BCCA finds statutory right of access to personal health information too broad

On April 24th, the Court of Appeal for British Columbia held that section 96(1) of the British Columbia Child, Family and Community Service Act infringes the Charter right against unreasonable search and seizure.

Section 96(1) gives British Columbia directors of child protection a right of access to information in the custody or control of public bodies, including health care bodies. Although for child protection purposes in the main, section 96(1) is worded broadly as follows:

96 (1)   A director has the right to any information that

(a)     is in the custody or control of a public body as defined in the Freedom of Information and Protection of Privacy Act, and

(b)     is necessary to enable the director to exercise [their] powers or perform [their] duties or functions under this Act.

The Court held that “necessity,” in particular given section 96(1)’s child protection purpose, imposes only a limited restriction – confining the right of access to “any information in the custody or control of a public body that the ‘“’Director considers necessary.'”

Interpreted as such, and based on a balancing of parents’ interest in informational privacy against the competing state interest in protecting children from harm, the Court held that section 96(1) was unreasonable.

The Court held that the application judge erred by focusing to heavily on the manner of intrusion – which does not invite an intrusion upon the body, entry into a private dwelling or ongoing surveillance – without giving due weight to the sensitivity of the information at issue. It said:

In applying the second Goodwin factor, a judge must consider not only the extent to which a particular methodology directly engages with the target of the search or seizure and interferes with their bodily integrity or personal surroundings, but the impact of the state action on their reasonable expectations of privacy in light of the nature of the items or information involved. In his earlier-cited article, Professor Penney describes the intrusiveness analysis in this manner: it is an assessment of the “degree to which [the search or seizure] discloses intimate personal information or compromises dignity, autonomy, or bodily integrity”: at p. 96, emphasis added. I agree.

The Court also held that the application judge erred in finding that section 96(1) has sufficient safeguards. Importantly, it said that prior judicial authorization or prior notice is not required to meet section 8’s standard of reasonableness, but held that section 96(1) lacks other features that renders it unreasonable. The Court (oddly) criticized the clarity of section 96(1) and suggested that the province replace the necessity requirement with a reasonableness requirement (?). More plainly, the Court said that the province must at least provide for after the fact notice and a meaningful oversight mechanism.

The Court declared section 96(1) to be of no force an effect to the extent that it authorizes the production of personal information, suspended the declaration for 12 months and ordered that the declaration be prospective only.

T.L. v. British Columbia (Attorney General), 2023 BCCA 167 (CanLII).

Hat tip to Ian Mackenzie.

No Charter-protected expectation of privacy in vehicle operation data

On July 20th, the Court of Appeal for Saskatchewan held that an accused person who drove his pickup truck through a highway intersection and stuck a semi-truck did not have a reasonable expectation of privacy that precluded the police from seizing a control module and its data from his vehicle before it was towed away.

The accident was horrible. There were six people in the truck with the accused, three of whom died, two of whom were children. The police charged the accused with dangerous driving and criminal negligence, and the prosecution relied on evidence retrieved from the wrecked pickup truck at the scene of the accident. Specifically, the police seized the truck’s Airbag Control Module (ACM) from under the driver’s seat. The ACM contained an Event Data Recorder (EDR) with data about the vehicle’s operation during the five seconds before impact in tenth of a second intervals – specifically, speed, accelerator pedal (% full), manifold pressure and service brake (on/off), seatbelt pretensioner readings, airbag deployment readings.

There are competing lines of Canadian jurisprudence regarding the warrantless seizure of on board vehicle computers and their data. The leading Ontario case is Hamilton, a Ontario Superior Court of Justice case that recognizes a reasonable expectation of (informational) privacy. In Yogeswaran, though, the Ontario Superior Court of Justice held that the territorial privacy interest in one’s vehicle is enough to preclude police search and seizure without prior judicial authorization.

Conversely, in Fedan, the Court of Appeal for British Columbia held that one’s territorial privacy interest in their vehicle is extinguished when the vehicle is seized and that EDR data is not associated with a strong enough informational privacy interest to warrant Charter protection.

