Federal Court on biometric voice authentication: Turner v. Telus Communications Inc.

The Federal Court has recently released its decision in the application made by certain employees of Telus Communications, complaining about the use of voice recognition technology for some of its internal management systems. (For more info, see my post on the original complaint: The Canadian Privacy Law Blog: PIPEDA Case Summary #281: Organization uses biometrics for authentication purposes.)

A group of employees refused to consent to the use of the technology and were threatened by Telus with "progressive disclipline". The applicants (including the union) sought an order preventing the use of this system and for unspecified damages. Justice Gibson of the Federal Court dismissed the application.

The judge concluded:

• the use of biometric voice authentication in these cirucmstances is reasonable;
  
• the threat of progressive discipline is not withholding goods or services contrary to principle 4.3.3;
• the categories of consent exceptions ("except where inappropriate") may not be a closed list set out in Section 7; and
• an employer can implement progressive discipline for those who do not consent to collections, uses and disclosures of their information that are reasonable.

The judge also declined to order costs against the union or the individual applicants.

Below is a condensed version of the conclusion reached by Justice Gibson:

Turner v. Telus Communications Inc., 2005 FC 1601 (CanLII):

[52] On the facts of this matter, Telus sought to obtain voice prints from a substantial number of its employees and the vast majority of that number consented. Those who did not consent knew that Telus wished to obtain their consent. They continued to refuse to consent so that their consent could not be obtained in "...a timely way". They exercised their right to complain to the Commissioner. They received a report from the Commissioner which concluded that Telus' wish to obtain their consent was reasonable. The non-consenting employees exercised their right to come to this Court for a de novo review of the situation. Assuming that they will be unsuccessful in this Court, and they will be, it would not be in the interests of justice that a stalemate result.

[53] I am satisfied that this is one of the circumstances to which paragraph 7(1)(a) of PIPEDA is directed. While that paragraph will not enable Telus to proceed with full and complete implementation of e.Speak and to force employee enrollment, it will, I am satisfied, enable Telus to continue with the implementation of e.Speak at its current level and, if persons such as the Individual Applicants continue to withhold their consent, it will entitle Telus to proceed with "progressive discipline" in relation to all or any of them that is reasonable in all the circumstances.

[54] By contrast, I am satisfied that paragraph 7(1)(d) of PIPEDA is of no assistance to Telus in the current circumstances. While it is arguable that voice characteristics are "publicly available", that form of personal information is not specified by any regulations made under the authority of PIPEDA.

[55] If I am determined to be wrong in my analysis regarding the scope of paragraph 7(1)(a) of PIPEDA, there remains, I am satisfied, an alternative solution to the impasse that I perceive might flow from an absolute requirement to obtain consent from each and every individual affected. My analysis in that regard follows.

[56] It was not in dispute before the Court that three (3) of the Individual Applicants have never consented to take part in the Nuance Verifier enrollment process. While the fourth Individual Applicant did consent and did take part, he withdrew his consent as he was entitled to do under Principle 4.3.8.

[57] Counsel for the Individual Applicants urges that consent to disclosure of biometric personal information is a term or condition of employment and that, as such, given the collective agreement in force between Telus and TWU representing certain of its employees, including the Individual Applicants, even if the Individual Applicants had consented, that consent is of no force or effect since "...terms and conditions of employment must be negotiated with The Telecommunications Workers Union and that had not taken place in respect of the disclosures for which consent is sought in the context of this proceeding."

[58] Counsel for Telus urges that consent to the disclosure of the personal information here at issue is simply not a term or condition of employment and that therefore Telus' efforts to obtain consent directly from the Individual Applicants was entirely appropriate and TWU had no role to play regarding the consents.

[59] I accept the position urged on behalf of Telus in this regard. That being said, in circumstances where it is a matter of public knowledge that was clear to the Court, that the relationship between Telus and TWU on behalf of a significant number of Telus' employees was, at all relevant times, less than cordial, it was at least surprising and, perhaps more appropriately, astonishing, that Telus had apparently not engaged TWU in the process of attempting to achieve consents to the implementation of e.Speak.

