Nova Scotia's new Freedom of Information and Protection of Privacy Act (Bill 150)

In just the past month, kind of unexpectedly, the Nova Scotia government introduced and passed a new public sector privacy and access to information law that completely replaces the existing Freedom of Information and Protection of Privacy Act (known here as “FOIPOP") with a new law that will come into effect in April of 2027.

This isn’t completely out of the blue because the Nova Scotia government has been “reviewing” FOIPOP since 2022, but unlike in most provinces it has been “behind the scenes”. Unlike other provinces, which have public consultations, Nova Scotia’s consultation on transparency was behind closed doors.

I wrote to the then Minister of Justice seeking to participate on behalf of the Nova Scotia branch of the Canadian Bar Association’s Privacy And Access Law Section. The CBA was never invited to chat. I wonder who else commented. We were told that the results of this review would be made public, but they never were. All we got was Bill 150, dropped in the legislature on September 26 and passed on October 3. There was no real opportunity given for privacy and access to information experts to appear in committee with their comments. 

In this episode, I’m going to do a relatively high-level overview of what’s changing with the new FOIPOP that will come into effect in 2027. There’s some good, some bad and some changes that I’m indifferent to. I hope I can provide a relatively unbiased view of it, given that I do legal work for applicants who are seeking access to records, for public bodies who have to comply with the law and third parties whose records held by public bodies are sometimes the subject of access requests. 

There’s a big change to the purposes clause of the law. The original FOIPOP was relatively unique among access to information laws in Canada in that it clearly had as its intent full transparency, accountability and access – as fundamental to how democracy should work. 

The purpose clause in the current act includes:

2. The purpose of this Act is …

(b) to provide for the disclosure of all government information with necessary exemptions, that are limited and specific, in order to

(i) facilitate informed public participation in policy formulation,

(ii) ensure fairness in government decision-making,

(iii) permit the airing and reconciliation of divergent views;

That part is gone. Just removed. The leader of the opposition made a motion to have it returned, but the motion was defeated.

That’s too bad. The purpose clause is important in how regulators and courts approach the law, and future governments will be able to say it was removed for a reason and that should influence how it is interpreted. That’s a real step backward. 

As I said, the new Act fully repeals and replaces the earlier statute. It restructures the entire Act into clear Parts (e.g., Part I – Freedom of Information; Part II – Protection of Privacy; Part III – Reviews and Appeals; Part IV - Information and Privacy Commissioner), and has a number of standardized definitions for consistent terminology (like “access request,” “correction request,” etc.), and procedural timelines are now measured in business days rather than calendar days. This will draw out access requests. Previously, the public body had thirty days; now it’s thirty business days. That’s thirty five percent longer. Easier on the public body, to be sure, but it will mean it takes longer to get requested information from public bodies.

An important change in the new FOIPOP is that it will include municipalities. The Commissioner's jurisdiction is significantly expanded through the consolidation of provincial and municipal regulation. Specifically, the new Act repeals Part XX of the Municipal Government Act and integrates municipalities and municipal bodies into the general FOIPOP framework. Part XX of the MGA was generally a mirror of FOIPOP, but with some significant differences. Bringing municipalities into FOIPOP means the Commissioner now has explicit and uniform jurisdiction to conduct reviews and investigations involving municipal units. The Review Officer's previous roles in handling appeals related to access and correction requests are maintained, but the new Act formalizes two new categories of complaint investigation called Privacy Reviews. These reviews can be initiated by individuals who believe their personal information was collected, used, or disclosed in contravention of the Act, or proactively by the Commissioner if there are reasonable grounds to suspect a contravention.

One of the most important changes is that the former “review officer” is now the Information and Privacy Commissioner of Nova Scotia, and will be an officer of the Nova Scotia House of Assembly. While still appointed by the Governor-in-Council, this position is much more independent of government than under the present Act. A big miss, at least as far as critics are concerned, is that the Commissioner does not have the ability to issue binding orders on public bodies. That position still just issues recommendations, and it’s up to applicants to go to court to get orders.

The 2027 Act introduces or revises numerous definitions, including “Personal information” which now explicitly includes IP addresses, biometric data, and genetic characteristics, while excluding business contact information.

