When an employer confronts an employee with an allegation of improper access to personal information, it is important to give the employee the event log data that proves the allegation. It may often be voluminous and difficult to interpret, but presenting a general allegation or summarizing events without particulars will give the employee a good reason to deny the allegation.
This is what happened in this very illustrative British Columbia case in which an arbitrator held he could not infer dishonesty from the grievor’s initial failure to admit wrongdoing because the grievor had not been given log data. Also, if an employee continues to deny responsibility, log data can be difficult to rely upon; even if it can be established to be authentic, there are issues about presenting log data in a meaningful and privacy-protective way. An early admission can go a long way.
Fraser Health Authority (Royal Columbian Hospital) v British Columbia Nurses’ Union, 2017 CanLII 72384 (BC LA).
On November 28th the Nova Scotia Court of Appeal held that the Nova Scotia Workers’ Compensation Appeals Tribunal erred by ordering the disclosure of a worker’s entire file without redaction.
The matter was about a workplace safety insurance claim, and particularly whether a worker’s condition was caused by his work. The Tribunal made the order in response to an employer’s objection to various redactions made to a set of records in the possession of the Workers Compensation Board. Although the employer argued the redacted information was relevant, the Tribunal ordered the unredacted file to be produced because it lacked the resources to vet for relevance, because fairness and the “ebb and flow” of a hearing supported full disclosure and because of the difficulty in making relevance determinations.
Despite the obvious appearance of laziness, the Tribunal framed its decision as rooted in procedural fairness. In response, the Court said: “…there is no principle of procedural fairness… that a litigant who requests disclosure is entitled to see every document it requests, regardless of relevance and without a relevance ruling by an impartial arbiter.”
Implicit in this statement is a concern for the worker’s privacy interest. The Tribunal had recognized this interest in a policy manual that it disregarded in making its order, though there are aspects of the Court’s reasoning that suggest a more broadly based right to redaction.
The Court gave this guidance on how to vet for relevance:
The person who vets for relevance must keep in mind that material should be disclosed for its connection to the “proposition[s] being advanced” by the parties, to borrow Justice Rothstein’s phrase, and not merely to justify an anticipated conclusion on the merits of those propositions. The vetting official may not be able to foretell precisely how the evidence will be martialed. So the ambit of disclosure should allow the parties some elbow room to strategize for the engagement.
Baker v. Nova Scotia (Workers’ Compensation Appeals Tribunal), 2017 NSCA 83.
Who is the “health information custodian” when an institution with an educational mandate provides health care? PHIPA gives institutions choice. Here’s a presentation I gave yesterday in which I argue that the institution (and not its employed practitioners) should assume the role of the HIC. Also includes some simple content on the new PHIPA breach notification amendment.
It’s hard being the Office of the Privacy Commissioner of Canada. The OPC is responsible making sure all is right in commercial sector and federal government sector privacy. It has a pretty small operating budget, yet issues in these sectors are meaty and novel – I dare say harder to deal with than the privacy issues raised in the health and provincial public sectors. More than anything, meeting the OPC mandate is particularly challenging because the mandate is to enforce a principled statute that affords a “right to privacy” that lacks a well-understood meaning.
It is in this context that the OPC issued its 2016-2017 Annual Report to Parliament. The report includes a 24 page “year in review” on PIPEDA that follows the OPC’s public consultation on informed consent and some polling work that shows 90% of Canadians are concerned about their privacy. The OPC concludes that the PIPEDA commercial sector regime is at a crossroads – making some suggestions about new directions, giving some practical guidance and arguing for more enforcement power.
This post is to highlight the most significant new directions and practical guidance and to provide a short comment on the argument for more enforcement power.
The most significant new directions and practical guidance:
- The OPC will expect organizations to address four elements in obtaining informed consent – what personal information is being collected, who it is being shared with (including an enumeration of third parties), for what purposes is information collected, used or shared (including an explanation of purposes that are not integral to the service) and what is the risk of harm to the individual, if any.
- The OPC will draft and consult on new guidance that will explicitly describe those instances of collection, use or disclosure of personal information which we believe would be considered inappropriate from the reasonable person standpoint under subsection 5(3) of PIPEDA (no-go zones).
- The OPC says that “in all but exceptional cases, consent for the collection, use and disclosure of personal information of children under the age of 13, must be obtained from their parents or guardians” and “As for youth aged 13 to 18, their consent can only be considered meaningful if organizations have taken into account their level of maturity in developing their consent processes and adapted them accordingly.”
- The OPC will encourage industry to develop codes of practice and fund research for the purpose of developing codes of practice to address more particular, sector-specific challenges – presumably a mechanism by which organizations will be able to seek safe harbour.
