Case Report – Doctors’ Association a “trade union” for the purposes of FIPPA

On September 9th, the Divisional Court dismissed an application for judicial review of an Information and Privacy Commissioner/Ontario order in which parts of a memorandum of agreement between the Ontario Medical Association, the Canadian Medical Protective Association and the Ministry of Health and Long Term Care were ordered to be disclosed.

On a point relating to the IPC’s jurisdiction over the MOU, the Court held that the MOU was “an agreement between an institution and a trade union” and therefore not excluded from FIPPA as a record of communications about labour relations.  It relied heavily on the Ontario Court of Appeal’s 2003 finding that negotiations between the OMA and the Ministry were a matter of “labour relations” for the purposes of applying the exclusion itself, therefore making a similarly-broad interpretation of the exception to the exclusion proper in the name of coherence.

The Court also considered the applicants’ attempt to distinguish the terms of the MOU from the terms of a standard supply contract, which are routinely denied protection from public access on the principle that information produced by a negotiation cannot be “supplied” by a third-party.  The IPC’s key factual finding, deferred to by the Court, was that certain actuarial assumptions provided by the CMPA and written into the MOU were a matter of negotiation when viewed in light of the parties’ custom. (Presumably these assumptions determined the cost of insurance, the subject matter of the MOU.)

Finally, the Court affirmed the IPC’s finding that certain information had not been supplied with a reasonable expectation of confidentiality.

Canadian Medical Protective Association v. Loukidelis, 2008 CanLII 45005 (Ont. Div. Ct.).

Cloud Computing, Second Life and the University

This is the title of our just-published university sector client bulletin. It was one of those writing projects I thought I could tackle quickly but led to some significant inquiry and learning, all of which was rewarding. It is written for universities but is relevant to anyone with responsibility for computer use policy in an organization. Click here for more. Hope it is helpful.

Case Report – FC orders party to generate and produce an accounting report

In this August 13th decision, the Federal Court rejected a party’s argument that it should not be compelled to create a record that does not exist and ordered it to generate and produce monthly financial statements from its accounting software program. Though the party did not retain copies of the specific reports requested, the Court held it was possible to generate them with minimal burden. For a look at the Ireland Supreme Court case on the issue of creating records, click here.

Thanks to Peg Duncan, keeper of the Canadian E-discovery Case Law Digest, for passing this on.

Shields Fuels Inc. v. More Marine Ltd., 2008 FC 947.

Information Roundup – 14 September 2008

Here are some new readings that may be of interest. This week they come with a theme – legal issues relating to new computing models.

This blog post comes to you from Halifax. I’m on a surf/construction management trip and have a lot of time to blog and work because I couldn’t imagine smaller waves than what we’ve had this weekend. So I’ve been camping out at our half-built house, reading and blogging off of an air card powered by a portable generator. This sets a new wireless standard for me. Ocean views with a horse in the paddock out front. Not bad.

See ya!

Dan

Case Report – NBCA says counsel can continue to act given nature of privileged records

On July 24th, the New Brunswick Court of Appeal affirmed an order that allowed counsel who received and read privileged communications to continue to act and affirmed the part of the order that stated that counsel was not precluded from establishing the facts underlying the privileged communications.

The defendants claimed that various written statements from a witness for an adjusting firm retained by legal counsel were subject to solicitor-client privilege after they were inadvertently disclosed to the plaintiff along with a draft affidavit of documents several days before examinations for discovery. The plaintiff had thoroughly reviewed and made notes of the written communications in question by the time its counsel showed up at the discovery and was told what he had read was privileged. The plaintiff eventually destroyed the written communications, though it kept its notes and made the point that its actions were taken without prejudice to its right use information contained in the communications now destroyed.

The defendants filed a motion to disqualify the plaintiff’s counsel, but only succeeded in obtaining a protective order that required the destruction of documents and notes and prohibited use of documents. The order also specifically stated that the plaintiff was not precluded from establishing the facts underlying the privileged communications. The defendants appealed, and the third-party defendants who had not participated in the motion for fear of gaining knowledge of privileged communications filed a cross-appeal, arguing that they were now at a relative disadvantage and deserved access to the facts underpinning the privileged communications.

In dismissing the appeal and cross-appeal, the Court of Appeal stressed that solicitor-client privilege only protects communications and not underlying facts. It said:

At the end of the day, one is driven to conclude that the inadvertent production of the Documents probably operated to do no more than this: it acquainted Canada Post and Cox & Palmer with information they would have acquired, sooner or later, as the litigation unfolded. The law would be in a sad state if accelerated acquaintance with non-privileged information, in circumstances such as those that avail here, sufficed to bring about the principled removal of a solicitor of record.

Though this statement may be valid on its own, the judgement was heavily swayed by the Court’s scepticism about the privilege claim. It did not review the impugned communications (nor did the motions judge), said the motions judge’s assumption that the communications were privileged was “questionable” and that, in any event, the documents were likely “fact-focussed.”

Euclide Cormier Plumbing and Heating Inc. v. Canada Post Corporation, 2008 NBCA 54 (CanLII).

Case Report – Arbitration board upholds challenge to post-incident testing provision

On September 3rd, an arbitration board chaired by David Elliot held that a post-incident drug and alcohol testing provision was unreasonable because it required for an automatic test of any employee “involved” unless there were reasonable grounds to find that alcohol or drugs did not cause the incident.

The board felt that this reverse onus was improper. It did not, however, find that an employer must have reasonable grounds in order to test, and endorsed an approach whereby a test could also be ordered where there is, “no credible explanation for the accident, near miss or other potentially dangerous incident.” This finding, which seems sensible, may have been influenced by evidence that supervisors were applying the reverse onus improperly by asking, “Can the use of drugs or alcohol be ruled out?”

