On January 8th, the Alberta Court of Queen’s Bench quashed an order of the Information and Privacy Commissioner of Alberta that dealt with a City of Edmonton directive to second hand goods dealers that required them to collect the personal information of individuals selling used goods.

The City required dealers to collect the name, date of birth, gender, eye colour, hair colour and identification details of all sellers and upload this and other information to a database hosted by a third-party under contract to the City. The police could access the database, but the information also remained available to dealers (presumably) for use in their business.

In February 2008 the IPC ordered the City to stop collecting information and destroy its database. It held that the scheme established a “collection” by the City, but that this collection violated the Alberta Freedom of Information and Protection of Privacy Act because it was not authorized by law, was not collected for the purpose of law enforcement and was not necessary for an operating program or activity of the City. The key finding was that the City’s longstanding by-law, which required used goods dealers to make information available to peace officers, did not allow the City to implement a scheme whereby information is uploaded to a database under the City’s control.

The Court of Queen’s Bench held that the IPC’s reading of the by-law was too strict and that that by-law provision that required dealers to “record” and “make available” information authorized it to direct the uploading of personal information to a secure database to be accessed on a standing basis. The outcome of the Queen’s Bench decision did not turn on this finding, because it held in any event that the City was not collecting information through dealers. Since dealers had their own purpose for collecting the information and also collected and uploaded additional information than that required by the City, the Court held they were not the City’s agents. According to the Court, the scheme entailed a collection by the police rather than the City, a collection that was lawful because it was made for the purpose of law enforcement. Finally, the Court held that the Commissioner erred in ordering the destruction of the database.

The Queen’s Bench decision is lengthy and includes more findings than described in this post. Though most of the Court’s conclusions are technical, it does seem to comment generally on the interpretation of municipal powers as they pertain to personal privacy and on the proper characterization of data flows. Moreover, the Court’s rather quick but clear conclusion that the collection was for “law enforcement” purposes is significant and appears to conflict with the Ontario Court of Appeal’s finding in the 2007 Cash Converters case. These points of significance aside, there is also an interesting subtext that is illustrated by the Court’s rather complete and forceful quashing of the OIPC order.

Business Watch International Inc. v. Alberta (Information and Privacy Commissioner), 2009 ABQB 10.

On December 24th, the Ontario Court of Appeal issued a judgement on the deemed undertaking rule. It held:

• That it only proscribes use and disclosure of information obtained in discovery by the recipient (and not by the provider, whose privacy interest the rule protects)
• That it acts as a shield against production in a subsequent action subject to its exceptions, including the exception for court-ordered relief
• The “interests of justice” versus “prejudice” balancing test for court-ordered relief does not protect the personal privacy interest of an individual in the records at issue

The last point arose because the records being considered by the Court included video surveillance footage and medical information of the plaintiff. She had obtained these records from her opponent in prior litigation, thereby engaging her opponent’s privacy interest. It appears that she attempted to argue that her personal privacy interest in the records was relevant to the exercise of discretion in ordering relief given the content of the records. The court disagreed, and said the only privacy interest engaged by the rule is that of a party compelled to produce records.

Kitchenham v. AXA Insurance Canada, 2008 ONCA 877 CanLII.

This is a pitch for the OBA Privacy Law section’s “What every lawyer needs to know about privacy” session.  It’s at the Metro Convention Centre on February 2nd from 1:15 pm to 4:30 pm.  Details here.

There’s a good line up, with a year-in-review talk along with sessions on the new telemarketing regulation and privacy and litigation (a favorite topic of mine).

I’ll be speaking with Professor Avner Levin on workplace privacy in a discussion moderated by Howard Simkevitz.  We’ve been planning the discussion for the last couple of days and have decided to spend a good deal of it on the workplace privacy issues related to Web 2.0.  Dr. Levin and other members of the Ryerson University Privacy and Cyber Crime Institute at the Ted Rogers School of Management have recently published a leading study on the perceptions of risk of young Canadians engaged in online socializing and how their behaviors meet with the use of online social networks by business for commercial and human resources purposes.  The study is entitled The Next Digital Divide:  Online Social Network Privacy and has attracted significant attention. We plan to hit on the major legal and policy issues relating to the workplace that flow from the study as well as touch on the key other “need to knows” about workplace privacy.