The Court of Appeal for Saskatchewan followed Fedan. It reasoned that the accused’s truck, being totally destroyed on the side of a public roadway, was in the total control of the police whether or not it was yet to be formally seized based on section 489(2) of the Criminal Code. It concluded:

…the claim to a territorial privacy interest by Mr. Major in that component of his vehicle is weak. While a warrant could have been obtained, that does not mean one was required. I find that the state of the vehicle, Mr. Major’s loss of control over it, the nature of the ACM as a mechanical safety component installed by the manufacturer, and the focused task by Cpl. Green in locating and removing only it, do not support the continued existence of an objectively reasonable territorial privacy interest at the point when the vehicle was entered

Regarding informational privacy, the Court made the point that not all digital evidence is equally sensitive or revealing of one’s “biographical core.” EDR data of the kind at issue is limited to data about the operation of a vehicle immediately before an accident, and provides no “longer-term information about the driving habits of the owner or operator of a vehicle.” The Court concluded:

After considering the two lines of cases regarding EDR data, I find myself in substantial agreement with the reasoning from Fedan for the characterization of the data stored in the EDR. As in Fedan, the data here “contained no intimate details of the driver’s biographical core, lifestyle or personal choices, or information that could be said to directly compromise his ‘dignity, integrity and autonomy’” (at para 82, quoting Plant at 293). It revealed no personal identifiers or details at all. It was not invasive of Mr. Major’s personal life. The anonymous driving data disclosed virtually nothing about the lifestyle or private decisions of the operator of the Dodge Ram pickup. It is hard to conceive that Mr. Major intended to keep his manner of driving private, given that the other occupants of the vehicle – which included an adult employee – and complete strangers, who were contemporaneously using the public roadways or adjacent to it, could readily observe him. His highly regulated driving behaviour was “exposed to the public” (Tessling at para 47), although not to the precise degree with which the limited EDR data, as interpreted by the Bosch CDR software, purports to do. While it is only a small point, I further observe that a police officer on traffic patrol would have been entitled to capture Mr. Major’s precise speed on their speed detection equipment without raising any privacy concerns.

R v Major, 2022 SKCA 80 (CanLII).

Appellate court’s decision on teachers’ privacy rights in Ontario

I’ve stuck my neck out in the BLG Insights article linked below in saying that the Court of Appeal for Ontario got a recent school search case wrong. Privacy claims are unpredictable, and can hook on ideas held by decision-makers in a way that impedes common sense outcomes. This is one of those cases in my view, and does harm to security and safety on a number of levels.

Practically, Ontario organizations ought to be addressing the very subject matter of this case in preparation for an October legislative change that will require workplace monitoring policies. The new legislation doesn’t change the right to “monitor,” but organizations shouldn’t view their policies as neutral. Rather, advocacy in support of several essential organizational interests should be embedded in that policy so clear need for balance is established from the start.

https://www.blg.com/en/insights/2022/07/appellate-courts-decision-on-teachers-privacy-rights-in-ontario

Man CA – Police can identify driver of rental car via agency

On April 15th, the Court of Appeal for Manitoba held that an accused had no reasonable expectation of privacy in information that a rental car agency provided to the police without a warrant.

The police were investigating a fatal shooting. The shooter was in a rental car that belonged to a specific agency, they knew. When the police asked, the agency identified the co-accused as the renter and the accused as an authorized driver. It also provided their cell phone numbers, drivers license numbers and credit card numbers.

The Supreme Court of Canada decision in Spencer dictates that the PIPEDA allowance for volunteering information to the police does not vitiate one’s expectation of privacy for the purpose of Charter analysis. The Court of Appeal acknowledged this, and as in Spencer, it also held that contract language allowing for the disclosure of personal information as “required or permitted by law” was “of no real assistance.”

However, the Court of Appeal distinguished Spencer on other grounds. Its decision turns on the following key factors:

the rental agreement allowed the agency share information with law enforcement “to take action regarding illegal activities or violations of terms of service”
section 22 of the Manitoba Highway Traffic Act requires agencies to keep a registry of renters that is open to public inspection (even though the registry is to include “particular’s of the [renter’s] drivers license”)
the overall context – i.e., that driving is a highly regulated activity, with one’s identity as an operator of a vehicle being something that is widely known and ought to be widely knowable

Privacy advocates will take issue with the Court’s reliance on the rental agreement term, though the case does rest on two other significant factors, including a provision of Manitoba law that the accused did not challenge. On a quick look, I see that Saskatchewan has the same provision.

R v Telfer, 2021 MBCA 38 (CanLII).

Notable snippet about the personal information concept in recent Ont CA search case

On January 13th, the Court of Appeal for Ontario held that a convicted appellant did not have a reasonable expectation of privacy in “what could be seen and heard on [his] property from his neighbour’s [property].”

The police trespassed on an neighbour’s rural property to conduct surveillance, and they heard gunshots and saw two individuals with rifles outside of the appellant’s house. Based on these observations, the police obtained a warrant to search the appellant’s house. They ultimately secured one or more convictions on drug and weapons charges.

