Did the Supreme Court of Canada formally establish a new form of consent? Is "implied consent" really "deemed, irrevocable consent"?

I just posted a comment on the new Royal Bank of Canada v. Trang decision from the Supreme Court of Canada (Supreme Court of Canada permits disclosure of mortgage document over debtor’s privacy objections), but there’s an aspect of it I’d like to dig into further.

On close review, it does appear that the Supreme Court of Canada has -- perhaps inadvertently -- re-written a key aspect of the Personal Information Protection and Electronic Documents Act ("PIPEDA"). In the decision, the Court found that Scotiabank had Trang’s implied consent to disclose a mortgage discharge statement to the Royal Bank of Canada. I don’t think that’s very controversial, but if you dig into it, the Court’s conclusion is significant. It found that "implied consent" is really not consent, but deemed and irrevocable consent where it’s reasonable.

“Implied consent” is consent where you can imply someone’s permission or consent from the circumstances. For example, if I ask someone for their name and address to send them something and they give their name and address, you can imply their consent to use it for that purpose. In other circumstances, it can be unspoken. If I were to ask the same person for their name and address and it is clear in the circumstances that I’d be using it to send them something, their consent can be implied by their providing the information.

This is in contrast to express consent, which is where the individual has expressed his or her consent at the time. (“Yes, I give you consent to use my name and address to send me that thing.”)

All of this is clear from PIPEDA. But what is also clear from PIPEDA is that an individual can withdraw his or her consent at any time:

4.3.8 An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. The organization shall inform the individual of the implications of such withdrawal.

In the Trang case, it was abundantly clear that Trang did not consent to any disclosure of the mortgage discharge statement. While the decision does not specifically say that Trang revoked it, it is clear that Trang was asked and did not consent. Further, Trang did not appear at an examination in aid of execution. (I’d imply no consent there.)

So what does this mean? In short, “implied consent” as used by the Supreme Court here is really not “implied consent” but “deemed deemed”. It’s a consent that is reasonable in the circumstances but really cannot be revoked or overridden. It occurs regardless of the actual wishes of the individual. And that’s a big deal.

Now, I don’t think that the Supreme Court just made this up. You might even say it is necessary given that that PIPEDA only has a limited number of circumstances where an organization can do away with consent, all of which are listed in s. 7 of the Act. We can see many examples in findings from the Office of the Privacy Commissioner of Canada, particularly those that arise in the workplace. For example, in Transit driver objects to use of technology (MDT and GPS) on company vehicle, the Commissioner found there was implied consent for a transit operation to use GPS to track his movements on the job. The driver who complained clearly objected -- definitively communicated a lack of consent, but the Commissioner found that the purpose was reasonable and that notice was given to the employees, so all was kosher.

Much of this has been fixed with the Digital Privacy Act (but only for employees), which added this new section 7.3:

Employment relationship

7.3 In addition to the circumstances set out in section 7, for the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, a federal work, undertaking or business may collect, use and disclose personal information without the consent of the individual if

(a) the collection, use or disclosure is necessary to establish, manage or terminate an employment relationship between the federal work, undertaking or business and the individual; and

(b) the federal work, undertaking or business has informed the individual that the personal information will be or may be collected, used or disclosed for those purposes.

So 7.3 fixes it and makes this discussion moot in the employment context, but the Supreme Court’s decision seems to support the proposition that there are circumstances where implied consent really equals deemed, irrevocable consent.

I hesitate to predict how this will play out in the future, but it's likely significant.