In November, 2013 the Supreme Court of Canada declared
Alberta's Personal Information Protection Act (PIPA) to be
unconstitutional, but suspended the effect of the ruling for 12
months to permit legislative changes to be brought forward to
remedy the deficiencies. The case of Alberta (Information and Privacy
Commissioner) v. United Food and Commercial Workers, Local 401
successfully challenged the constitutionality of PIPA in the
context of picket line surveillance in a labour dispute.
PIPA's restrictions on the collection use and disclosure of
personal information were seen as violating the
union's freedom of expression rights in this labour
context. At the request of the Alberta government, the court
declared the entire PIPA unconstitutional, rather than
attempting to determine which particular legislative provisions
might need to be modified.
In December, 2013 Alberta's Information and Privacy
Commissioner publicly commented on her assessment of what
needs to be done to amend PIPA in response to this case. In a
letter addressed to the Alberta government,
she suggests that only very limited changes are appropriate or
Varying degrees of scope of amendment could possibly be advanced
to deal with the constitutional issues arising from PIPA's
structure, which establishes a broad prohibition against any
information collection, use or disclosure absent consent, providing
only selected and specified statutory exemptions. These
potential degrees of scope of amendment included:
a) narrow amendments exempting information collection in a
picket line scenario to the extent related to union expressive
rights in that narrow context [the particular facts of the United
b) broader amendments exempting information collection in any
context of labour dispute, to the extent related to union
expressive rights, even if not in the context of a picket line;
c) even broader amendments exempting information collection in
the labour relations sector generally, to the extent related to any
party's expressive rights, even if there is no labour
d) very broad amendments exempting information collection
generally, both within and outside the labour relations context, in
any situation where there are legitimate rights of expression which
are considered to be protected by the Charter.
In her letter, Alberta's commissioner advocates that the
most appropriate scope of change is the narrowest one, set out in
paragraph (a) above. She believes that this would preserve
the delicate balance between freedom of expression rights, and
leigitmate privacy expectations of individuals, which PIPA
is designed to protect. She also suggests that given the
imposed timeline for rectification, this specific and narrow
amendment can be made without waiting for the context of a more
comprehensive and general review of the PIPA legislation.
In January, 2014 the Alberta government announced that it would
be bringing forward only selective amendments to PIPA in the fall
legislative session, which would focus on and be restricted to
unions and picketing. A more comprehensive review of the PIPA
legislation would no doubt occur at a later date. This
effectively defers any debate on the extent to which PIPA should
accomodate other and broader rights of expression beyond the narrow
facts of the United Food case.
The Alberta amendments will also be observed with interest by
other governments. British Columbia has its own version of
PIPA which is very similar in structure to the Alberta
legislation. Although not strictly bound by the November,
2014 deadline, British Columbia would be expected to implement
changes to its own PIPA law closely tracking the process which
occurs in Alberta. The federal private sector privacy law,
the Personal Information Protection and Electronic Documents Act
(PIPEDA), is not modelled on the PIPA structure, but does contain
privacy restrictions which are substantially similar.
Some remedial amendments to the PIPEDA law might be expected as
well. It is not known how that federal process, if it occurs,
would harmonize with current efforts to make more comprehensive
changes to PIPEDA, which efforts have become stalled in the
Canadian Parliament over the past few years.
Finally, the status of all personal information protection laws
enacted in Canada has now been somewhat overshadowed by an
initiative in the European Union to re-examine Canadian legislation
in this area to assess how closely it meets evolving privacy
standards in the European Union. Stay tuned.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
In early 2013, an employee of the Investment Industry Regulatory Organization of Canada lost an unencrypted USB drive containing confidential and personal data of approximately 50,000 customers of its dealer members.
All of the decisions discussed eliminate or reduce potential obstacles to privacy class actions, and so they may signal that more privacy class actions will be brought and potentially certified in 2016.
Cyber-attacks can have devastating financial and reputational effects on any business. Ponemon Institute LLC's 2015 Cost of Data Breach Study: Canada indicates that the average cost of a data breach in Canada is C$5.32-million.