Federal Court Of Appeal Weighs In On Privacy And Consent

Article by Elizabeth McNaughton, Ian Hay and Veera Rastogi, ©2005 Blake, Cassels & Graydon LLP

The first detailed substantive decision of an appeal court on Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) provides important comments on a number of issues under Canadian privacy legislation. The initial complaint before the federal Office of the Privacy Commissioner (the Commissioner) involved the type of consent required under PIPEDA for the listing of first-time customers’ personal information in telephone directories, the appropriate manner of obtaining that consent, and the reasonableness of fees charged for de-listing. In the subsequent proceedings in the Federal Court and the Federal Court of Appeal, the courts considered a number of additional issues, including interpretation of PIPEDA, the nature of hearings under PIPEDA and deference to the Commissioner, the standing of complainants and jurisdictional issues.

This article focuses on the Court’s comments on the type of consent required to meet PIPEDA’s "knowledge and consent" standard and the Court’s comments on the deference, or lack thereof, to be paid to decisions of the Commissioner. On both of these issues, the Court of Appeal reversed the decision of the lower court and disagreed with the earlier findings of the Commissioner.

A major Canadian telecommunications provider had tried to obtain consent from first-time customers by having its customer service representatives indicate to customers that subscription to a new telephone line includes a listing in its directory. Customers were then asked how they would like their personal information to appear in the directory. If a customer expressed an interest in not having his or her name published in the directory, options, including the ability to opt out of the directory listing, were discussed only at that point. Once a customer had enrolled, they received written material including a privacy brochure that set out the purposes for the collection, use and disclosure of their personal information and of their right to be de-listed.

The lower court found that the company and its affiliates use and disclose customers’ names, addresses and telephone numbers not only to publish its directory, but also for a number of secondary purposes, including dial-in and Internet directory assistance as well as the licensed sale of the information as a retail product in CD-ROM format. While these purposes are outlined in the privacy brochure sent to customers following enrolment, they are not identified at the time customers initially call to subscribe to a new telephone line. However, the lower court reasoned that first-time customers would be well aware of the established practice of telephone companies to include directory listings as part of their residential telephone services and that, as such, the company could assume that it had their implicit consent in this regard unless customers specifically requested an unlisted number on their own initiative at the time of enrolment.

The Court of Appeal overturned the decision of the lower court on the consent issue, finding that the company had infringed PIPEDA in two respects. First, it had failed to inform first-time customers, at the time of enrolment, of the secondary purposes for which their personal information is used and disclosed. On this point, the Court of Appeal held that: "These services were not identified at the time of enrolment and there is no evidence that they were so connected with the primary purposes of telephone directories that a new customer would reasonably consider them as appropriate. There is no evidence that TELUS made any "effort", let alone a "reasonable" one, within the meaning of clause 4.3.2, to ensure that its first-time customers are advised of the secondary purposes at the time of collection."

The Court of Appeal found that the company had also infringed PIPEDA in not informing customers, at the time of subscription, of the availability of the Non-Published Number Service (NPNS), finding the position of the lower court on implied consent to be incompatible with the very requirement of seeking the knowledge and consent of customers at the time of collection, as mandated by Part I and Schedule I of PIPEDA. The Court of Appeal stated that "[a] consent is not informed if the person allegedly giving it is not aware at the time of giving it that he or she had the possibility to opt out". In the Court’s view, it was particularly important in these circumstances that customers immediately be made aware of their right to subscribe to the NPNS, as personal information published in a telephone directory becomes "publicly available" under PIPEDA regulations with the consequence that it can be further used and disclosed without consent. The Court asserted that only with such knowledge and consent can effect be given to the express purpose of PIPEDA, which is to strike a balance between individuals’ right to privacy and industry’s need to collect, use and disclose personal information for appropriate purposes.

On the issue of the deference to be paid to the Commissioner, the lower court in this and previous decisions had indicated that the report of the Commissioner was "entitled to some deference with respect to decisions clearly within his jurisdiction". The Court of Appeal appears to reject this view. Previous Federal Court decisions have confirmed that a hearing under section 14 of PIPEDA is a proceeding de novo, or a new action. However, the Court of Appeal went further and concluded that, because the nature of the proceeding is not a review of the Commissioner’s report per se but a review of the conduct of the respondent company, the report of the Commissioner may be contradicted or challenged like any other document put in evidence and was not entitled to any deference. The Court of Appeal reasoned that, because PIPEDA provides that the Commissioner may appear as a party at the court hearing, showing deference to the Commissioner’s report would compromise the fairness of the court hearing.

Of particular significance to businesses is that the Court of Appeal interprets PIPEDA to require organizations to identify to individuals all purposes for the collection, use and disclosure, as well as any opt-out options, at or before the time of collection. On its face, this requirement, in terms of the timing of the identification of purposes and consent options, affords organizations less leeway than comments of the current federal Privacy Commissioner in recent speeches or even the wording of the "Identifying Purposes" and "Consent" principles in Schedule 1 of PIPEDA. It is possible that this interpretation may have been informed by the particular facts of this case, given that the consequence of a directory listing is that the information becomes publicly available. However, until this issue is considered by the Court on different facts, and particularly in light of the Court’s finding on the issue of deference to the Commissioner, it is at least arguable that the Court of Appeal has raised the bar on the "knowledge and consent" requirement of PIPEDA.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.