My post and column on the expansion of warrantless disclosure under Bill S-4, the misleadingly named Digital Privacy Act, has attracted some attention and a response from Industry Canada. The department told iPolitics:
“Companies who share personal information are required to comply with the rules to ensure that information is only disclosed for the purpose of conducting an investigation into a contravention of a law or breach of an agreement. For example, self-regulating professional associations, such as a provincial law society, may wish to investigate allegations of malpractice made by a client. When organizations are sharing private information, the Privacy Commissioner can investigate violations and may take legal action against companies who do not follow the rules. This is consistent with privacy laws in British Columbia and Alberta and was recommended by the Standing Committee Access to Information, Privacy and Ethics.”
The response may sound reassuring, but it shouldn’t be.
First, the Privacy Commissioner of Canada can obviously address complaints regarding companies that do not follow the rules. However, the new rules plainly allow warrantless disclosure of personal information for an investigation into a breach of an agreement or a contravention of the laws of Canada or a province that has been, is being or is about to be committed. This broadly worded exception will allow companies to disclose personal information to other companies or organizations without court approval.
Second, the disclosure itself is kept secret from the affected individual, who is unlikely to complain since they will be unaware that their information has been disclosed.
Third, allowing a regulated industry to conduct investigations (such as a provincial law society) is a far narrower issue than the wide open warrantless approach found in the bill.
Fourth, while the Standing Committee on Access to Information, Privacy and Ethics may have recommended a similar reform in 2006, that recommendation was rejected by both the Conservative government and the Privacy Commissioner of Canada. The committee recommendation appears to have come from a single submission from the Canadian Bar Association. The CBA appeared before the committee but was not questioned about the proposal.
The CBA proposal focused specifically on personal information legally available to a party to a legal proceeding. That is much narrower than the Bill S-4 provision.
Yet even that narrower proposal was rejected by the Conservative government in its response to the committee recommendations:
The government notes the Committee’s recommendation and acknowledges that it was made in response to concerns expressed by certain stakeholders regarding the need to ensure that PIPEDA does not impede litigation procedures. However, the government does not share the Committee’s view that such an amendment is necessary at this time.
The Privacy Commissioner of Canada also publicly opposed the recommendation, which she included among the six issues about which she had particular concerns:
The Canadian Bar Association recommended that the AB and BC Acts both provide clarity in regard to information legally available in a legal proceeding. I do not believe that this issue has posed any great difficulty over the past five years. The OPC has stated in complaints that the access provisions of PIPEDA may be broader than the requirements of discovery, depending on the breadth of documents relevant to a proceeding.
In other words, Bill S-4 contains an expanded version of a provision that one group asked for without facing any questions, that the government rejected when it was proposed, and about which the Privacy Commissioner of Canada expressed particular concern. In response, Industry Canada claims that Canadians can file complaints if the provision is misused, but by definition they will not know that their personal information has been disclosed.