[60] It was not in dispute before the Court that, while the three Individual Applicants had not consented to provide voice samples, and the fourth withdrew his consent, by far the vast majority of their colleagues at Telus in respect of whom Telus sought to implement e.Speak had consented and had provided voice samples for the purposes of Nuance Verifier. It was also not in dispute that one individual who had volunteered to provide a voice sample was incapable, for medical reasons, of fulfilling the appropriate requirements. In her case, special arrangements had been made to accommodate her situation. Finally, it was also not in dispute that, although Telus had "threatened", "progressive discipline" for those from whom it sought enrollment and who refused to consent to enrollment, no such discipline had been imposed and there was no evidence before the Court that such discipline would reach the level of dismissal, thus making the discipline imposed effectively reach to the level of a term or condition of employment.

[61] I am satisfied on the evidence before the Court that Telus was somewhat high handed in its efforts to achieve consent to enrollment and had been, since the commencement of the enrollment process, something less than forthcoming as to what it meant by "progressive discipline". That being said, I am satisfied that Telus was reasonably forthcoming in other respects in its consultations with its employees that it sought to enroll, that it was reasonably patient in that process and that, generally speaking, it neither bullied nor harassed its employees towards enrollment.

[62] The issue then reduces itself to the question: "What are the implications where Telus fails to achieve consent from a small minority of affected employees, such as the Individual Applicants, to enrollment in the e.Speak programme, where implementation of "progressive discipline" for failure to consent is not only implied but expressed, and where there is absolutely no evidence before the Court that Telus will escalate such "progressive discipline" to the point of termination, thus effectively making consent a term or condition of employment?

[63] I am satisfied that the foregoing question remains an issue for another day. Telus has, to a very large extent, implemented e.Speak. A very small minority, perhaps only the Individual Applicants, but perhaps also others, remain principled hold-outs. There is no basis on which to conclude that "progressive discipline" that might be implemented against hold-outs will reach the level of termination. To this point, I adopt the urgings of counsel for Telus that Telus has simply engaged, in what it considers to be the best interests of its business and, thus, arguably of its employees, including the Individual Applicants, in the exercise of its residual management rights. I cannot conclude that the obligation on the part of Telus to obtain consent to the implementation of the e.Speak system, in respect of the Individual Applicants, precludes Telus from implementing that system in respect of the vast majority of its employees to which it wishes to make the e.Speak system applicable.

[64] Counsel for the Individual Applicants cites Principle 4.3.3 against the conclusion I have reached in this regard. That principle, reproduced in the Schedule to these reasons, is reproduced here for ease of reference:

An organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purposes.

With great respect, I am not satisfied that Telus' efforts to achieve the consent of the Individual Applicants to participate in the e.Speak system is being sought as "...a condition of the supply of a product or service,...". In the result, while my conclusion in this regard does not affect the result herein, I am not satisfied that the Individual Applicants are entitled to rely on Principle 4.3.3 in respect of this matter.

[65] The foregoing being said, quite apart from my analysis regarding the interpretation of paragraph 7(1)(a), of PIPEDA, I nonetheless conclude that Telus has fulfilled its consent obligations under PIPEDA in respect of the implementation of e.Speak. In introducing e.Speak applicable only to those who consented to enrollment, Telus acted within its residual management rights. The impact of "progressive discipline" against the small minority who have withheld their consent, as they are entitled to do, is for another day and for another forum.

d) Additional issues raised on behalf of the Commissioner

[66] As earlier indicated in these reasons, counsel for the Commissioner raised issues including the appropriate weight to be given to the factors taken into consideration by the Commissioner in her Report leading to this proceeding, whether this Court should apply the legal analytical framework and factors considered by the Commissioner in balancing the interests of the parties as required by subsection 5(3) of PIPEDA, the role of TWU in the process of seeking consent from the Individual Applicants and the appropriate principles in assessing whether the Individual Applicants consented to the collection and use of their personal information.

[67] To some extent, these issues have been addressed, directly or indirectly, in the foregoing analysis. To the extent that they have not been so addressed, I am reluctant to respond to them because they indirectly invite the Court to answer questions that would only be appropriate if this matter were in the nature of judicial review. Where the foregoing issues have not been addressed, the Court's response is that it must be guided by jurisprudence from the Federal Court of Appeal and where no such guidance exists, by guidance provided by other decisions of this Court in an appropriate context and, further, where that guidance is also lacking, the Court must act in accordance with what it, itself, considers to be required by PIPEDA. Put another way, and more briefly, it is not for the Commissioner, however knowledgeable and informed she or he might be with respect to the issues here coming before the Court, to set the agenda of this Court where hearings such as this are in the nature of de novo proceedings.

