The New Privacy
OTTAWA, OCTOBER 15 , 2003
The Ottawa Chapter hosted an informative preview of the Personal Information Protection and Electronic Documents Act (" PIPEDA") which came into force in Ontario on January 1, 2004. The meeting took place at the Centurion Conference Centre, and a good number
of people braved driving rain and high winds to attend the session.
The speaker was Charles Hofley, partner with Hicks Morley in its
Ottawa office. His practice includes arbitrations, collective bargaining,
Labour Board representation, wrongful dismissal defence and employer
advice. He has extensive experience in grievance arbitration in both private
and public sectors and trial experience in the Ontario courts. He is well versed
in the use of legal tools to prevent and minimize conflict and liability arising
from the employment relationship. Charles has established expertise in
advising and representing clients with respect to plant closures, downsizing,
restructuring and sale of business implications.
As Charles explained to the group, the Act will apply to personal information
that is collected, used, or disclosed
in the course of commercial activity. One area which no doubt may be affected
by the legislation is the maintenance of online membership directories. The
applicability of the PIPEDA to these password-protected sites will depend
on the specific content of the directory.
The first question a firm must
address is whether the information contained therein falls within the
meaning of personal information. The Act defines personal information
broadly as meaning "information about an identifiable individual."
However, it is not likely to apply to information that is publicly available,
for example, names, addresses and phone numbers which can be found
in a public telephone directory will probably not be considered 'personal
information'. Therefore, it will be the type of information available on the
directories that determines the applicability of the PIPEDA. In certain
circumstances there may be an argument that what is disclosed in the online
directories does not consist of personal information, but rather is limited to
what is otherwise publicly available.
If the information collected, used
or disclosed is found to be 'personal',
the Act requires that two questions be answered to determine whether the
1. Is the collection, the use, or the disclosure directly or indirectly
related to an exchange of merchandise or services for
2. Is the exchange undertaken
for the purpose of generating revenue or positive cash flow?
The commercial purpose inquiry set out in the two questions above,
does not involve an examination of the purpose of the institution, but an
examination of the purpose of the specific exchange. The Act expressly
states that "the selling, bartering or leasing of donor, membership or other
fundraising lists" is included within the scope of 'commercial activity'
and as such these activities would require adherence to the PIPEDA rules.
The applicability of the PIPEDA to online membership directories that
are password protected and available as a function of one's membership to
an organization will depend upon the specific information that is collected
and/ or disclosed. Undoubtedly, the safest approach would be to
treat the directory as falling within under the Act and to seek the express
informed consent of all those whose names and information will appear
in the directory.
Charles Hofley is the featured
presenter on Employment Law Update
at the IPM Full Day Conference in
Ottawa on June 7, 2004.