We’d love to see you there!

Dan

On December 15th, Arbitrator Lorne Slotnick dismissed a grievance that challenged the implementation of a biometric timekeeping system.

The employer purchased a Kronos system and required employees to enrol. The system works by matching a person’s partial fingerprint against a 348 byte numeric representation or “template” of the fingerprint that is created in the enrolment process. The employer brought evidence that fingerprint templates were kept secure and could not readily be used to recreate a fingerprint image that could be used by law enforcement. The employer also admitted that it did not have a serious “buddy punching” problem but wanted the superior biometric system anyway.

Arbitrator Slotnick applied a balancing test and dismissed the grievance because the employer had proven a concrete benefit to the system and its invasiveness was minimal. He used the following strong langauge in doing so:

How great is the infringement on privacy of employees? In my view, the evidence reveals it to be extremely small, almost negligible. In fact, labelling this an “invasion” of privacy strikes me as linguistic excess. When employees enrol in the system, a scan of less than half of a fingertip is taken. Enrolment, the evidence indicates, takes less than a minute. There is no physical intrusion, no furnishing of any bodily substance, no exposure of any part of the body that is considered private. Employees do not provide a fingerprint, nor can the scan that is provided be reconstructed into a fingerprint.

…

Natrel asked me to contrast these facts with the kinds of personal information that is routinely gathered by this employer and others, such as employees’ home phone numbers, signatures, home addresses and social insurance numbers. The union argued this was an irrelevant consideration. I disagree. The type of information given as a matter of course by employees to their employers indicates clearly that a certain level of infringement of privacy is understood and accepted by all workplace parties – provided there is some legal or business justification and provided the information is protected and used only for the purpose for which it is given. No evidence is necessary for me to note that in addition to the information mentioned above, many employers request other sorts of information such as photographs of employees for use on identification cards or bank account numbers for direct deposit of pay. These are accepted intrusions, they are part of the modern workplace, and in my view are far more invasive and far more open to the possibility of misuse or abuse than a scan of part of a fingertip that is converted to a jumble of numbers and deleted right away.

Unionized employers have been cautious about implementing biometric timekeeping systems since Arbitrator Tims upheld two similar grievances in Dominion Colour and IKO Industries, the latter being upheld on judicial review. Though no one arbitrator is bound by another, the facts underlying most challenges to these systems are similar. This decision and two similarly permissive decisions of the Alberta OPIC from last year (see here) are therefore persuasive and tip the balance of authority in employers’ favour. In fact, Abitrator Slotnick noted that Dominion Colour and IKO Industries were not distinguishable on their facts, but that he preferred a different balancing of interests.

Agropur (Natrel) v. Milk and Bread Drivers, Dairy Employees, Caterers and Allied Employees (Teamsters Local Union No. 647), 2008 CanLII 66624 (ON L.A.).

I’m happy to announce that we’ve published the Information and Privacy Post “2008 Year in Review.” This years’ edition covers 100 cases from 2008 on the law of privacy and access to information, protection of confidential business information and the law of production. Co-editor Paul Broad and I also have done a forward to the annual that discusses the following five highlights:

1. Ontario Court of Appeal says journalists can’t shield wrongdoers…appeal pending (on National Post)
2. Three civil privacy claim cases out of Ontario… the dawning of a new era? (on Nitsopoulos, Warman and Colwell)
3. SCC says privacy commissioner can’t adjudicate on privilege claims (on Blood Tribe, E.F.A. Merchant and Proplus)
4. Alberta Court of Appeal decision lends some clarity to pleas for a spoliation remedy (on Black & Decker and Commonwealth Marketing Group)
5. SCC says what’s disclosed in the discovery room stays in the discovery room (on Juman v. Doucette)

We hope you enjoy!

Dan