[68] In the result, I decline to address the issues raised on behalf of the Commissioner, to the extent that they have not already been addressed in these reasons.

CONCLUSION

[69] These applications will be dismissed. As earlier indicated, orders will go striking out The Telecommunications Workers Union as a party Applicant in each proceeding."

Jurisdictional limitations on Canadian privacy law

Canada's privacy law is already hobbled by the constitutional division of power. For example, as a federal law, it cannot apply to the provincially regulated workplace. But, theoretically, it can apply outside of Canada's border. This has been the theoretical position of officials from the Office of the Privacy Commissioner. However, when dealing with an actual complaint, the Commissioner did not extend the federal privacy law to an organization entirely outside of Canada.

Michael Geist, in his weekly Toronto Star Column, reports on an as-of-yet unpublished finding of the Commisioner that concludes that the law cannot regulate the use of Canadian personal information that is in the hands of an organization that has no presence in this country:

TheStar.com - CIBC breach spotlights hole in privacy law:

"...According to a recent unpublished letter from the privacy commissioner, the answer is unfortunately no. The Commissioner has adopted the position that Canada's privacy legislation stops at the border and that her office does not have the power to investigate companies that do not have a physical presence in Canada.

The letter was issued in response to a complaint launched by the Canadian Internet Policy and Public Interest Clinic (CIPPIC) against Abika.com, a U.S. company that harvests databases and public reports. The company uses the information to produce reports that allegedly include, in some cases, psychosexual profiles. CIPPIC filed its complaint in June, claiming that Abika collects, uses, and discloses the personal information of Canadians without their consent in violation of Canada's national privacy law.

The privacy commissioner's office responded privately to Canadian Internet Policy and Public Interest Clinic two weeks ago. It noted that the company does not have a physical presence in Canada and therefore concluded that 'while the organization may well be collecting information on Canadians, our legislation does not extend to investigating organizations located only in the United States. We are, therefore, unable to investigate this matter under PIPEDA' (the Personal Information Protection and Electronic Documents Act, Canada's national privacy law that governs how businesses collect and use personal information)...."

I tend to agree with Michael ... the Privacy Commissioner could have asserted jurisdiction and then dealt with the challenges of enforcement. This would at least have left the complainant with the ability to take the finding to the Federal Court of Canada to see if a real remedy could be fashioned.

Under traditional principles of international law, there are six bases on which a country such as Canada can assume jurisdiction to proscribe the actions of individuals and companies. (In most cases, these principles have arisen in the criminal law context but there is no reason to believe the Canadian courts would not apply them.) Four of the bases for jurisdiction are relevant to this discussion:

• Territorial Principle – A state has the jurisdiction to regulate individuals and subjects within its territory, including internal waters and airspace. This is the primary and most universal base for jurisdiction.
  
• Nationality Principle – Civil law countries have traditionally asserted jurisdiction over their nationals, regardless of where they may be located.
  
• Passive Personality Principle – States have assumed jurisdiction over crimes committed abroad against its nationals.
  
• By Agreement – A country may, by agreement, grant another country jurisdiction over certain persons or subjects within its borders.

Traditionally, the territorial principle has been the most persuasive and widely applied. This is based on the fundamental principle of international sovereignty that a state has absolute jurisdiction over "all persons, citizens and aliens alike, and things within its territory."

The Supreme Court of Canada’s decision in Libman v. The Queen is the leading Canadian authority on the issue of how and when a Canadian court may assert jurisdiction. Libman dealt with a "telemarketing scam" where the calls originated from Canada but were made to residents of the United States. Justice LaForest, who delivered the judgment of the unanimous court, recited the relevant facts:

3 During the period covered by the informations, Mr. Libman operated a telephone sales solicitation room (or "boiler room") at 43 Menin Road in Toronto, where a number of individuals were employed as telephone sales personnel. Pursuant to Mr. Libman's directions the sales personnel telephoned United States residents and attempted to induce them to purchase shares in two companies, Hebilla Mining Corporation and Claravella Corporation, which purported to be engaged in gold mining in Costa Rica. In addition to the telephone representations, the United States residents also received promotional material which was mailed from Panama City, Panama and San José, Costa Rica by associates of Mr. Libman.

