken by the University and that a review committee had failed to take into account the students’ freedom of expression right as protected by the Charter. She rejected the University’s argument that “the application of the Charter in these circumstances undermines the University’s academic freedom or institutional autonomy,” finding that academic freedom and freedom of expression are not competing values. McDonald J.A. found that while it may be time to reconsider whether or not universities are subject to the Charter, the judicial review court erred in undertaking such an analysis in this particular case. O’Ferrall J.A. found that the issue here was not whether the university was a “Charter-free zone,” but whether the university’s disciplinary body ought to have considered whether its discipline violated the students’ right to their freedoms of expressions and association, freedoms which long pre-dated the Charter.

More to come on this decision in a while.

Pridgen v. University of Calgary, 2012 ABCA 139

• to produce any and all computers and electronic media in his possession, power or control, for a forensic review to be conducted by a computer expert retained by the plaintiffs;
• to pay for the review and post $30,000 in security for costs; and
• to pay the costs of the contempt motion on a full indemnity basis.

Yesterday the Court of Appeal for Alberta varied the order because it was not well-proportioned. It explained:

As a remedy for the contempt, the chambers judge ordered that the individual appellant pay the cost of the application on a full indemnity basis. While acknowledging that “in the present case no information has been lost”, he nevertheless ordered a full computer forensic investigation. The chambers judge speculated that “it is unclear what else may have been deleted”. The contempt application was based entirely on the efforts to delete the HSE Manual. No allegation was made of the destruction of any other document, nor is there any evidence of any other destruction. Embarking on an expensive fishing expedition at this stage of the litigation is unwarranted. Should the discovery process produce evidence of other problems, further applications for relief can be brought.

Despite allowing the appeal in part, the Court order the appellant to pay the full costs of the appeal “to ensure an effective sanction.”

Fuller Western Rubber Linings Ltd. v Spence Corrosion Services Ltd., 2012 ABCA 137 (CanLII).

In the Matter of an Application Under Rules 14.05(3)(d), 2012 ONSC 2530 (CanLII).

Last September the Alberta Court of Queen’s Bench held that the Alberta Personal Information Protection Act violated the right of expression guaranteed by section 2(b) of the Charter because it was disproportionate in restricting unions from engaging in “union journalism” relating to labour disputes and picket lines. The Court’s focus was relatively narrow though, and its Charter-based order focused on the breadth of a scope provision meant to protect journalistic activity and an exclusion for publicly available information.

The Court of Appeal first re-framed the expressive interest at stake as related to labour relations and not journalism. It then held that the statute interfered with this interest in a manner that could not be justified in a free and democratic society.

The Court’s proportionality analysis is remarkable in its breadth. It weighs the purpose of Alberta PIPA – protecting reasonable expectations of privacy, protecting expectations that one can control one’s own image and personal information and limiting the misuse of personal information – against the right of free expression in general. The Court says:

There is, however, a problem relating to proportionality. The constitutional problems with the Act arise because of its breadth. It does not appear to have been drafted in a manner that is adequately sensitive to protected Charter rights. There are a number of aspects to the over-breadth of the Act:

-It covers all personal information of any kind, and provides no functional definition of that term. (The definition of “personal information” as “information about an identifiable individual” is essentially circular.) The Commissioner has not to date narrowed the definition in his interpretation of the Act in order to make it compliant with Charter values.

-The Act contains no general exception for information that is personal, but not at all private. For example, the comparative statutes in some provinces exempt activity that occurs in some public places.

-The definition of “publicly available information” is artificially narrow.

-There is no general exemption for information collected and used for free expression.

-There is no exemption allowing organizations to reasonably use personal information that is reasonably required in the legitimate operation of their businesses.

This appeal clearly demonstrates the impact that the Act can have on protected rights. The legitimate right of the union to express itself and communicate about the strike and its economic objectives have been directly impacted by the Adjudicator’s order. The appellant has not demonstrated why this heavy handed approach to privacy is necessary, given the impact it has on expressive rights.