In the part of the Act related to the right of access to public body records, changes clarify that the right of access extends to records in custody or control of a public body, but not to duplicates or exact copies. It says that part of a record that can be withheld and can be reasonably severed, access must be provided to the remainder of the record.

Not surprisingly, the amendments made earlier this year related to frivolous, vexatious and unduly repetitive requests have been continued in the new FOIPOP. The Commissioner must approve a request from a public body to disregard a request, with defined criteria and 14-business-day timelines for both application and decision. It does provide applicants with a right to appeal to the Supreme Court of Nova Scotia if their request is disregarded.

Almost all the timelines in FOIPOP have been extended. All procedural periods are now in business days (such as giving a public body 30 business days to respond to an access request). It also introduces an  explicit suspension of time calculations while fees are being negotiated or reviews are underway (s. 20).

The government gets to set a standard application fee pursuant to the regulations, and also sets  service-based fees but exempts requests for one’s own personal information and provides 3 free hours of work time. Public bodies can charge additional fees if the request will take more than three hours. When presented with a fee estimate, applicants may narrow their requests accordingly. Once the request is being processed, a public body can provide a “revised fee estimate” that the applicant can either accept or revise their request. Fee estimates and revised fee estimates can be referred to the Commissioner. 

There remains a possibility for fee waivers where disclosure serves a public interest (e.g., environment, public health, or safety), or if the applicant can’t afford to pay the fee.

One thing that is interesting and progressive: The new FOIPOP specifically says that public bodies must provide electronic records in “an electronic form that is capable of re-use”. This is positive. If the record is an Excel spreadsheet, the spreadsheet itself should be provided and not just a photocopy of the spreadsheet. (There are few things as useless and opaque as a print-out of an excel spreadsheet full of formulas.)

There are a number of changes that will restrict public and journalistic access to records. The first is an expansion of the definition of “legal privilege” to specifically include settlement privilege. And at section 86(2), the Information and Privacy Commissioner will not be able to inspect a record that is alleged to be privileged to determine if it actually is privileged. Only the Court can do that, and the process to get there can be set out in the regulations.

The second major restriction on the right to know is essentially excluding any right of access to any record that is defined as an “Executive Council record”, going well beyond what was traditionally “cabinet confidences.” To make it worse, in section 32(2), a head of a public body is prohibited from disclosing Executive Council records. There’s no discretion. 

The new Act expands the privacy sections substantially and in a good way, but most of the details will have to wait until we get to see the regulations.

Every public body will have to have a privacy policy and has to publicly disclose its internal privacy-complaint process.

Once the Act comes into effect, every public body will have to carry out a privacy assessment for any new or substantially changed “project, program, system or other activity involving the collection, use or disclosure of personal information”. The details for what must be in a privacy assessment will be determined in regulations. 

The new Act defines “Data-linking” programs – where two or more data sets are combined, either temporarily or permanently, and requires them to be carried out only in accordance with the yet to be seen regulations. 

There are some tweaks to the rules that permit a public body to collect, use or disclose personal information. These public sector privacy laws are generally not based on consent so these rules set the guardrails for public bodies. There are new rules related to inter-agency data sharing, research, and public-interest exceptions.

There’s a new explicit authorization for disclosure to protect individuals from intimate-partner violence or human trafficking.

The new Act introduces obligations to contain, assess, and notify affected individuals and the Commissioner of privacy breaches that pose a real risk of significant harm — aligning Nova Scotia with federal PIPEDA and other provincial models.

There is a weird new provision in s. 79 that authorizes a public body to go to court if “personal information in the custody or under the control of a public body has  been stolen or has been collected by or disclosed to a third party other than as  authorized by this Act”. They can get an order to return or destroy the personal information, or any other order the court considers appropriate to protect the personal information. 

If you’ve been reading or watching my stuff, you may recall that in 2020, the Government of Nova Scotia went to court to try to identify people who may have read unredacted Workers Compensation Appeal Tribunal decisions that were mistakenly given to the Canadian Legal Information Institute, known as CanLII, and they were posted online. I was one of the people they identified, and I was contacted by the government as part of their damage control.  (Here's a video I did on that on my YouTube channel: https://youtu.be/XETVLvkksj0.)

There’s also an interesting, quirky new section that essentially says that a public body is deemed to have not “collected” personal information if it does not relate to a program or activity of the public body, and they either delete it, return it or transfer it to another public body or federal government institution if it’s relevant to the other public body or institution’s programs or activities. 