4 The telephone sales personnel, on the direction of Mr. Libman, made material misrepresentations with respect to their identity, where they were telephoning from, and the quality and value of the shares they were selling. As a result of these misrepresentations, a large number of United States residents were induced to purchase shares in the two mining companies. There was some evidence tendered at the preliminary inquiry from which it could be inferred that these shares were virtually worthless.

5 The United States residents who agreed to purchase shares were told by the telephone sales personnel to send their money to offices operated by Mr. Libman's associates in either San José, Costa Rica or Panama City, Panama. There was evidence tendered that Mr. Libman went to a location outside Canada, usually Costa Rica or Panama, to meet with his associates and receive his share of the proceeds of the sale of the shares. Mr. Libman then brought this money back to Toronto and distributed a portion of it to his sales personnel. There was also evidence tendered at the preliminary inquiry with respect to the wire transfer of monies from Panama City to Mr. Libman in Toronto.

The appellant, Mr. Libman, was charged in Canada with fraud under the Criminal Code. In his defence, the appellant argued that Canada did not have the jurisdiction to prosecute him for the offence as the deprivation of the victim is the essential element of the offence and, if it did occur at all, it did not occur in Canada.

Justice LaForest began with the essential principle of territorial jurisdiction:

11 The primary basis of criminal jurisdiction is territorial. The reasons for this are obvious. States ordinarily have little interest in prohibiting activities that occur abroad and they are, as well, hesitant to incur the displeasure of other states by indiscriminate attempts to control activities that take place wholly within the boundaries of those other countries; see R. v. Martin, [1956] 2 All E.R. 86, at p. 92. … As well, along with other types of protective measures, states increasingly exercise jurisdiction over criminal behaviour in other states that has harmful consequences within their own territory or jurisdiction; see The Lotus (1927), P.C.I.J., Ser. A., No. 10. It follows from this that the same criminal act may occasionally be subject to prosecution in more than one country, a matter to which I shall refer from time to time.

The analysis is relatively straightforward where all the elements and effects of an alleged offence are within the bounds of the prosecuting state: Territorial and subject matter jurisdiction unambiguously provide that state with sufficient grounds to assert jurisdiction. In fact, it would be difficult for another state to attempt to exert jurisdiction. Matters become much more complicated when transnational activities are in question:

16 The cases reveal several possibilities, of which I mention a few. One is to assume that jurisdiction lies in the country where the act is planned or initiated. Other possibilities include the place where the impact of an offence is felt, where it is initiated, where it is completed, or again where the gravamen, or essential element of the offence took place. It is also possible to maintain that any country where a substantial or any part of the chain of events constituting an offence takes place may take jurisdiction.

17 Though counsel for Mr. Libman argued that exclusive jurisdiction belongs to the country where the gravamen of the offence took place or where it was completed, a review of the English authorities does not really support that position. What it shows is that the courts have taken different stances at different times and the general result, as several writers have stated, is one of doctrinal confusion, a confusion compounded by the fact that the discussion often focuses on the specific offence charged, a discussion made more complicated by the further fact that some offences are aimed at the act committed and others at the result of that act.

After surveying the threads of English and Canadian jurisprudence, LaForest J. concluded that a Canadian court may assert jurisdiction in circumstances where there is a "real and substantial link" between the offence and Canada:

74 I might summarize my approach to the limits of territoriality in this way. As I see it, all that is necessary to make an offence subject to the jurisdiction of our courts is that a significant portion of the activities constituting that offence took place in Canada. As it is put by modern academics, it is sufficient that there be a “real and substantial link” between an offence and this country, a test well-known in public and private international law; see Williams and Castel, supra; Hall, supra. As Professor Hall notes (p. 277), this does not require legislation. It was the courts after all that defined the manner in which the doctrine of territoriality applied, and the test proposed simply amounts to a revival of the earlier way of formulating the principle. It is in fact the test that best reconciles all the cases. The only ones that do not fall within it are those like Harden and Rush which, in my view, should no longer be followed.

75 That this approach is attuned to modern times is evident from the fact that some variant of it has been recommended by numerous law reform bodies or adopted in legislation…

76 Just what may constitute a real and substantial link in a particular case, I need not explore. There were ample links here. The outer limits of the test may, however, well be coterminous with the requirements of international comity.

