While lawyers are generally aware that privacy legislation exits, not all are aware how, or even which legislation applies to any particular circumstance. For this reason, a request for disclosure of "personal information" can often set off alarm bells in a lawyer's head — and rightfully so.
"Privacy cases" represent but a tiny fraction of all those that may proceed to litigation. Nonetheless, privacy issues often arise in the context of examinations for discovery, even where the case is not a "privacy case." One such issue is whether an organization may, without offending privacy legislation, provide the names and contact information of former employees in the course of discoveries. What follows is a very broad overview of the subject.
Privacy legislation applies to "personal information." For present purposes, suffice it to say that "personal information" can include an individual's name and address.
The Personal Information Protection and Electronic Documents Act (PIPEDA), the federal privacy legislation that most lawyers are aware of, applies to the protection of personal information in the private sector (other statutes apply to personal information held by government). PIPEDA applies to two categories of personal information: information collected by organizations in the course of commercial activities (s. 4(1)(a)); and personal information collected by federally regulated organizations relating to their employees (s. 4(1)(b)). As becomes clear, PIPEDA applies to organizations that collect personal information — it does not apply to individuals so collecting. Once an organization has collected an individual's personal information, it can only disclose the information either with the individual's consent or if the statute provides an exception to consent.
In light of PIPEDA's application to "commercial activities," an organization cannot disclose, without consent or an exception, the personal information of, for example, its customers. This applies to both provincially and federally regulated organizations in the private sector, with the exception of organizations in British Columbia, Alberta, and Quebec. These latter organizations cannot so disclose based on provincially enacted privacy legislation that is substantially similar to PIPEDA and, as such, permits the provinces to opt out of PIPEDA. PIPEDA's application to employees' personal information is limited to federally regulated employers such as banks and airlines (though the courts have never specifically considered whether "employee" includes "former employee," there is some support for this in the case law).
A question that arises is whether the personal information of employees of a provincially regulated organization could nonetheless be deemed "personal information collected in the course of commercial activities." The simple answer is no — when reading ss. 4(1)(a) and 4(1)(b) together, the principle that "Parliament does not speak in vain" suggests that employee information is separate from information collected in the course of "commercial activities." A number of arbitral decisions have also so held (see for example, E.S. Fox Ltd., [2006] O.L.R.D. No. 107).
Saskatchewan, Manitoba, Ontario, the Maritime provinces, and the Territories have not adopted their own versions of PIPEDA. Accordingly, there is no legislative scheme in these jurisdictions that prevents a private-sector organization from disclosing contact information for employees or former employees. Indeed, the rules of court of the above jurisdictions, with the exception of those of Nova Scotia and Newfoundland and Labrador, specifically provide that on an examination for discovery a party is entitled to obtain the names and addresses of potential witnesses (see for example, r. 31.06(2) of Ontario's Rules of Civil Procedure).
As mentioned, the common law jurisdictions of Alberta and B.C. have enacted their own versions of PIPEDA. Sub-sections 4(5) and 3(4) of Alberta's and B.C.'s respective private-sector privacy acts (each named the "Protection of Personal Information Act") provide that the acts do not limit the information available by law to a party to a legal proceeding. The Alberta Privacy Commission, for its part, has expressly stated that parties to a proceeding have a right to disclosure of information relevant to their cases and that nothing in the provincial act affects that right. This general proposition is borne out in both Alberta and B.C. case law (see Peter Choate & Associates Ltd. v. Dahlseide [2014] A.J. No. 212, and Shilton v. Fassnacht [2006] B.C.J. No. 565). Thus, it appears that a party to litigation would not run afoul of B.C. or Alberta privacy legislation by providing contact information for employees (whether current of former), or customers, or business associates, provided that such information is relevant to the matters at issue in the lawsuit.
In light of the above, it appears that there is no prohibition against an organization providing the name and contact information for former employees in response to a request from same from another party in the course of discoveries. This makes sense in the circumstances. First, a party should not have to obtain a court order or conduct potentially lengthy investigations in order to contact those with information about the case. Second, while names and contact information are certainly "personal information," these are not intimate details of lifestyle and personal choices that must be kept under lock and key. While privacy is important, so too is the efficiency of the legal system and its processes.
Originally published in the May 30, 2014 issue of The Lawyers Weekly.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
