A recent federal court decision to overturn one of the Privacy Commissioner of Canada‘s first findings under the country’s privacy act has raised questions about how well the Commissioner can enforce the law.
a Vancouver-based lawyer who brought a complaint against Telus minutes after the act came into effect four years ago, won a partial victory last November, when an appeals court said Telus did not go to sufficient lengths to inform him of how telephone directory listings could be used. The complaint involved both the issue of consent (over whether his phone number should be listed in the white pages) and whether Telus should be allowed to charge a $2 fee to keep his number unlisted. The complaint was the first made under the Personal Information Protection and Electronic Documents Act (PIPEDA).
According to Englander, Telus’s listing policy meant his personal information could be packaged on CD-ROMs and sent to telemarketers, political parties and charities. But George Radwanski, who at the time served as the Privacy Commissioner of Canada, concluded the complaint was not well-founded. He also said it passed the act’s Reasonable Person test, which states the “”collection, use and disclosure of personal information must be limited to purposes that a reasonable person would consider appropriate in the circumstances.”” The federal court agreed, but an appeals court overturned those decisions, ordering Telus to reimburse Englander the nearly $12,000 he paid in costs after losing the earlier Federal Court decision.
The about-face comes as the Office of the Privacy Commissioner tries to rebuild its reputation following the disgrace and resignation of Radwanski over his spending habits. Jennifer Stoddart was appointed as Radwanski’s replacement last year.
Michael Geist, Canada research chair in Internet and E-Commerce Law at the University of Ottawa, said there was a danger that the Englander case could mean citizens and corporations give the Commissioner’s findings far less weight than they did initially. They may decide, for example, that the findings aren’t enforceable, and more complaints will be taken to the courts instead.
“”People were looking to see whether the law had any teeth,”” he said. “”This may turn out to be a case of: ‘Be careful what you wish for, you just might get it.'””
Geist and others were commenting on the Englander case Tuesday as part of a teleconference hosted by Synomos Inc.
Heather Black, assistant privacy commissioner of Canada, said the Commissioner’s Office had concluded that the fee for an unlisted number was established by the CRTC, and fell under the regulator’s jurisdiction, and the CRTC does take privacy into account. As for consent, “”it could have been better in terms of a more positive statement, in terms of ‘Do you want to be listed?'”” she said.
Consent gets more complicated when information is obtained legally but then used for secondary purposes, said Patricia Wilson, a partner in the litigation group of Osler, Hoskins & Harcourt. What many organizations have done is to collect information in order to provide a service or complete the sale, and then inform customers of the secondary purpose.
“”What the federal court seems to have said is that provision of notice in that fashion could be too late in order to establish a valid business consent,”” she said. “”However, the danger in this case is that reasoning of the federal court . . . would be applied in other business contexts, where this is that opportunity to further communicate.””
A real question in the case, Wilson said, is whether it’s up to the Privacy Commissioner — or the courts — to be prescriptive and direct about what kind of notice companies like Telus should provide customers. Englander is arguing they should, she said, while Telus has said it needs more flexibility.
“”That level of remedial authority is in PIPEDA. What the court does with that will be really interesting,”” she said.
Geist said many in the privacy community are “”reading the tea leaves”” to see how the Commissioner’s findings will influence the way Canadians adhere to PIPEDA.
“”We do need, in my view, a very strong central view to privacy,”” he said.
The Office of the Privacy Commissioner is in the process of conducting a comprehensive follow-up on every recommendation it has ever made, Black said, and is working with the courts on cases like Englander’s.
“”That Englander may change the whole landscape and ignore the commissioner without impunity — I sincerely doubt that,”” she said. “”Trying to decipher what impact decisions are going to have on PIPEDA is kind of like trying to decipher chicken entrails.””
Englander and Telus are still waiting to hear the court’s remedy for the case. According to a posting on his Web site, Englander said he submitted his recommendations on Dec. 24, and Telus on Dec. 15.