77 As I have already noted, in some of the early cases the English courts tended to express a narrow view of the territorial application of English law so as to ensure that they did not unduly infringe on the jurisdiction of other states. However, even as early as the late 19th century, following the invention and development of modern means of communication, they began to exercise criminal jurisdiction over transnational transactions as long as a significant part of the chain of action occurred in England. Since then means of communications have proliferated at an accelerating pace and the common interests of states have grown proportionately. Under these circumstances, the notion of comity, which means no more nor less than “kindly and considerate behaviour towards others”, has also evolved. How considerate is it of the interests of the United States in this case to permit criminals based in this country to prey on its citizens? How does it conform to its interests or to ours for us to permit such activities when law enforcement agencies in both countries have developed cooperative schemes to prevent and prosecute those engaged in such activities? To ask these questions is to answer them. No issue of comity is involved here. In this regard, I make mine the words of Lord Diplock in Treacy v. Director of Public Prosecutions cited earlier. I also agree with the sentiments expressed by Lord Salmon in Director of Public Prosecutions v. Doot, supra, that we should not be indifferent to the protection of the public in other countries. In a shrinking world, we are all our brother's keepers. In the criminal arena this is underlined by the international cooperative schemes that have been developed among national law enforcement bodies.

78 For these reasons, I have no difficulty in holding on the facts agreed upon for the purpose of this appeal, that the counts of fraud with which the appellant is charged may properly be prosecuted in Canada, and I see nothing in the requirements of international comity that would dictate that this country refrain from exercising its jurisdiction. Since these fraudulent activities took place in Canada, it follows for the reasons set forth in the Chapman case that the conspiracy count may also be proceeded with in Canada.

It goes without saying that the evolving adoption of privacy and data protection laws are not identical to criminal law, either domestically or internationally. However, analogies are easily made and there is an evolving international cooperative scheme, beginning with the OECD Guidelines.

As the basis for Canada to claim jurisdiction requires a "real and substantial link" between the activity and Canada, one must consider whether the collection of personal information about Canadians by foreign companies would be considered to provide a "real and substantial link" to Canada or the collection of information about non-Canadians by a Canadian company. The facts in Libman are sufficiently analogous to provide authority for the proposition that a court on review would likely find a “real and substantial link” between such activities and Canadian jurisdiction, notwithstanding any argument that the connection is de minimis.

The Personal Information Protection and Electronic Documents Act sets out, at Section 4, the basis of its application:

Application

4. (1) This Part applies to every organization in respect of personal information that

(a) the organization collects, uses or discloses in the course of commercial activities; or

(b) is about an employee of the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.

Limit

(2) This Part does not apply to

(a) any government institution to which the Privacy Act applies;

(b) any individual in respect of personal information that the individual collects, uses or discloses for personal or domestic purposes and does not collect, use or disclose for any other purpose; or

(c) any organization in respect of personal information that the organization collects, uses or discloses for journalistic, artistic or literary purposes and does not collect, use or disclose for any other purpose.

Other Acts

*(3) Every provision of this Part applies despite any provision, enacted after this subsection comes into force, of any other Act of Parliament, unless the other Act expressly declares that that provision operates despite the provision of this Part.

The application section is entirely silent with respect to its intended territorial application. The only reference to specific jurisdictions are contained in the transitional provisions and the definition of "federal work, undertaking or business". The transition provisions begin with Section 30:

DIVISION 5

TRANSITIONAL PROVISIONS

Application

30. (1) This Part does not apply to any organization in respect of personal information that it collects, uses or discloses within a province whose legislature has the power to regulate the collection, use or disclosure of the information, unless the organization does it in connection with the operation of a federal work, undertaking or business or the organization discloses the information outside the province for consideration.

Application

(1.1) This Part does not apply to any organization in respect of personal health information that it collects, uses or discloses.

Expiry date

*(2) Subsection (1) ceases to have effect three years after the day on which this section comes into force.

*[Note: Section 30 in force January 1, 2001, see SI/2000-29.]

Expiry date

*(2.1) Subsection (1.1) ceases to have effect one year after the day on which this section comes into force.

*[Note: Section 30 in force January 1, 2001, see SI/2000-29.]

These provisions are temporary (and expired on January 1, 2004), as they assist with the gradual implementation of the legislation, providing individual provinces with the ability to put in place substantially similar legislation during the period in which the law only applies to the federally regulated private sector and cross-border sales of information. It may be notable that the cross-border reference says "outside the province" and not "to another province".

