LAWPRO Magazine archive: Personal information and privacy – Where are the boundaries?
This article by Simon Chester of Heenan Blaikie LLP is from the Winter 2007 “Aging Boomers” edition of LAWPRO Magazine. All past LAWPRO Magazine articles can be found at www.lawpro.ca/magazinearchives
An earlier article on privacy (see www.lawpro.ca/LawPRO/privacy.pdf) raised the possibility that a law firm might find itself the subject of a Privacy Commissioner’s investigation. A recent finding of the federal Privacy Commissioner not only drives this home, but also has implications for Ontario lawyers.
On May 2, 2006, the Privacy Commissioner of Canada released its first findings concerning the business activities of law firms. The cases involved two law firms which obtained consumer credit reports on individuals from credit bureaus, as part of their litigation preparation. The lawyers had hoped that the credit reports would reveal whether a potential party was worth suing and would assist in a dispute involving the law firm’s clients.
The law firms hadn’t reckoned with the fact that they could be considered to have breached their contract with the consumer reporting agency, and violated the Ontario Consumer Reporting Act and the Federal Personal Information Protection and Electronic Documents Act.
By the time the Privacy Commissioner’s finding was released, thelaw firm’s consumer reporting agency membership had been cancelled, and the provincial Registrar of Consumer Reporting Agencies had conducted an inconclusive complaint investigation.
The Privacy Commissioner asserted its jurisdiction and argued that the firms had both collected personal information on individual’s without their consent and without fitting into any of the exemptions provided for in the legislation.
Initially neither firmtook the Privacy Commissioner’s investigations terribly seriously. It took a threat by the Commissioner’s litigation counsel to take the matter to the Federal Court before the firms agreed to implement the findings. The fact that the firms backed down left some of the jurisdictional issues unsettled.
The findings make sobering reading. The Commissioner found that in doing the credit check, the firms had collected personal information without the consent of the subject. The firms could not point to any applicable exemption in the Act. They had breached federal law.
The finding ended with recommendations that the firms implement a policy to ensure consent when obtaining consumer reports or conducting other background checks.
Privacy experts are scratching their heads about the finding since it seems to apply broad language under federal law to override detailed provincial law establishing the specific circumstances under which credit reports can be lawfully obtained. The findings can’t easily be squared with the 2004 Superior Court decision in Ferenczy v. MCI Medical Clinics, dealing with video surveillance of a personal injury plaintiff.
Nevertheless, the fact that the firm’s jurisdictional arguments cut no ice with the Commissioner is worth noting. We can hope that Parliament’s current review of the federal Act or future court decisions clarify how the issues of competing federal and provincial statutes should be resolved. It should be noted that there are significant differences of opinion on this matter, especially regarding how far the process of civil litigation will be affected by federal privacy legislation (see, for example, PIPEDA Case Summary #352: “Airline delays granting access to personal information, citing ongoing litigation”).
On one side, this federal legislation is limited in the extent to which it can regulate property and civil rights, given that it was arguably enacted as an extension of the federal trade and commerce power. But on the other side, the Supreme Court of Canada has begun to afford privacy a quasi-constitutional status. Either way, re-characterizing legal professional privilege is not a trivial matter.
But that sort of interpretive wrangle should not detract from the serious impact of the findings. What should Ontario lawyers do?
- Prudence suggests rereading your membership contract with the credit bureau, if you rely on the bureau to help you assess the credit worthiness of potential clients.
- Familiarize yourself with the Consumer Reporting Act, and the provisions under which you can access credit information.
- Review the Personal Information Protection and Electronic Documents Act, and in particular Schedule 1, and train your lawyers to recognize the obligations it imposes.
- Treat any investigation by the Privacy Commissioner seriously. While the two law firms weren’t named, it’s clear that they both initially rebuffed the enquiry and then backed down.
- Recognize that in today’s technologically-empowered practice, privacy will become an increasingly serious concern. Better to get your firm ahead of the law.
LAWPRO has a generic policy, which you can use as a precedent and checklist to guide you as you examine your own firm’s procedures for dealing with confidential information. The policy deals with a fictitious firm called Smith & Partners. It is available at www.practicepro.ca/privacypolicy.