Individuals still have a right to access their own information, and public bodies have an obligation to retain any information that has been used to make a decision directly affecting an individual for at least one year so the individual can exercise their access right. And also in such circumstances, the public body has to make every reasonable effort to make sure the information is accurate and complete.

While the former Privacy Review Officer Act existed separately, the new Act integrates and strengthens the privacy review powers directly within the consolidated statute, giving the Commissioner an explicit mandate to conduct Privacy Reviews. This authority can be used to investigate complaints that personal information has been improperly collected, used, or disclosed, and allows the Commissioner to proactively initiate an investigation if they have reasonable grounds to believe a contravention has occurred.

Finally, on the privacy side, the new FOIPOP revokes and replaces the Personal Information International Disclosure Protection Act or PIIDPA. That law generally prohibits a public body from allowing personal information to be stored outside of Canada or to be accessed from outside of Canada, subject to some exceptions. Under the new FOIPOP, a public body will only be allowed to store or permit access from outside of Canada in accordance with specific regulations, which we haven’t seen yet.

While the new independent Information and Privacy Commissioner is not granted the ability to issue orders or levy penalties in connection with access, correction or privacy reviews, the Commissioner does have broad powers in connection with carrying out such a review. The Commissioner can summon witnesses and compel records (other than records that are claimed to be privileged). The Commissioner can initiate a privacy review without a complaint or request if the “Commissioner has reasonable grounds to believe that a person has contravened or is about to contravene this Part”.

The Commissioner also has an important role to play in requests that a public body thinks is trivial, frivolous, vexatious or abusive. The public body has to seek the approval of the Commissioner to disregard such requests, which is an important check to prevent the overuse of these new provisions.

Individual complainants, exercising access, correction and privacy rights, still have recourse to the Supreme Court of Nova Scotia. In most cases, that will be following a review by the Information and Privacy Commissioner, but individuals do have the right to skip the Commissioner and go straight to the Supreme Court of Nova Scotia. Once you’re in the Court, it is what’s called a “de novo” proceeding meaning that the Court will determine the matter from the very beginning. And the court can issue binding orders.

Finally, the new FOIPOP expands the number and kind of offences that can result in charges and prosecution: this includes (a) willfully collecting, using or disclosing personal information in contravention of the Act, (b) willfully attempting to gain access to personal information in violation of the Act, (c) obstructing the Commissioner and (d) destroys, alters or falsifies a record to evade a request for access to records. 

So this represents a significant change to the privacy and access to information landscape in Nova Scotia. It repeals the old Freedom of Information and Protection of Privacy Act, the Privacy Review Officer Act, the Personal Information International Disclosure Protection Act and Part XX of the Municipal Government Act, replacing all of them with a new Freedom of Information and Protection of Privacy Act. As I said, it comes into effect in April 2027. 

This has been a relatively high-level overview of the new Act. Each time I read it, I find something new. I would encourage folks in Nova Scotia who have an interest in access to information and privacy to review the legislation, and let the government know if it raises any concerns. Though the process to get here has been the opposite of transparent, there is an opportunity before April 2027 to amend it before it comes fully into effect. 

Presentation: Access to Government Information

On Friday, November 23, 2019, I had the pleasure of presenting on the topic of access to government information with Janet Curry of the Workers Compensation Board at the Canadian Bar Association - Nova Scotia branch annual professional development conference. In case it's of interest, here's our presentation.

ACCESS TO GOVERNMENT INFORMATION (FOIPOP AND BEYOND!)

David Fraser, McInnes Cooper; Janet Curry, Workers’ Compensation Board of Nova Scotia

The panel will share their perspectives on advising clients on requests for access to information held by government and public bodies. They will share best
practices and tips from both sides – those making requests for access to information, and those responding to such requests.

You can download it in PDF format here.

Supreme Court to hear important case about legal privilege and access to information/privacy laws

This morning, the Supreme Court granted leave to appeal the Alberta Court of Appeal decision in University of Calgary v JR, 2015 ABCA 118.

In a nutshell, this will be a revisiting of Blood Tribe, but in the context of the provincial access to information laws that govern public bodies and government agencies.

