On April 20th, the Alberta Court of Queen’s bench quashed several Alberta OIPC orders made against a doctor and a medical spa in relation to the maintenance and use of a database of contact information used to market medical and medspa services and fundraise for a related charitable foundation.
The complainants were patients of the doctor who claimed to have received mailings without having provided consent. Both asked not to be identified in the course of the OPIC’s inquiry because they feared reprisal from the doctor and had an ongoing need for his services.
The Court held that the OIPC erred in agreeing with the complainants’ request for anonymity and withholding their identities. It held that the OIPC must meet a “fairly stringent” standard of fairness and did not meet this standard in the circumstances. It discounted the complainants’ concern about access to medical services given they lived in a major centre and held the prejudice to the respondents from non-identification was significant. The Court said:
Had the applicants been provided with the identity of the complainants, they could have checked their records to confirm whether consent had been provided or refused, or may have had an explanation as to why the complainants continued to receive solicitations despite their wishes to the contrary if that in fact was the case. Here the applicants were forced to accept the evidence of the complainants that they had not provided consent, without being given the opportunity to rebut the evidence. In my view this was unfair and wholly inappropriate given the reliance of the Privacy Commissioner on the complainants’ evidence of no consent and the applicants’ evidence that documentation was available which could potentially support their position that consent was obtained. Relevant documentation would likely have constituted the best evidence as to whether or not consent was given to the use that was made of the information.
Even more significantly, the Court held the OPIC erred in finding that the Alberta Health Information Act prohibits the collection and use of individually identifying health information for marketing and fundraising purposes with or without consent. In doing so, the Court recognized that the general purpose of privacy legislation is to give people control the use of their personal information. It held the OIPC’s interpretation was inconsistent with this purpose, inconsistent with evidence of legislative intent and inconsistent the text of the statute.
Lycka v. Alberta (Information and Privacy Commissioner), 2009 ABQB 245.
All About Information 