The Court held, that in the context, it did not matter that the police were trespassing. (The gunshots were loud, and the appellant’s property was abutted by a public road in any event.) It also held that the police did not obtain “personal information,” reasoning as follows:

What triggered the application for the first warrant was the sound of the discharge of a firearm – something that could scarcely be concealed – coupled with visual observations of persons outdoors either firing a rifle or holding a rifle. These were bare observations of physical acts. There was no personal information obtained.

This illustrates how the personal information concept is not as simple, and perhaps not as broad, as one might think. The facts observed clearly allowed the police to infer what was in the house and obtain, on the reasonable and probable grounds standard, a search warrant. Nonetheless, the Court held that the observations did not invite a collection of personal information.

R v Roy, 2020 ONCA 18 (CanLII).

Ont CA majority says no Charter right to text in private

In a case that speaks to the bounds of digital privacy, the Court of Appeal for Ontario recently held that a text message sender has no reasonable expectation of privacy in text messages stored on a recipient’s phone.

Text messaging is a unique form of communication. To text certainly invites the feeling of engaging in a private conversation, but a sender’s texts are received by another person who typically has no duty of confidence and who has exclusive control of the “inbox” in which the texts are invariably left to reside. Like digital messages of all kinds, once sent, a text message is beyond control.

The question for courts in these matters is a normative one – what ought to be treated as private in our society? – so the loss of control over information does not necessarily invalidate a Charter-based privacy claim. Nonetheless, there’s a real practical consequence to the loss of control that Courts must reckon with. If they do not, we risk unduly restricting the free flow of information and free expression. Privacy is always a matter of striking an appropriate balance.

The Court issued its balance-striking judgement about text messaging on July 8th. Justice MacPherson wrote for the majority that denied privacy protection, and held that control was of “central importance” in the context. He wrote:

The facts of this case demonstrate that, unlike in Spencer and Cole, the ability to control access to the information is of central importance to the assessment of the privacy claim. We are not talking about the appellant’s privacy interest in the contents of his own phone, or even the contents of a phone belonging to someone else, but which he occasionally used. We are also not dealing with deeply personal, intimate details going to the appellant’s biographical core. Here, we are talking about text messages on someone else’s phone that reveal no more than what the messages contained – discussions regarding the trafficking of firearms.

This is far from being a question of whether the appellant had “exclusive control” over the content. He had no ability to regulate access and no control over what Winchester (or anyone) did with the contents of Winchester’s phone. The appellant’s request to Winchester that he delete the messages is some indication of his awareness of this fact. Further, his choice over his method of communication created a permanent record over which Winchester exercised control.

It has never been the case that privacy rights are absolute. Not everything we wish to keep confidential is protected under s. 8 of the Charter. In my view, the manner in which one elects to communicate must affect the degree of privacy protection one can reasonably expect.

Justice Laforme dissented – clearly differing from the majority on the importance of control, citing numerous cases in which the loss of control has not precluded the recognition of a Charter-protected privacy interest, stressing that privacy is a normative concept and in general ascribing great value to texting in private.

While the debate between majority and minority about the significance of control and standing to raise section 8 of the Charter is important, the majority and minority do not differ by much in principle. Where they clearly do differ is on the value they ascribe to text messaging. To start with the minority, Justice Laforme says texting is the “modern version of a conversation,” and is nearly romantic about it: “In my view, these private communications are an increasingly central element of the private sphere that must be protected under s. 8.” Justice MacPherson, in contrast, has no interest in constitutionalizing texting. In a humorous and effective appeal to authority, he links to the Ontario health and physical education curriculum, under which we teach 12-year-olds across the province, “If you do not want someone else to know about something, you should not write about it or post it.” This, of course, dovetails with Justice MacPherson’s important point about electing how to communicate. To people older than 12, we typically say something like, “You want privacy, pick up the phone.”

R. v. Marakah, 2016 ONCA 542 (CanLII).

No reasonable expectation of privacy in bad breath

On January 7th, the Ontario Superior Court of Justice overturned a trial decision that had recognized a Charter-protected expectation of privacy in the odour emanating from one’s breath. A doctor who had treated the accused following a motor vehicle accident told a police officer that the accused’s breath smelled of alcohol, following which the police obtained an warrant to seize a blood sample. The Court also noted that the doctor was not acting as a state agent in making his observation and reporting to the police.

R v Maureen Daly, 2014 ONSC 115 (CanLII).