Here’s the summary of the issue in appeal from the SCC website:

36460
Information and Privacy Commissioner of Alberta v. Board of Governors of the University of Calgary

(Alberta) (Civil) (By Leave)

Keywords Privacy - Access to information.

Summary

Case summaries are prepared by the Office of the Registrar of the Supreme Court of Canada (Law Branch) for information purposes only.

Privacy — Access to information — What words must a statute employ to empower a tribunal to review records to determine whether a claim of privilege is valid?

In the course of a wrongful dismissal suit by an individual against the respondent University, the University asserted solicitor-client privilege over certain material. The individual made an access to information request under s. 7 of the Freedom of Information and Protection of Privacy Act, R.S.A. 2000, c. F-25, seeking certain records about her in the University’s possession. The University provided some disclosure, but claimed solicitor-client privilege over some of the requested material. The Commissioner’s delegate eventually directed the University to the Commissioner’s “Solicitor-Client Privilege Adjudication Protocol”. When the University did not comply, the delegate issued a “notice to produce records” under s. 56(3) of the Act. It reads, in part, “[t]he Commissioner may require any record to be produced to the Commissioner and may examine any information in a record… [d]espite any other enactment or any privilege of the law of evidence”. The delegate indicated in an accompanying letter that the purpose of the notice was to enable him to determine whether solicitor-client privilege had been properly asserted because the University had not provided sufficient evidence to allow him to make that determination. The University sought judicial review of the delegate’s decision to issue the notice to produce. The Law Society of Alberta was granted intervener status at the Court of Queen’s Bench and the Court of Appeal. The application for judicial review was dismissed, and the subsequent appeal was allowed.

In the same batch of leave applications, the Court dismissed leave to appeal from the Ontario decision of Hopkins v. Kay, 2015 ONCA 112. In that Case, the Ontario Court of Appeal declined to throw out a class action brought against a health authority which had argued that the provinces Personal Health Information Protection Act was a complete code which ousts claims for intrusion upon seclusion.

Nova Scotia FOIPOP Review Officer resigns after not being reappointed

Dulcie McCallum has resigned as Freedom of Information and Protection of Privacy Review Officer, effective next week. Here's the message from her, released today:

Message from Dulcie McCallum

Freedom of Information and Protection of Privacy Review Officer

January 31, 2014

On January 17, 2014, I was advised by the government of Nova Scotia that it had elected not to offer me reappointment for another term as the Nova Scotia Freedom of Information and Protection of Privacy [“FOIPOP”] Review Officer which was an option available to it under the statute. Therefore I am announcing my departure from my position as Nova Scotia’s FOIPOP Review Officer is effective Tuesday February 4, 2014.

I was honoured to be appointed in 2007 as the first female FOIPOP Review Officer for Nova Scotia and in 2009 as Nova Scotia's first Privacy Review Officer. During my term, the oversight role of FOIPOP Review Officer was significantly expanded to include privacy under the Privacy Review Officer Act and access and privacy under the Personal Health Information Act. I have thoroughly enjoyed my seven year tenure in this position particularly having the support and collaboration of my Federal/ Provincial/ Territorial Access and Privacy Commissioner colleagues and being part of the effective and vibrant team at the FOIPOP Review Office.

I am most proud of how much our small team of only six people has accomplished over the past seven years: tabled six Annual Reports with the House of Assembly to which the FOIPOP Review Officer reports, received over 8,500 inquiries, opened 716 Reviews, closed 521 investigations, 314 of which were informally resolved or mediated, issued 62 public and private Review Reports, built up a body of best practices and hosted the 2012 Annual Summit of the Canadian Access and Privacy Commissioners for the first time in Nova Scotia.

My Director Ms. Carmen Stuart will be appointed as Acting FOIPOP Review Officer effective February 5, 2014. I am confident she will meet this challenge while a search is conducted for the new FOIPOP Review Officer. I trust that my team and I were able to effectively serve the access and privacy interests of Nova Scotians during this seven year period. In particular, the applicants who entrusted us with their Requests for Review and the public bodies, municipalities and health custodians who worked with my office to diligently protect the rights of access and privacy. Thank you for being given the opportunity to make a contribution to Nova Scotia’s public service.

Is university faculty e-mail subject to access and privacy laws?

