In a recent decision, the Ontario Privacy Commissioner addressed a complaint from a member of a wine club against the Liquor Control Board of Ontario ("LCBO"), a Crown agency that operates retail liquor stores across the province. Under LCBO guidelines, approved wine clubs are permitted to purchase liquor products not available through LCBO outlets for their members if the purchases are for personal use only, not for re-sale. LCBO policy requires that the wine club submit with the purchase order a list containing the names, addresses and phone numbers of each of its members placing an order and the products and quantities being purchased by each member. This information is not required if an individual purchases liquor in an LCBO retail outlet.
A wine club member complained that this collection of personal information was inconsistent with the Freedom of Information and Protection of Privacy Act (the "Act") and amounted to collection of information about members' consumption habits. Under the Act, collection of personal information by a government institution is not permitted unless the collection is expressly authorized by statute, used for law enforcement purposes, or necessary for the proper administration of a lawfully authorized activity. The LCBO argued that collection of the personal information was necessary to administer the wine club program, and was required to
- process the transaction,
- facilitate a potential recall of products,
- enable audits of the program, and
- deter fraud generally.
The Commissioner quickly dismissed the first two purposes noting that, for reasons that were unclear, the LCBO had not collected this information from the time the wine club was registered in 2004 until the fall of 2012 and that the LCBO had been able to process transactions without that information. While collection of personal information might be helpful in the case of a product recall, the contact information might not be accurate and there were a variety of other options open to the LCBO to process a recall.
The LCBO also claimed that the collection of the personal information was necessary in order for audits to be performed to determine whether clubs were stockpiling liquor with a view to illegal resale, whether orders were placed for actual customers, and whether LCBO employees were committing fraud. The Commissioner found that the LCBO had not provided any evidence about the scope of these problems, how frequently audits were conducted in the past or the results of such audits. She also noted that illegal reselling and stockpiling of liquor may be investigated by police and by the Alcohol and Gaming Commission of Ontario under its enabling statute. She found that the collection of personal information for audit purposes was "merely helpful" and not necessary for the administration of the sale of liquor to clubs.
The Commissioner very carefully addressed the LCBO's claim that its collection of personal information was necessary to prevent fraud and, in particular, to prevent the illegal resale of liquor. She found that no substantive information had been provided to her that fraud was a significant problem with respect to wine clubs.
She noted that the LCBO provided her with the names of 12 companies sanctioned during the period 2002 – 2005 for illegal stockpiling of wine. None were wine clubs. Personal information was provided with respect to the customers in those cases, and the Commissioner commented that "if the collection of personal information about customers was aimed at deterring fraud, it appears not to have been successful in these cases".
The Commissioner emphasized that she had not been provided with "much more than anecdotal or hypothetical evidence to support [the LCBO's] position that the illegal resale of liquor by wine clubs in this province is so problematic that it necessitates the collection of personal information of club members", and that absent such evidence that this was actually occurring on a "significant scale" was unable to find that the collection of personal information was necessary for the operation and management of the club purchasing program.
In addition, the Commissioner noted that the Chair of the LCBO had the statutory power to appoint an inspector to determine whether there was compliance with the legislation and that, in appropriate circumstances, an inspection of a club could be conducted rather than collecting personal information at the time of purchase.
The Commissioner ordered that the LCBO cease collecting personal information of wine club members to process club purchase orders and destroy all such personal information that it had collected.
In response, the LCBO announced that it would stop supplying wine clubs. That decision upset the wine clubs. The LCBO has since announced that it is appealing the decision and is seeking a stay of the Order requiring it to destroy all the personal information of wine club members that it holds, although it will cease collecting such information while the appeal is pending. We will keep you advised of further developments.
The findings mean that an institution that seeks to justify its collection of personal information on the basis of fraud prevention or deterrence will need to provide evidence that such fraud is actually occurring and is significant, that the collection of personal information is necessary, and not merely helpful, in preventing such fraud, and that other methods of preventing prevent the fraud that do not require the collection of personal information are unavailable.
About BLGThe content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
