With Canada's national privacy legislation slated to take full effect on Jan. 1, 2004, most privacy watchers anticipated that 2003 would be an eventful year. Led by Ontario, some provinces were expected to introduce their own privacy legislation.
At the same time, findings by the federal privacy commissioner and several court challenges were seen as likely to yield a fuller understanding of the law's obligations and implications.
As we enter summer, some noteworthy surprises have lent an air of uncertainty around privacy law in Canada. Most troubling is the emergence of jurisdictional questions that raise questions about who is ultimately responsible for enforcing and interpreting Canada's privacy legislative framework.
On the provincial front, Ontario has come up short in its effort to introduce privacy legislation. Despite months of negotiations, a draft that received widespread approval from many stakeholder groups has been shelved, falling victim to a looming election and the belief that privacy will not be a winner at the ballot box.
While waffling in Ontario is disappointing, in recent weeks British Columbia and Alberta have taken an important first step by introducing provincial privacy bills of their own.
Both are expected to receive rapid approval so that they may take effect by year-end, even though the B.C. bill has already run into opposition from Privacy Commissioner George Radwanski.
The federal privacy law acknowledges that the Canadian government is constitutionally prohibited from regulating certain kinds of personal information.
Accordingly, it creates a clear window for the provinces to enact their own privacy statutes and states that, provided that the provincial version is "substantially similar" to the federal law, the provincial privacy law will govern.
A key question that remains, however, is who is entitled to decide whether the provincial laws meet the substantial similarity test.
While the privacy commissioner once suggested his office was responsible to make the determination, it is now widely accepted he is only required to issue a finding on the matter and that the determination ultimately falls to Ottawa, which has set guidelines for the substantial similarity test.
The privacy commissioner has pointed to several shortcomings in the B.C. bill that he believes render it deficient when compared with the federal law. In particular, he notes that unlike the federal law, the B.C. bill includes a grandfathering provision that excludes personal information collected before the law came into effect.
Interestingly, he also focuses on lax workplace privacy protections accorded to employees under the B.C. bill, despite the fact that workplace privacy is a matter of provincial jurisdictional competence.
The coming months are likely to prove contentious as B.C. and Alberta march toward provincial privacy legislation.
We have in the same arena the privacy commissioner unlikely to fully endorse their efforts, the federal government eventually providing its view on the matter, and constitutional lawyers salivating at the prospect of a court challenge against the federal privacy law.
Adding to the uncertainty is a recent federal court decision that calls into question the system of checks and balances created by the federal law.
The federal law provides that the privacy commissioner reviews complaints launched under the act and renders findings as to whether complaints are well-founded.
If complainants are unhappy with the privacy commissioner's finding, they are entitled to apply to the Federal Court of Canada for a hearing on the matter. It then falls to the federal court to provide a definitive interpretation of the law and possibly provide complainants with a remedy.
A case involving a privacy complaint against the Montreal Airport Authority illustrates that this system may have some holes, however.
Diane L'Ecuyer, a former employee of the Airport Authority, complained to the privacy commissioner's office in 2001 that her employer had disclosed personal information without her consent to several third parties.
The privacy commissioner agreed with at least part of the complaint, finding that there was disclosure of information without consent to the Ms. L'Ecuyer's trade union.
Dissatisfied with other aspects of his decision, Ms. L'Ecuyer proceeded to take her complaint to the federal court. Two weeks ago, the federal court dismissed her complaint on jurisdictional grounds. Noting that the case involved a unionized worker subject to a collective agreement, the court ruled that the Canada Labour Code is granted the exclusive right to address disputes that arise out of a collective agreement.
Though the decision is consistent with earlier Quebec case law, it comes as a surprise to privacy watchers since it exposes an important shortcoming in the federal legislation.
While the law envisions a right of action at the federal court, apparently not everyone is entitled to exercise that right.
With this case now sitting alongside disputes surrounding the introduction of provincial privacy legislation, it is clear that the Canadian privacy law framework is undergoing significant uncertainty well beyond what most anticipated at the start of the year.