Dan Michaluk has just blogged about an interesting case out of Alberta (University of Alberta v. Alberta (Information and Privacy Commissioner), 2011 ABQB 100) that may have a significant impact on freedom of information law, particularly in universities. It will also have an impact on cloud computing decisions by universities. The Canadian Association of University Teachers takes the position that faculty e-mail are not under the "custody and control" of the educational institution. If this is found to be the case, faculty e-mail is not within the ambit of access to information laws at all and the privacy protection provisions of those laws. And, if that's the case, such e-mails are not covered by laws that are meant to regulate the export of personal information (out of fear of the USA Patriot Act). Stay tuned ....

See Dan's post: Alberta Court set to Hear Faculty E-mail Case « All About Information

US Supreme Court: Corporations do not have personal privacy rights under US Freedom of Information law

The United States Supreme Court has just ruled today that the personal privacy exemptions in the US Freedom of Information Act do not protect information about corporations. In short, corporations do not have a personal privacy right.

This is consistent with the Canadian approach.

FCC v. AT&T Inc. :: Volume 562 :: Docket Number 09-1279 :: 2011 :: Syllabus :: US Supreme Court Cases from Justia & Oyez

SYLLABUS

OCTOBER TERM, 2010

FCC V. AT&T INC.

SUPREME COURT OF THE UNITED STATES

FEDERAL COMMUNICATIONS COMMISSION et al. v. AT&T INC. et al. certiorari to the united states court of appeals for the third circuit No. 09–1279. 

Argued January 19, 2011—Decided March 1, 2011

The Freedom of Information Act requires federal agencies to make records and documents publicly available upon request, subject to several statutory exemptions. One of those exemptions, Exemption 7(C), covers law enforcement records the disclosure of which “could reasonably be expected to constitute an unwarranted invasion of personal privacy.” 5 U. S. C. §552(b)(7)(C). CompTel, a trade association, submitted a FOIA request for documents AT&T had provided to the Federal Communications Commission Enforcement Bureau during an investigation of that company. The Bureau found that Exemption 7(C) applied to individuals identified in AT&T’s submissions but not to the company itself, concluding that corporations do not have “personal privacy” interests as required by the exemption. The FCC agreed with the Bureau, but the Court of Appeals for the Third Circuit did not. It held that Exemption 7(C) extends to the “personal privacy” of corporations, reasoning that “personal” is the adjective form of the term “person,” which Congress has defined, as applicable here, to include corporations, §551(2).

Held: Corporations do not have “personal privacy” for the purposes of Exemption 7(C). Pp. 3–12.

(a) AT&T argues that the word “personal” in Exemption 7(C) incorporates the statutory definition of “person,” which includes corporations, §551(2). But adjectives do not always reflect the meaning of corresponding nouns. “Person” is a defined term in the statute; “personal” is not. When a statute does not define a term, the Court typically “give[s] the phrase its ordinary meaning.” Johnson v. United States, 559 U. S. ___, ___. “Personal” ordinarily refers to individuals. People do not generally use terms such as personal characteristics or personal correspondence to describe the characteristics or correspondence of corporations. In fact, “personal” is often used to mean precisely the opposite of business-related: We speak of personal expenses and business expenses, personal life and work life, personal opinion and a company’s view. Dictionary definitions also suggest that “personal” does not ordinarily relate to artificial “persons” like corporations.

AT&T contends that its reading of “personal” is supported by the common legal usage of the word “person.” Yet while “person,” in a legal setting, often refers to artificial entities, AT&T’s effort to ascribe a corresponding legal meaning to “personal” again elides the difference between “person” and “personal.” AT&T provides scant support for the proposition that “personal” denotes corporations, even in a legal context.

Regardless of whether “personal” can carry a legal meaning apart from its ordinary one, statutory language should be construed “in light of the terms surrounding it.” Leocal v. Ashcroft, 543 U. S. 1, 9. Exemption 7(C) refers not just to the word “personal,” but to the term “personal privacy.” “Personal” in that phrase conveys more than just “of a person”; it suggests a type of privacy evocative of human concerns—not the sort usually associated with an entity like AT&T. AT&T does not cite any other instance in which a court has expressly referred to a corporation’s “personal privacy.” Nor does it identify any other statute that does so. While AT&T argues that this Court has recognized “privacy” interests of corporations in the Fourth Amendment and double jeopardy contexts, this case does not call for the Court to pass on the scope of a corporation’s “privacy” interests as a matter of constitutional or common law. AT&T contends that the FCC has not demonstrated that the phrase “personal privacy” necessarily excludes corporations’ privacy. But construing statutory language is not merely an exercise in ascertaining “the outer limits of [a word’s] definitional possibilities,” Dolan v. Postal Service, 546 U. S. 481, 486, and AT&T has provided no sound reason in the statutory text or context to disregard the ordinary meaning of the phrase. Pp. 3–9.

