Sometimes businesses receive requests for personal information from the police or other law enforcement bodies and must then consider whether they may disclose the requested information in light of the Personal Information Protection and Electronic Documents Act of Canada (PIPEDA). PIPEDA states that the knowledge and consent of an individual are generally required for the collection, use or disclosure of their personal information. However, the Act sets out some exceptions to allow disclosure of personal information without the individual’s knowledge or consent. One such exception, found in s. 7(3)(c.1) of PIPEDA, was recently considered by the Ontario Court of Justice.
This provision states that an organization may disclose personal information without consent to a government institution that has made a request for the information, identified its "lawful authority" to obtain the information and indicated that the disclosure is requested for the purpose of enforcing, investigating or gathering intelligence for the enforcement of a law of Canada, a province or a foreign jurisdiction. Section 7(3)(c.1) appears to allow disclosure in situations other than just in response to a subpoena or warrant or when "required by law," as separate provisions (s. 7(3)(c) and s. 7(3)(i)) provide for disclosure without consent in such circumstances. In Re S.C., Justice of the Peace Conacher of the Ontario Court of Justice discussed the scope of the "without consent" exception in s. 7(3)(c.1).
This decision appears to indicate that in order to rely on the exception in s. 7(3)(c.1), the "lawful authority" to obtain the information must first be established by the government institution, and that PIPEDA itself does not establish the authority for it to obtain the information. Unless that lawful authority is established, a private sector entity (in this case, Bell Canada) may risk falling afoul of PIPEDA by disclosing the information, unless some other "without consent" exception applies.
The Re S.C. case considered a request for a search warrant and whether there was sufficient authority for Toronto police to have obtained subscriber information and addresses from an information service provider. Prior to seeking a warrant to search an individual’s home, the police had requested subscriber information for the user of a certain internet protocol address from Bell Canada. The police’s letter stated that the "request was done under the authority of PIPEDA." Bell Canada supplied information to the investigators.
However, the Justice of the Peace found that the information supplied in the request for a search warrant was information for which a citizen would have a reasonable expectation of privacy. Accordingly, there was a presumption based on the Charter of Rights and Freedoms that prior judicial authorization was required to obtain such information via a search warrant or production order.
Accordingly, Bell Canada did not have a basis upon which to disclose the information in the view of the Justice of the Peace, and the information obtained was set aside in the overall consideration of the search warrant application submitted, because the police were not lawfully in possession of it. The request for the search warrant was ultimately rejected by the Justice of the Peace because the balance of the Information to Obtain did not establish a reasonable nexus between the matters being investigated and the individual and residence identified as targets for the warrant.
Subsequent to the Justice of the Peace’s decision in the Re S.C. case denying a search warrant, another application for a search warrant in respect of the same individual was made to a judge of the Ontario Court of Justice. An amended Information to Obtain was submitted for the court’s consideration, along with the Justice of the Peace’s reasons for judgment in Re S.C and further written representations about certain case law. In an unreported decision, the judge issued the warrant (without reasons).
McCarthy Tétrault Notes:
To the extent that the amended Information to Obtain contained the information received as a result of the police’s letter of request, it may be difficult to reconcile these conflicting decisions about the issuance of the search warrant. However, the Justice of the Peace’s reasons that PIPEDA does not itself establish the lawful authority to obtain information and that independent legal authority should exist in order to obtain the benefit of s. 7(3)(c.1) may nevertheless remain intact. Ultimately, further guidance from the courts may be required to clear up the ambiguity and provide guidance about how to respond to a request for information from a lawful authority.
If the Justice of the Peace’s reasons in Re S.C. and certain decisions of the Privacy Commissioner of Canada (e.g., PIPEDA Case Summaries #62 & 173) are to be used as a guide, it appears that a company subject to PIPEDA should take the following steps when faced with a request for personal information from a government institution conducting an investigation or enforcing a law:
- if the institution does not have a subpoena, warrant or court order, advise that the company may have obligations under PIPEDA in respect of the information requested;
- request that the institution specify its lawful authority to obtain personal information; and
- check the authority cited as the lawful authority for the institution to obtain the information.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
