Copyright 2011, Blake, Cassels & Graydon LLP
Originally published in Blakes Bulletin on Privacy, May 2011
Organizations and consumers alike should take notice of the recent ruling from the Alberta Court of Appeal in Leon's Furniture Limited v. Alberta (Information and Privacy Commissioner), 2011, where the court held that it was reasonable under the Personal Information Protection Act (PIPA or the Act) for Leon's Furniture Limited to observe a policy of recording driver's licence information and licence plate numbers from persons picking up merchandise for the purpose of fraud prevention and investigation.
The Ruling in Leon's Furniture Limited v.
In 2006, a customer purchased a table from the appellant, Leon's Furniture Limited The customer paid a deposit and told the appellant's staff that her mother would be coming back to pick up the table. The next month, the customer's mother arrived to pick up the table. To take delivery of the table, the customer's mother was required to produce her driver's licence. Despite her objection, the sales clerk recorded her driver's licence number. The appellant observed this policy as a fraud prevention and investigation tactic and had measures in place to protect the information which was not stored in a computer system. At the loading dock, the customer's mother was asked to record the vehicle licence plate number of her car. She objected but complied. The customer's mother subsequently filed a complaint with the Information and Privacy Commissioner about the collection of both pieces of information pursuant to the PIPA.
The adjudicator from the office of the Commissioner ordered that the appellant cease recording driver's licence and licence plate numbers when individuals pick up merchandise and directed that the appellant destroy all existing record of both pieces of information. The appellant's application for judicial review was dismissed.
Slatter J.A. (Berger J.A. concurring, Conrad J.A. dissenting) opened his discussion of the PIPA with comments regarding the competing values addressed by the Act: the right of an individual to have his or her personal information protected and the need of organizations to collect, use or disclose personal information for reasonable purposes. Noting that the Act does not give predominance to either of these values, Slatter J.A. stated that, although privacy rights are important, this does not mean that they should predominate over all other social needs, values and interests. Indeed, Slatter J.A. observed that in an increasingly complex and information-based society, many organizations must use personal information for legitimate reasons daily and should not be unreasonably curtailed.
Moving to the reasons of the adjudicator, Slatter J.A. held that, while it was reasonable to conclude that a driver's licence number was personal information, it was not reasonable to conclude that a licence plate number was personal information as it is not about an individual.
With respect to the appellant's policy, Slatter J.A. found that the key issue was whether it was unreasonable (in the context of judicial review) for the adjudicator to find that it was unreasonable (objectively) for the appellant to collect this information as a condition of its business dealings. Slatter J.A. noted that the appellant needed only demonstrate that its policy was reasonable, not that it was the "best" or "least intrusive" approach. Slatter J.A. further stated at para. 58 that "[a]s long as fraud is a meaningful risk in the business, and the policies adopted have a meaningful effect on preventing or detecting fraud, those policies would be considered "appropriate in the circumstances" by reasonable people. A reasonable person would not expect a retailer to view the world through rose coloured glasses, and assume that everybody conducts themselves honestly."
Slatter J.A. held that the adjudicator's conclusion that the appellant's policy was unreasonable was itself unreasonable as it was influenced by the view that privacy rights must prevail in all circumstances over the legitimate use of information and the adjudicator's view that there were other reasonable ways that the business could have been operated. Slatter J.A. found that the PIPA calls for a balancing of interests which the adjudicator did not observe. The decision was quashed.
Relevance of Leon's Furniture Limited v. Alberta
This decision confirms that privacy rights are nuanced and that conclusions should be contextual and fact-specific. This case further clarifies that, with respect to collecting information as a condition of doing business, the Information and Privacy Commissioner is charged with a determination with respect to reasonableness, while balancing the interests of those involved. It is not the place of the Information and Privacy Commissioner to determine the best policy.
Organizations and consumers should take note of the statement about the importance of the balance of competing interests in privacy law. This decision represents one of a series of decisions where the courts have contemplated privacy law, and interpreted privacy law differently from the Information and Privacy Commissioner. It certainly will not be the last.
The Office of the Information and Privacy Commissioner has confirmed it is going to seek leave to appeal to the Supreme Court of Canada.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.