Later this month, the Federal Court of Canada will hear a case in Halifax that threatens Canada's privacy law framework. State Farm Mutual Automobile Insurance Co. is contesting the constitutional validity of Canada's private sector privacy legislation (PIPEDA), arguing it oversteps the federal government's jurisdictional power. My weekly technology law column (Toronto Star version, homepage version) argues that if successful, PIPEDA would no longer apply to thousands of Canadian businesses and new legislation such as the Electronic Commerce Protection Act (ECPA) would be imperilled.
The case stems from a dispute over an insurance claim arising from a March 2005 automobile accident. Gerald Gaudet, the injured party, asked State Farm to provide copies of all names, addresses, and phone numbers of anyone to whom it disclosed his personal information (State Farm had used a private investigator to conduct surveillance on Gaudet). After State Farm refused to disclose the information, Gaudet filed a complaint with the Privacy Commissioner of Canada.
The Privacy Commissioner proceeded to launch an investigation into the case, asking State Farm to provide it with the requested information. The insurance company again refused, leading to the Federal Court case.
State Farm raises several issues in contesting the disclosure demands, but it is the constitutional arguments where the stakes are the highest. The constitutional question has dogged Canadian privacy law since it was first introduced, with the federal government arguing the Constitution grants it legislative authority to make laws in relation to trade and commerce. The trade and commerce power covers both inter-provincial and international trade as well as general trade and commerce regulation that affect the whole country.
From a privacy law perspective, the government recognized that in a world where a typical consumer transaction may involve a product originating in British Columbia, a retailer in Alberta, a credit card provider in Ontario, a call centre in New Brunswick, and an order fulfillment provider in Quebec, a national standard is needed since personal data traverses provincial boundaries with ease.
By creating PIPEDA but enabling provinces to enact their own “substantially similar” legislation (Quebec, Alberta and British Columbia have all done so), the government navigated a compromise between the interests of the federal and provincial governments.
This is not the first time PIPEDA's constitutionality has been raised. Days before it was scheduled to take effect in 2003, the Quebec government initiated its own constitutional challenge. That case is ongoing but has remained largely dormant.
The Supreme Court of Canada established the test for determining validity of legislation under the trade and commerce clause in a 1989 case involving General Motors. The court outlined five indicia to consider: (i) the legislation is part of a general regulatory scheme; (ii) the legislation is continuously monitored by a regulatory agency; (iii) the legislation is concerned with trade generally rather than with a particular industry; (iv) the legislation is of a nature that the provinces jointly or severally would be incapable of enacting; and (v) the failure to include one or more provinces within the legislative scheme would jeopardize the successful operation of the law elsewhere.
PIPEDA may have been crafted with these five indicia in mind, but there are no guarantees once the law is subjected to Federal Court scrutiny. If State Farm succeeds, PIPEDA would no longer apply within the provinces. Moreover, the government has since relied on the same analysis with other legislative initiatives, notably ECPA, the anti-spam bill that died with prorogation but could be reintroduced this spring.
PIPEDA was viewed as controversial when it was first introduced more than a decade ago. It is now well-entrenched within Canadian law, but the State Farm case presents a tough test that could radically alter privacy protections in Canada.
Tell me again why they didn’t just exercise a search and seizure warrant on the insurance company…
…like they have on other companies for the same thing?
Can you please expand
Michael, can you please expand on your statement that “If State Farm succeeds, PIPEDA would no longer apply within the provinces”. Do you, by this, mean that PIPEDA would no longer apply to non-federally regulated businesses (i.e. the status would effectively revert to the 2000 version of the legislation)?
FCC loses key ruling on Internet `neutrality’
Just wanted to bring this to your attention Professor, if you hadn’t seen it yet.
http://finance.yahoo.com/news/US-court-rules-against-FCC-on-apf-78990100.html?x=0&.v=4
More bad forecasting for Net Neutrality.
got a link to priv.gc.ca?
I tried finding it in the priv comm’s site. Many instances of people running to them about insurance companies, so I wasn’t able to piece together which complaint it was.
Anyone have the link to the complaint on the Privacy Commissioners site to this one?
What about doing what’s right?
I can’t believe that if I requested who they provided my information to, I would be denied, especially insurance, medical, etc.
Don’t these companies have some kind of audit trail……
Crazy.//
Not only State Farm refuses to provide the info but they also dispute the validity of the organization that defends our privacy. I doubt their intent is to better Canada’s judicial system. I truly wonder what causes them to react so strongly. Do they regularly share client data with impunity? Or is it that the messed up big time with that particular client?