In the absence of clear guidance from the statute, one can interpret it to apply in all circumstances where there exists a "real and substantial link" to Canada, following the Supreme Court's guidance in Libman. In any event, there is nothing in the statute that would prevent Canada from assuming jurisdiction in the circumstances set out above.

In the past, Officials with the Office of the Privacy Commissioner have advised that the Commissioner likely would assume jurisdiction where the collection of personal information is about Canadians or Canadian residents or where the collection originates in Canada. This appears to no longer be the case. Not only would the collection take place "in Canada", the Commissioner’s office used to be of the view that PIPEDA is part of an international scheme of privacy protection that could reach over borders.

The Privacy Commissioner has an arguable basis to make this second assertion and assume jurisdiction. As mentioned above, Canada implemented PIPEDA following the OECD Guidelines and in light of threatened restrictions on cross-border data flows caused by the EU Directive. Recital 20 of the EU Directive reads:

(20) Whereas the fact that the processing of data is carried out by a person established in a third country must not stand in the way of the protection of individuals provided for in this Directive; whereas in these cases, the processing should be governed by the law of the Member State in which the means used are located, and there should be guarantees to ensure that the rights and obligations provided for in this Directive are respected in practice;

The EU Directive is implemented, for example, in the United Kingdom's Data Protection Act 1998, which provides that the statute would apply, for example, if a call centre contacting Canadians were located in the United Kingdom:

Application of Act.

5. - (1) Except as otherwise provided by or under section 54, this Act applies to a data controller in respect of any data only if-

(a) the data controller is established in the United Kingdom and the data are processed in the context of that establishment, or

(b) the data controller is established neither in the United Kingdom nor in any other EEA State but uses equipment in the United Kingdom for processing the data otherwise than for the purposes of transit through the United Kingdom.

(2) A data controller falling within subsection (1)(b) must nominate for the purposes of this Act a representative established in the United Kingdom.

(3) For the purposes of subsections (1) and (2), each of the following is to be treated as established in the United Kingdom-

(a) an individual who is ordinarily resident in the United Kingdom,

(b) a body incorporated under the law of, or of any part of, the United Kingdom,

(c) a partnership or other unincorporated association formed under the law of any part of the United Kingdom, and

(d) any person who does not fall within paragraph (a), (b) or (c) but maintains in the United Kingdom-

(i) an office, branch or agency through which he carries on any activity, or

(ii) a regular practice;

and the reference to establishment in any other EEA State has a corresponding meaning.

While Canada is obviously not bound by the EU Directive, it appears to be the spirit of PIPEDA that the Canadian law fit within this general scheme of international data protection.

This may be academic, as this no longer appears to be the position of the Office of the Privacy Commissioner.

FCA hands privacy victory to the "little guy"

Sorry for the light (read: non-existent) blogging over the last few days. I've finally gotten to an internet connection ....

Mathew Englander e-mailed me the other day to say that the Federal Court has rendered their decision in his fight against Telus. I haven't read the full reasons, which should be available here soon, but all reports suggest that Telus did not persuade the Federal Court of Appeal to uphold the finding of the Privacy Commissioner and the Federal Court, Trial Division. I haven't found any free coverage online, but here is an extract of an article from the Calgary Herald.

Little guy wins privacy fight against giant Telus.


Canwest News Service

Saturday, November 20, 2004

Byline: Sarah Staples

In a victory for the little guy, a federal appeals tribunal has ruled
unanimously that Telus Communications Inc. must go to greater lengths to
get its customers' approval before reselling their personal information
to telemarketers and others.

``There is no evidence that Telus made any `effort,' let alone a
`reasonable' one . . . to ensure that its first-time customers are
advised of the secondary purposes (of their personal information) at the
time of collection,'' wrote Justice Decary on behalf of his colleagues
in the decision released this week.

The case is the result of a protracted battle by Mathew Englander, a
lawyer and Vancouver resident, with the phone company since 2001.

Englander argued Telus breaks new federal privacy rules by not informing
customers when they sign up for service that it repackages telephone
directory listings into CD-ROMs and machine-readable lists and sells
them to telemarketers, charities and political parties.

Minutes after the Personal Information Protection and Electronic
Documents Act (PIPEDA) was enacted on Jan. 1, 2001, Englander became the
first Canadian to lodge a formal complaint to the federal privacy
commissioner under the new law.