(b) The meaning of “personal privacy” in Exemption 7(C) is further clarified by two pre-existing FOIA exemptions. Exemption 6, which Congress enacted eight years before Exemption 7(C), covers “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” §552(b)(6). This Court has regularly referred to Exemption 6 as involving an “individual’s right of privacy,” Department of State v. Ray, 502 U. S. 164, 175, and Congress used in Exemption 7(C) the same phrase—“personal privacy”—used in Exemption 6. In contrast, FOIA Exemption 4, which protects “trade secrets and commercial or financial information obtained from a person and privileged or confidential,” §552(b)(4), clearly applies to corporations. Congress did not use any language similar to that in Exemption 4 in Exemption 7(C). Pp. 9–11. 582 F. 3d 490, reversed.

Roberts, C. J., delivered the opinion of the Court, in which all other Members joined, except Kagan, J., who took no part in the consideration or decision of the case.

Saskatchewan Privacy Commissioner cuts services due to lack of funds

The Privacy Commissioner of Saskatchewan is reportedly having to scale back services after the provincial government nixed a request for additional resources to hire another investigator. Gary Dickson's office not only administers the public sector access and privacy law, but he has to deal with the health privacy law that covers public and private sector healthcare.

I'm not sure you can truly be independent of the government if you have to go begging to it for adequate funds.

Saskatchewan privacy commissioner cuts services citing lack of resources - Winnipeg Free Press

REGINA - Saskatchewan's privacy commissioner says his office is in crisis and is being forced to cut back services because of a lack of funding from the provincial government.

Gary Dickson says surging demand for service has overwhelmed his office and the current three investigators cannot sustain the caseload.

He says despite his plea, the government's Board of Internal Economy has denied a request for $129,000 to hire another investigator and set up office space for that person.

"I've said to the board when I appeared in front of them, and I used the word very consciously, our office is in a crisis in terms of being swamped with demands for service from the people who live in the province," Dickson said Monday.

"We just cannot possibly ... respond to that demand in any kind of reasonable time frame."

Dickson says the number of reviews and complaints is up by 113 per cent over last year. Requests for advice and inquiries from public bodies and health trustees are also up.

Some people have been waiting for more than three years for a resolution to their case file, he says. The three investigators currently have a caseload of 376 reviews and investigations.

"Something has to give," says Dickson.

"So what we've decided to do is try and be transparent to the people of the province in terms of how this is going to translate into waits and delays."

The commissioner says his office will send letters to everyone who requests an investigation or review alerting them that they should not expect any action on their file for approximately 12 to 18 months.

Dickson also says all public organizations should expect significant cutbacks and delays if they need consultation on a project.

The privacy commissioner's office oversees some 3,000 bodies including ministries, Crown corporations, boards, commissions, agencies, schools, regional health authorities, municipalities, universities, colleges and health trustees.

The commissioner says the decision by the board will diminish how accountable public bodies are to the people of Saskatchewan.

"Manitoba, with roughly the same population, would have six investigators. Newfoundland and Labrador I think has more than six investigators (and) half the population. They certainly don't oversee 3,000 public bodies and health trustees," says Dickson.

Saskatchewan Justice Minister Don Morgan, who sits on the board of internal economy, says the privacy commissioner's budget has been steadily rising since 2002. That can't continue during tough financial times, he says.

"We're in times of fiscal restraint and we're expecting all ministries, all government agencies to try and work within existing budgets wherever they can," says Morgan.

The province is trying to cope with a big hole in last year's budget when potash revenue fell $1.8 billion.

The Saskatchewan government will deliver its new budget March 24, but Premier Brad Wall has already warned there won't be big spending increases - in fact, cuts are in the works.

Morgan said there's no way of controlling how many complaints the privacy commissioner's office receives, but he wants to cut the number if possible.

