Alberta Privacy Commissioner has just released a noteworthy decision on the application of private sector privacy laws to mergers and acquisitions transactions.  The case involved the acquisition of an Alberta company.  As part of the deal, employee information, including home addresses and Social Insurance Numbers, were disclosed.  Moreover, since the information formed a material part of the transaction, the personal information was posted on the Internet on SEDAR, the securities clearinghouse, and therefore freely available to all.

The Commissioner found against both the companies and the law firms involved.  Commissioner Work does not mince words when he notes that:

"We suggest generally that Shtabsky and Tussman and other law firms have shown a lack of attention to the impact of privacy laws on the myriad legal processes involving the collection, use and disclosure of  personal information, including client information and third party information that are common in the type of work they perform on behalf  of their clients. Privacy laws are complex, and have implications for their  clients on many different types of transactions, including mergers and  acquisitions such as in the present case. We believe that lawyers and law  firms require heightened awareness and knowledge of privacy laws in  order to properly recognize these implications."

To achieve the heightened awareness, Commissioner Work recommended that Stikeman Elliott, a leading national law firm:

• enact a privacy policy and appoint a Calgary-based Privacy Officer;
• conduct comprehensive in-house privacy training with all lawyers  and staff;
• ensure that lawyers develop professional awareness and  knowledge of privacy law by supporting participation in privacy  law seminars and courses and encouraging ongoing education in  this regard;
• communicate these findings to all lawyers and staff;
• review its processes when representing clients on business  transactions where personal information may be collected, used or  disclosed and address any gaps that are identified;
• review the processes and controls employed by Stikemans when material contracts or other filings are posted on SEDAR and  address any gaps that are identified. 

This decision will have significant reverberations throughout the legal community as it points the liability (reputational and otherwise) that law firms face when dealing with personal information.  Moreover, it highlights yet again the fundamental difference between provincial laws that name names (and thus carry serious consequences) and our federal law, which in its current form does little to encourage full compliance.