His arguments were rejected, first by the commissioner and later by a
Federal Court judge in a ruling last June. But the Federal Court of
Appeals reversed those earlier decisions this week, saying Telus didn't
go far enough to make Englander understand his privacy rights.

Telus has been ordered to reimburse Englander the nearly $12,000 he paid
in costs after losing the earlier Federal Court decision.

Experts following Englander v. Telus said the ruling sets positive early
precedents, defining the legal obligations of business at a time when
consumers' expectation of privacy is under siege.

PIPEDA theoretically gives Canadians the right to scrutinize innumerable
bits of data collected about them by customer service reps, squirreled
into computerized cash registers, and revealed to creditors, doctors and
employers. It also warns companies to seek permission before using those
details. But the law frames the issues broadly, leaving it to the courts
to resolve what crucial notions, such as ``informed consent,'' will mean
in practice.

``There are huge costs to industry in attempting to inform the public.
Nevertheless, we've moved so far into an age of technology that people
don't understand what they're agreeing to,'' said Stephanie Perrin, a
consultant and former federal civil servant who was one of the authors
of PIPEDA.

``This gives us a first interpretation of what a person can reasonably
be expected to understand.''

Englander called the ruling ``an interpretation such that people can
make their own decisions about how their information will be used.

``That's what privacy is about,'' he said in a telephone interview.
``It's not only keeping things secret, it's giving individuals the right
to decide what stays confidential and what does not.''

Englander's win is a partial victory: the appeals court denied his
attempt to stop Telus from charging customers $2 a month for unlisted
service a fee that adds $5.96 million annually to the company's coffers,
from roughly 250,000 unlisted telephone numbers in Alberta and B.C.,
according to affidavits.

The telco now has 60 days to offer suggestions for revamping its
policies to bring them into compliance with the privacy law. Any changes
negotiated with the federal appeals tribunal will be incorporated into
their final written judgment, to be issued at an unspecified later date.

Drew McArthur, VP of corporate affairs and privacy officer for Telus,
hinted his firm will argue any court-ordered changes should apply only
to new customers, and only involve ``the scripting for new customers
when they call in for service,'' as opposed to more elaborate and
expensive retraining for employees.

The spokesman said phone companies across Canada may be affected, and
added Telus is considering its options, including appealing all or some
parts of the decision to the Supreme Court of Canada.

One potential hot potato for the highest court is a question of
jurisdiction: the appeals tribunal apparently granted federal judges
``overlapping jurisdiction'' to rule on PIPEDA cases, whereas Telus
argued any decision on fees should be made exclusively by its regulator,
the CRTC.

Also, ironically, the tribunal denied Canada's privacy commissioner
deference in cases that come before the courts in future, arguing that
to do so would have given privacy advocates an unfair advantage over
business interests.

``I think it's now further education of how the court views the balance
of the privacy rights of individual versus the needs of businesses,''
said McArthur.

...

Federal Court of Appeal issues a declaration in the Englander case

According to Mathew Englander's website, the Federal Court of Appeal today issued its decision with respect to his remedy. There was no order issued, but the Court did declare that Telus had contravened PIPEDA. Stay tuned for a link to the decision and some commentary on it.

Mathew Englander, privacy advocate:

"UPDATE: On February 10, 2005 the Court issued its decision on remedy. The Court declined to order Telus to comply with the Act in future, but issued a judicial declaration that Telus had contravened the Act in the past.

The Court held that Telus has infringed PIPEDA in not informing its first-time customers, at the time of enrolment, of all the purposes for which their personal information is collected and in not informing them at that time of non-published number service. On the other issue, the Court held that the fee Telus charges does not infringe the Act.

This is the first time a court has ruled that an organization breached PIPEDA."

Update: Mathew has put the decision on his site at http://www.mathew-englander.ca/fca-order-09feb2005/

CIPPIC challenges Privacy Commissioner's denial of jurisdiction to investigate

As reported here some time ago, the Canadian Privacy Commissioner recently declined to investigate a US-based data broker on the basis of lack of jurisdiction (The Canadian Privacy Law Blog: Office of the Privacy Commissioner responds to complaint against US data-broker: No jurisdiction to investigate outside of Canada). Now, CIPPIC has announced it filed an application in the Federal Court on December 15, 2005 for judicial review of that decision. Should be interesting ...

See: CIPPIC News - CIPPIC.