Judicial review puts Privacy Commissioner's cross-border powers under the microscope

It appears from an article in today's Toronto Star (TheStar.com - Privacy chief eyes U.S. border) that Phillipa Lawson of the University of Ottawa is taking the Privacy Commissioner to task and to court for not going after a US-based data broker. In June 2004, Lawson and the Canadian Internet Policy and Public Interest Clinic complained to the Privacy Commissioner of Canada against Abika.com. The complaint alleged that Abika violated Canadian privacy laws by compiling information about Lawson without her consent and in violation of the Accuracy principle of PIPEDA.

The Assistant Commissioner concluded that because the company had no presence in Canada, she could not investigate and therefore could not issue any finding on the matter. PIPEDA, the Assistant Commissioner concluded, did not give her jurisdiction to investigate a company outside of Canada. Lawson has sought judicial review of the decision not to investigate.

From the Star's article:

The commissioner's decision "ultimately narrowed the scope of privacy protection for all Canadians," Lawson's court documents state.

"... in the absence of any legislative restrictions on her investigative powers and despite Parliament's intent to give the Commissioner broad investigative powers and this Court's findings that the Commissioner's powers be given a liberal interpretation, the commissioner chose to set artificial limits on her ability to investigate the complaint," the documents state.

In a response filed late last month, privacy commissioner Jennifer Stoddart asks that the application be dismissed.

Her court documents state that she "correctly determined that PIPEDA was not intended, either expressly or implicitly, to have extra-territorial reach."

...

Court documents filed by Lawson say "this case is about the scope of Canadians' legal privacy protection when a commercial organization with a foreign business address reaches into Canada to collect personal information about Canadians and discloses that information to other Canadians."

For the background to this complaint, see PIPEDA and Canadian Privacy Law: CIPPIC complaint raises a number of novel and interesting issues, PIPEDA and Canadian Privacy Law: Jurisdictional limitations on Canadian privacy law and The Canadian Privacy Law Blog: CIPPIC v Abika.com: Part deux.