Re Communications, Energy and Paperworkers Union, Local 707 and Suncor Energy Inc. (3 September 2008, Elliot).

Case Report – BCCA dismisses leave to appeal forensic inspection order

On September 9th, the British Columbia Court of Appeal dismissed an application for leave to appeal of an order for forensic inspection of a home computer. The applicants argued that the propriety of such orders is of broad significance to the practice, but Bauman J. responded, “In my respectful view, the plaintiff overstates the significance of the case and the scope of the order at bar.”

For a summary of the reasoning given in support of the order, click here.

Honour v. Canada, 2008 BCCA 346.

Case Report – Alberta OIPC releases two biometrics decisions

The Alberta OIPC has recently released two reports on the use of biometrics for timekeeping purposes.  In both, the OIPC upheld the use of biometrics after conducting a contextual analysis that de-emphasized the invasiveness of standard biometric timekeeping systems.

Encrypted form in which information stored weighs in favour of use

The first report, dated August 7th, was made in response to a complaint brought under Alberta’s public sector privacy legislation. The complainant objected to a biometric timekeeping system which relied on a numeric template produced from hand measurements. The rationale for the system – time fraud protection and administrative efficiency – was not particularly unique, though the institution did provide evidence that it had dismissed one employee for buddy punching in the past.  The adjudicator nonetheless held that the institution met the FIPPA necessity requirement, in part because the information was stored in a form in which it was not likely to be misused.

The complainant was under the impression that the hand scanner would “take [her] hand print.”  If the hand recognition system gathered biometric information that was useful in another context, this would represent a potential privacy risk.  For example, if the hand scanner captured an image of the employees’ palms or fingerprints, this information could be used in a law enforcement context.  Having employees participate in a mandatory system that increases risk to their privacy would certainly be intrusive.  However, the system does not gather a palm print or finger print; it collects hand measurements, which it translates into a unique number (the template).  The template is useful only when combined with the employee’s identification number and the payroll system at Intercare.  It seems unlikely that the template could be put to any other use, mitigating the privacy risk and making it less intrusive.

While this is a helpful finding for employers, the adjudicator did state, “This finding does not represent ‘privacy carte blanche’ for public bodies to implement biometric systems.”

Investigation Report F2008-IR-001 (Alberta OIPC).

Use of biometrics okay, but notice especially important for employers

The OIPC reached the same conclusion on the question of use in the second decision, dated August 27th and made in response to a complaint filed under the Alberta PIPA.  This case involved the use of a numeric template produced from employee thumbprints.  The employer’s rationale for use was fairly general, but in finding the employer met the reasonable collection standard in PIPA the OIPC drew an express link between the employer’s rationale for use and the form in which the biometric information was stored.  It said:

While Empire Ballroom previously used another method (the time card/punch clock) it was ineffective due to abuse. Having the manager sign each employee in and sign out was inefficient, and the biometric sign-in system is a paperless system that yields more accurate arrival and departure information that is far more difficult to dispute. The system is also more secure in that employees are unable to access each other’s personal information. In terms of this finding, it is significant that Empire Ballroom does not collect actual thumbprints. Were that the case, my findings might be different.

… an important distinction must be made between collection of actual biometric information used for “one-to-one identification” of a person, and collection of numeric representations of biometric attributes for “one-to-one authentication” of an individual. In the latter case, a finger, hand, voice, or facial imprint is not actually captured; instead numbers representing unique features of a biometric, from which the biometric cannot be reconstructed or reproduced, are collected.  

Although endorsing the employer’s use biometrics for timekeeping purposes, the OIPC held that the employer did not meet the reasonable notification requirement embedded in the Alberta PIPA employee personal information provisions because it did not explain to employees that it would only collect a numerical representation of thumbprints and not thumbprints themselves.  It stressed that identifying personal information to be collected with specificity is important, particularly when information is to be collected through new and misunderstood technologies and particularly for employers, who are relieved from the ordinary consent requirement under PIPA.

Investigation Report P2008-IR005 (Alberta OIPC).

Information Roundup – 5 September 2008

Here are some links which may be of interest.

Just heading up north for the weekend for my sister-in-law’s wedding.  Should be a good time.  Hope you have a good one too!

Dan

Information-sharing a part of recent Dawson College discussion

The media has reported on the release of the Coroner’s report on the 2006 Dawson College shooting and Quebec’s new gun control law, which came into force on Tuesday. I believe the report is only available in French (though if someone knows otherwise, please let me know).

The focus of the recent discussion is on gun control, but there are a number of information-related points of significance. First, the media again has suggested that privacy laws prohibited information-sharing and contributed to the incident. Second, the Quebec coroner’s report apparently recommends that health and education officials should have access to the federal gun registry so they would know if a student or patient has a gun, which begs the tough question, “And then what?” And finally, the new Quebec law includes a requirement on teachers and educational administrators to report suspicious behaviours to the police and a statutory authorization for these individuals and certain health care professionals to make such reports. The standard for reporting is a “reasonable grounds” standard and there must be a link between the behaviour and harm “by the use of a firearm.”

Notably, under the new Quebec legislation, health care professionals who are not educational administrators – “professionals occupying a management position” in the language of the Bill – do not appear to be subject to a mandatory reporting duty. Rather, they are given a discretion to report based on observation of behaviour that does not necessarily meet the traditional risk of “serious and imminent harm” standard but is linked to the use of a firearm.

As readers of this blog know, I’m very interested in the topic of information sharing and managing the threat of on-campus violence. For more on this topic, see this post.