- The OPC will make greater use of its power to initiate investigations “where [it sees] specific issues or chronic problems that are not being adequately addressed.”
Then, there’s the OPC’s argument for more enforcement powers. Specifically, the OPC wants Parliament to drop the “reasonable grounds” restriction from its audit power so it can engage in truly proactive audits, it wants the power to levy fines and it wants PIPEDA to feature a private right of action – all of which would invite a departure from the ombudsman model the OPC has operated under since PIPEDA came into force in 2004.
I personally dislike the ombudsman model of enforcement because it doesn’t come with the procedural safeguards associated with more formal enforcement models and can therefore give the ombudsman a frightening degree of “soft” power. This said, the prospect of big fines and lawsuits based on substantive rules that are poorly defined and understood is even more frightening to to those in the business of privacy compliance and defence. This is the irony of the OPC report: at the same time the OPC admits that the substance of the PIPEDA is, at the very least, “challenged” it asks to enforce it with a new hammer. Now going through an admittedly bad experience with CASL – legislation that the OPC would argue is much more “ineffective” than PIPEDA (see p. 34) – we can readily foresee the wasted compliance costs that the proposed change to PIPEDA could invite. Even if business is indeed responsible for the great concern about privacy that the OPC’s polling effort reveals, this is nonetheless a valid position for business to take going forward.
A four judge majority of the Court held that the clause should not be enforced. Three judges in this majority (Karakatsanis, Wagner and Gascon JJ) held that the clause was valid according to contract law principles but, as a matter of policy, should not be enforced. They explained that the two dispostive factors were (1) the “gross inequality in bargaining power” between Douez (a consumer of online services) and Facebook and (2) the interest in local adjudication of privacy disputes – disputes that rest on “quasi-constitutional” rights. Justice Abella joined this group against enforcement of the clause, but held that the clause should not be enforced because it was unconscionable – issuing a broader critique of the means of contracting used by Facebook and most other online service providers.
Douez v. Facebook, Inc., 2017 SCC 33 (CanLII).
There’s been some talk about the Federal Court of Australia’s recent decision in the “Ben Grubb” case – Mr. Grubb being the journalist who requested and was denied access to certain data related to his mobile phone usage from his carrier. Although the data was linked to Mr. Grubb’s mobile phone usage, the Court held it was not “information about” Mr. Grubb and therefore was not “personal information” that Mr. Grubb could access under the Australia Privacy Act. The Court explained:
…in every case it is necessary to consider whether each item of personal information requested, individually or in combination with other items, is about an individual. This will require an evaluative conclusion, depending upon the facts of any individual case, just as a determination of whether the identity can reasonably be ascertained will require an evaluative conclusion.
In some instances the evaluative conclusion will not be diﬀicult. For example, although information was provided to Mr Grubb about the colour of his mobile phone and his network
type (3G), we do not consider that that information, by itself or together with other information, was about him. In other instances, the conclusion might be more diﬀicult. Further, whether information is “about an individual” might depend upon the breadth that is given to the expression “from the information or opinion”. In other words, the more loose the
causal connection required by the word “from”, the greater the amount of information which could potentially be “personal information” and the more likely it will be that the words
“about an individual” will exclude some of that information from National Privacy Principle 6.1
In other words, there must be more than a link between information and an individual for the information to be “personal” information. The information must also reveal something “about” the person in a way that engages a reasonable expectation of privacy. I am not sure whether this “guts” the rights provided by the Australia Privacy Act as reported, but this reasoning has been a feature of Canadian law, most notably supported in our Federal Court of Appeal’s Nav Canada case – an authority the Australian court relied upon in determining the outcome of Mr. Grubb’s access request.
Privacy Commissioner v Telstra Corporation Limited  FCAFC 4 (19 January 2017).
On December 12th of last year, Justice Fragomeni of the Ontario Superior Court of Justice ordered a man to pay $15,000 in damages to his estranged spouse for surreptitiously installing a camera in a bathroom (prior to separation) to take photos “for a couple of days.” There’s little analysis about liability. Here are the damages factors listed by the Court:
1. the nature of the intrusion. It took place in a bedroom and bathroom, places which are very private. The privacy interests of Sheth were significant.
2. the intrusion takes place within a domestic relationship
3. although Sheth was embarrassed and shocked at the intrusion no medical information was filed to support and establish an evidentiary basis to find any significant effect on Sheth’s health or welfare
4. the conduct of Patel in lying about the intrusion at his Discovery and even attempting to blame Sheth herself for the camera being installed is extremely aggravating and demonstrates a lack of any insight into what he did as being wrong.
Note also that the photos recovered and tendered in evidence by the plaintiff did not show anything explicit.
Patel v Seth, 2016 ONSC 6964 (CanLII).