Alberta Privacy Commissioner has just released a noteworthy decision on the application of private sector privacy laws to mergers and acquisitions transactions. The case involved the acquisition of an Alberta company. As part of the deal, employee information, including home addresses and Social Insurance Numbers, were disclosed. Moreover, since the information formed a material part of the transaction, the personal information was posted on the Internet on SEDAR, the securities clearinghouse, and therefore freely available to all.
The Commissioner found against both the companies and the law firms involved. Commissioner Work does not mince words when he notes that:
"We suggest generally that Shtabsky and Tussman and other law firms have shown a lack of attention to the impact of privacy laws on the myriad legal processes involving the collection, use and disclosure of personal information, including client information and third party information that are common in the type of work they perform on behalf of their clients. Privacy laws are complex, and have implications for their clients on many different types of transactions, including mergers and acquisitions such as in the present case. We believe that lawyers and law firms require heightened awareness and knowledge of privacy laws in order to properly recognize these implications."
To achieve the heightened awareness, Commissioner Work recommended that Stikeman Elliott, a leading national law firm:
- enact a privacy policy and appoint a Calgary-based Privacy Officer;
- conduct comprehensive in-house privacy training with all lawyers and staff;
- ensure that lawyers develop professional awareness and knowledge of privacy law by supporting participation in privacy law seminars and courses and encouraging ongoing education in this regard;
- communicate these findings to all lawyers and staff;
- review its processes when representing clients on business transactions where personal information may be collected, used or disclosed and address any gaps that are identified;
- review the processes and controls employed by Stikemans when material contracts or other filings are posted on SEDAR and address any gaps that are identified.
This decision will have significant reverberations throughout the legal community as it points the liability (reputational and otherwise) that law firms face when dealing with personal information. Moreover, it highlights yet again the fundamental difference between provincial laws that name names (and thus carry serious consequences) and our federal law, which in its current form does little to encourage full compliance.