Privacy laws and litigation

Focus on Privacy

Fall 2004

Canadian Privacy Law and Litigation:[1]

Ontario Court canvasses the effect of privacy laws on discovery
and the meaning of “commercial activities” in PIPEDA

David T.S. Fraser – david.fraser@mcinnescooper.com

Most privacy law practitioners expected that the year 2004 would bring a torrent of findings from the Office of the Privacy Commissioner once the Personal Information Protection of Electronics Documents Act, S.C. 2000, c.5 (“PIPEDA”) became fully applicable to the collection, use and disclosure of personal information in the private sector. While the Commissioner’s Office struggles through its backlog, the civil courts have been a rather productive area for consideration of PIPEDA.

One of the more recent cases emerging from the courts relating to PIPEDA is that of Clustercraft Jewellery Manufacturing Co. Ltd. v. Wygee Holdings Ltd., [2004] O.J. No. 2877 (QL). The case relates to the alleged non-delivery of a quantity of diamonds to Clustercraft. The respondent, Wygee Holdings Ltd., sought information related to employees of Clustercraft who may have been able to shed light on the allegedly missing diamonds. Clustercraft’s witness resisted the questions on the basis that it was not able to disclose the information due to the constraints of PIPEDA.

A Master of the Ontario court ordered that Clustercraft answer the questions put to it related to the employees, an order that was appealed to Justice Ducharme. At the appeal, Clustercraft claimed that information related to employees and former employees should not be compelled because it was not relevant and, it was argued, the company was prohibited from doing so without the consent of the employees due to PIPEDA.

In the brief reasons for the order, Justice Ducharme concluded that the information not only crossed the relevance threshold but could not be shielded from disclosure by PIPEDA due to the application of s. 7(3)(c) of that Act.

The general rule, in circumstances where PIPEDA applies, is that personal information can only be collected, used and disclosed with the knowledge and consent of the individual, subject to enumerated exceptions. One of those exceptions is applicable to the litigation context. Section 7(3)(c) of PIPEDA provides:

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is …

(c) required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;

Though the applicable Rules of Civil Procedure are generally seen as sufficient to engage the operation of this subsection, Justice Ducharme concluded, at paragraph 9:

At a minimum, the order of Master Albert is an order made by a court with jurisdiction to compel the production of information. Thus, this submission of the Appellant also fails.

The Clustercraft case confirms that where “personal information” that is otherwise protected by PIPEDA is relevant and producible in the course of litigation, PIPEDA will not act as a shield to prevent its disclosure.

An additional aspect of this case that does not appear to have been discussed by the parties or the Court is whether PIPEDA would be applicable to the information in the first place. The information being sought by the Respondents related to Clustercraft’s present and past employees. Though there has not been extensive judicial comment on this point to date, the language of PIPEDA suggests that employee information of businesses such as Clustercraft is beyond the Act’s purview.

The application section of PIPEDA, section 4, provides:

4. (1) This Part applies to every organization in respect of personal information that

(a) the organization collects, uses or discloses in the course of commercial activities; or

(b) is about an employee of the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.

The law applies to commercial activities (except in those provinces where local legislation is declared to be “substantially similar”) or information about employees of the federally regulated private sector. Unless Clustercraft is a “federal work, undertaking or business”, PIPEDA would not preclude the collection, use or disclosure of its employees’ personal information, for litigation or any other purpose.