Regarding remedy, the Court issued a declaration that the restrictive order at issue was unconstitutional and invited the Alberta legislature to “decide what amendments are required to the Act in order to bring it in line with the Charter.”

Look for a leave to appeal application in which the Alberta Commissioner is joined by her counterparts from other provinces at the leave to appeal stage.

United Food and Commercial Workers, Local 401 v Alberta (Attorney General), 2012 ABCA 130 (CanLII).

Here are the four points of significance.

First, the Court held that the standard of review for custody or control decisions is reasonableness based on the strong presumption established by the Supreme Court of Canada last December in Alberta (Information and Privacy Commissioner) v. Alberta Teachers’ Association. This is a change, albeit a predictable one in light of Alberta Teachers’ Association. Despite the outcome in this case, custody or control decisions will generally be harder to challenge on judicial review than in the past.

Second, the Court held that the Association of Academic Staff of the University of Alberta did not have a right to notice of standing in the OPIC’s hearing as an affected party or as a matter of fairness. It held that the AASUA interest in the precedential effect of the OIPC’s finding did not give it an interest in the request under appeal sufficient to justify a right to notice and standing.

Third, the Court held that the OPIC erred in finding that the records at issue were under the university’s custody or control.

In part, the Court’s reasoning highlights the growing importance of assessing the purpose of access to information legislation in deciding custody or control issues. It held the OPIC erred by failing to recognize that the faculty member’s e-mails related to a grant funding process in which the university had no role. They therefore shed no light on the university’s own operation in furtherance of the statutory aims. Rather, the records at issue shed much more light on another public institution’s operations, something the Court said the OIPC also ought to have considered.

The Court’s reasoning also suggests that standard technical processes used in the management of business e-mail systems will not govern whether e-mails are in the custody or control of a public institution. It held that the OIPC erred by inferring too much from the routine backup of e-mails and the right to monitor. The Court said, “It was unreasonable to focus on the general computer use policy, rather than considering the particular records in question.”

Finally, the Court declined to address a bold argument by the AASUA that all records produced by faculty members in the course of participating in external committee work and in the context of their internal research and other academic work are not subject to a university’s custody or control. The Court said, “Academic freedom may be one relevant factor in considering whether a university has custody or control of records, but until the Commissioner considers that question in a hearing that raises the issue at first instance, this Court need not address it here.”

University of Alberta v. Alberta (Information and Privacy Commissioner), 2012 ABQB 247 (CanLII) (standard of review, custody or control).

Association of Academic Staff of the University of Alberta v University of Alberta, 2012 ABQB 248 (CanLII) (notice and standing).

The order under review was re-issued by the Board after being quashed in 2010 because the Board had simply blessed the parties’ consent order without considering the privacy interests of affected parties. In re-issuing the order (with some newly-imposed security features), the Board held that the disclosure did not breach the federal Privacy Act because CRA’s purpose for obtaining home contact information (contacting employees about the terms and conditions of their employment) was consistent with the use for which PIPSC would use it (discharging its statutory duties as bargaining agent by contacting employees about employment-related matters). The applicant sought review before the Federal Court of Appeal.

The Court of Appeal’s disposition is unremarkable, and turns mainly on the standard of review and other technical matters.

Bernard v. Canada (Attorney General), 2012 FCA 92.

The facts are simple. A fire started on the defendant’s premises and spread to the plaintiff’s premises. The defendant denied the plaintiff’s insurer access to its premises, which led the plaintiff’s insurer to write. The insurer said that it would likely bring a subrogated claim and that the plaintiff should preserve all physical and other evidence. This left the defendant with an option to allow the requested inspection or stop cleaning the damaged property and debris. It did neither.

The plaintiff raised a spoliation claim in the context of a production dispute. It claimed that privilege in certain communications should be waived in the interests of justice on account of the defendant’s spoliation. Master Baker of the BCSC agreed.

Hat tip to Seva Batkin of the B.C. Business Litigation Blawg for this one. Seva’s post on the case is here.

Brown v. Wilkinson, 2012 BCSC 398 (CanLII).