"We would like to work with the privacy commissioner to find ways that we can reduce the backlog in their office and try and find some efficiencies by having more of the requests dealt with at the ministry levels rather than through his office," he says.

Who do our privacy laws protect?

I was intereviewed by a New Brunswick journalist last week who was writing an article on how privacy laws can be used in a knee-jerk way to limit access to government information. The article, I expect, is a reaction to a number of stories out of NB where reporters were given the excuse of privacy laws to limit their access to information about potential high-risk offenders, the investigation of a motor vehicle accident that claimed a number of lives and public sector salaries.

Here is the bit that I contributed:

nbbusinessjournal.com - Who do our privacy laws protect?

Governments must protect citizens' public information [note: I'm sure I said "private information"] while still being accountable and transparent to the public, said David Fraser, a privacy lawyer with the Atlantic Canadian law firm McInnes-Cooper.

For example, the expenses for a cabinet minister's trip to Europe would likely be made public. However, a doctor's billing records, which would essentially reveal their salary, are only made available in some provinces, he said.

And although some form of privacy legislation has existed federally for quite some time, that doesn't mean the laws regulate every activity on the internet.

"It regulates commercial activities. So it says what information your bank can ask about you and what it can do with it, or your local video store," said Fraser. "But if an individual takes a picture of another person on their camera phone in embarrassing circumstances and then they post it on the Internet that's a personal use, not a commercial use, so that's not caught by that law." There are some circumstances where personal information can be released. For example, if an individual gives consent.

As well, personal information can be disclosed if it's deemed to be for the greater good of the public.

"I think people, just as a knee-jerk reaction, they say no - it's personal information," said Fraser.

An access odyssey in the UK

The Guardian has an interesting article on John Harris' odyssey of exercising his access rights under the Data Protection Act. He had quite an experience, between credit files he never knew existed and a mobile phone company that made up rules on the fly. I'm surprised no Canadian journalist has tried this under PIPEDA so far, but one or two may follow Harris' example. Check it out: The John Harris files UK news The Guardian.

Court of Appeal considers insured's right of access to IME notes

Last month, the Federal Court of Appeal issued its decision in Wyndowe v. Rousseau, 2008 FCA 39 (CanLII). This case involved an individual's request for access to information generated by a physician hired by his insurer for the purposes of an independent medical examination. At trial, Justice Tietelbaum held the information was "personal information" for the purposes of PIPEDA and that it was not covered by litigation privilege (See Rousseau v. Wyndowe, 2006 FC 1312 (CanLII) and Canadian Privacy Law Blog: FCA grants stay of judge's order for disclosure of personal information). The question of litigation privilege was not appealed.

The Federal Court of Appeal has some interesting things to say about the interplay of the common law and PIPEDA, the definition of personal information, the nature of "commercial activities".

On the question of "commercial activities", the Court was clear that the collection of the applicant's personal information was in the course of commercial activities:

[35] The question is whether the IME transaction was of a “commercial nature”, as defined in section 2. The transaction between Dr. Wyndowe’s corporation and Maritime Life, who was paying for the IME, is of a commercial nature. Mr. Rousseau’s relationship between himself and Maritime Life is also clearly of a commercial nature: it is governed by a contract between Mr. Rousseau and his insurer, where Mr. Rousseau presumably paid some premiums (or his employer paid the premiums as part of Mr. Rousseau’s compensation for employment) and he therefore may or may not be entitled to benefits.

[36] In the context of these two commercial relationships – between Dr. Wyndowe’s corporation and Maritime Life on the one hand and between Mr. Rousseau and Maritime Life on the second hand – I find it hard to believe that by introducing a third relationship – between Dr. Wyndowe and Mr. Rousseau – the commercial nature of the overall transaction is defeated. In my view, Dr. Wyndowe is merely the medical agent of Maritime Life. If Dr. Wyndowe worked as a full time doctor for Maritime life, there would be no question the transaction is commercial; being examined by him would merely be a step which Mr. Rousseau had to follow to collect his benefits. In that sense the examination would be akin to filling out a form required by Maritime Life in order to begin collecting benefits. Just because Dr. Wyndowe is an independent consultant hired by Maritime Life does not change the fact that the overall transaction retains its commercial nature. It also does not change the fact that Mr. Rousseau was only doing what his contract with Maritime Life required him to do to maintain his benefits, i.e. submitting to an IME.

