On September 13th the Federal Court ordered a law firm to pay $1,500 in damages for publishing an Office of the Privacy Commissioner of Canada decision letter and report of findings that contained an individual’s personal information.
PIPEDA allows some publicly available information to be used and disclosed without consent, including:
personal information that appears in a record or document of a judicial or quasi-judicial body, that is available to the public, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the record or document
The OPC arguably does not act as a judicial or quasi-judicial body in investigating privacy complaints nor are its decision letters and reports public, so the law firm could not rely on this exception.
Though the “related directly to the purpose” requirement is narrowing, law firms are more open to using and disclosing personal information contained in published court and tribunal awards in their publications. The OPC’s recently-published PIPEDA and Your Practice guideline for lawyers nonetheless establishes an anonymization “best practice”:
Ultimately, lawyers should be conscious of limiting the disclosure of any personal information they may have. As a best practice, lawyers preparing newsletters or giving presentations at conferences should give thought to anonymizing or deidentifying personal information in any case law or resources they rely on. Most times, the identity of an individual need not be disclosed in order to explain the legal reasoning underlying a decision.
Does your firm have a protocol in place to address this?
Here’s David Fraser’s post on the case. (David, you’re fast man!)
Girao v. Zarek Taylor Grossman Hanrahan LLP, 2011 FC 1070.
All About Information 