The Access to Information Act has generated increasing attention over the past few months as Prime Minister Steven Harper has acknowledged the need for its reform as part of his accountability plans for government. The statute, which addresses the public’s right to access to government records, was recently at the centre of a Supreme Court of Canada decision that shed light into how Canada’s top court regards the importance of privacy.
The case involved an access to information request regarding food giant H.J.Heinz to the Canadian Food Information Agency. Government officials determined that some of the requested records might be exempt from disclosure since they contained confidential information and asked the company for its view. Although the company responded that the records did indeed contain confidential data, the government officials ruled that the records could still be disclosed with the sensitive information redacted.
The company disagreed, arguing that the records should not be disclosed on the grounds that the data was confidential and that they contained personal information. The privacy issue ultimately wound its way to the Supreme Court, which was asked to determine whether privacy protections could be factored into the disclosure analysis.
A divided court ultimately sided with the company by ruling that privacy considerations were too important to be left out. The majority of the judges feared that once the personal information was disclosed, the only recourse would be to launch a complaint with the Privacy Commissioner of Canada. That option was viewed as insufficient, with the court candidly concluding that "the Privacy Commissioner and the Information Commissioner are of little help because, with no power to make binding orders, they have no teeth."
Indeed, the court had little confidence in the complaints mechanism, which it viewed inadequate because "the Privacy Commissioner has no authority to issue decisions binding on the government institution or the party contesting the disclosure. Nor does the Commissioner have an injunctive power which would allow it to stay the disclosure of information pending the outcome of an investigation."
In other words, the current framework simply does not provide adequate privacy protection. Given the importance of privacy – the majority characterized the Privacy Act as ‘quasi-constitutional’ because of the role privacy plays in the preservation of a free and democratic society – the court was unwilling to allow for a potential privacy breach with little prospect for subsequent protection.
The majority’s analysis was countered by a strong dissent from several of the court’s judges. They were far more comfortable with the limited powers of the Privacy Commissioner, noting that the role is "akin to that of an ombudsman and is indicative of a policy decision to adopt a non-litigious dispute resolution mechanism in the context of complaints arising. . . from third parties seeking to protect their personal information."
The dissenting judges argued that Parliament established the limits of the Privacy Commissioner’s powers and that the court should respect that decision by adhering to the strict words of the statute.
While this decision has garnered little mainstream attention, it provides valuable insights into the Supreme Court' s perspective on privacy and the potential for privacy law reform in Canada.
The Supreme Court decision can be read as an indirect endorsement of the Privacy Commissioner of Canada’s longstanding call for changes to the Privacy Act, which applies to the protection of personal information held by government institutions. Privacy advocates have regularly criticized the statute, dismayed that the government is seemingly unwilling to hold itself to the same standard of privacy protection that it demands of the private sector.
Moreover, when Canada’s private sector privacy law is reviewed later this year, the "lack of teeth" associated with the Privacy Commissioner of Canada is certain to emerge as a major focal point. Canadians who presently launch complaints against either the government or private sector companies under the current privacy law framework are frequently disappointed to learn that the Commissioner is unable to do anything more than issue a non-binding finding.
The Internet environment further erodes the effectiveness of the law, since jurisdictional limitations of the Privacy Commissioner' s power hamper the ability to investigate claims or obtain a suitable outcome.
With some studies suggesting that privacy compliance rates in Canada remain low, beefing up the powers of the Privacy Commissioner may be one solution. Given this recent decision, it would appear that the majority of the Supreme Court of Canada stands ready to endorse that approach.
Michael Geist holds the Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, Faculty of Law. He can reached at firstname.lastname@example.org or online at www.michaelgeist.ca.