With respect to whether the information is "personal information" of the applicant, the Court concluded it was:

[49] In light of the Privacy Commissioner’s recognition that there are in the notes information which is personal to Mr. Rousseau and information which is not, it may be said that in the end, Mr. Rousseau has a right of access to the information he gave the doctor, and to the final opinion of the doctor in the form of the report to the insurer. In accordance with Principle 4.9.1. of Schedule I to the PIPED Act, this enables Mr. Rousseau to correct any mistakes in the information he gave the doctor or which the doctor noted, as well as any mistakes in the doctor’s reasoned final opinion about his medical condition. But the process of getting to that final opinion from the initial personal information of Mr. Rousseau belongs to the doctor.

[50] This Court, in Canada (Information Commissioner) v. Canada (Minister of Citizenship and Immigration) (above, at para. 8), has recognized that “the same information can be “personal” to more than one individual” (at para. 15). It may well be, in the end, that some information in the notes will be personal to both Mr. Rousseau and Dr. Wyndowe. A balancing exercise similar to that proposed in our ruling in Canada (Information Commissioner) would then need to be performed.

And on the interplay between the common law and PIPEDA:

[26] A) the common law

The appellant first submits that as the PIPED Act does not clearly and unambiguously override the common law respecting the right of access to one’s personal health record, the common law should apply. At common law, as the argument goes, the right to inspect one’s medical records is only recognized where there is a fiduciary relationship between physician and patient (see McInerney v. MacDonald, 1992 CanLII 57 (S.C.C.), [1992] 2 S.C.R. 138. As there is no fiduciary relationship between the insured and the insurer’s doctor performing an IME (see X(Minors) v. Bedfordshire County Council, [1995] 3 All E.R. 353 (H.L.), the insured has no right of access to his medical records.

[27] I am not persuaded that at common law an insured has no right of access to his medical records. In any event, it is my view that the common law should not prevail where the very purpose of the PIPED Act is to provide new privacy protections to Canadians not otherwise enjoyed under the common law.

In the result, the Court of Appeal held that the applicant/insured had a right of access to the notes of the examining physician under PIPEDA.

Developments in UK data protection law

DP Thinker has posted a few developments in UK data protection law:

DP thinker: A few developments

Just a few developments to note on data protection in the UK:

1) The draft Data Retention (EC Directive) Regulations 2007 will take effect on 1st October 2007. These regulations implement the Data Retentions Directive 2006/24/EC and will apply to public electronic communications providers. Data will be retained for a period of 12 months from the date of communication (Regulation 4(2)). The types of data to be retained are telephone numbers and mobile numbers (Regulation 5(1) and 5(2)). The regulations do not apply to data from internet access, e-mail and internet telephony (VoIP). The Information Commissioner will monitor the application of these regulations (Regulation 8). A comparison of the other European Member States' Laws implementing the Data Retentions Directive 2006/24/EC can be found here.

2) On 24 October 2007, the transitional exemptions under the UK Data Protection Act 1998 will end. This means that structured manual filing systems containing personal records will be covered under the Data Protection Act, but would apply to data that was held before October 1998. The Durant case will be relevant, which took the view that most manual file files are not relevant filing systems.

3) Draft Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2007 - The Government has drafted amended freedom of information (FOI) fees regulations which will allow public authorities to take into account more comprehensively the work involved in dealing with an FOI request. The consultation was completed in June, but further details can be found here.

New Information Commissioner takes up post

Canada's new Information Commissioner, Robert Marleau, took up his post yesterday. You may recall that he was the interim Privacy Commissioner after George Radwanski's resignation until the current Commissioner's appointment.

From the Government of Canada news release:

Prime Minister Welcomes New Information Commissioner

15 January 2007

Ottawa, Ontario

Prime Minister Stephen Harper today welcomed Canada’s new Information Commissioner, Mr. Robert Marleau, whose appointment was recently approved by the Senate and the House of Commons. This appointment is effective January 15, 2007.

The Prime Minister took the opportunity to commend Mr. John Reid, who had been serving as Information Commissioner since August 1, 1999 and whose term expired on September 30, 2006, for the commitment, diligence, and professionalism he demonstrated during his tenure. The Prime Minister wished him well in his future endeavours.

The Office of the Information Commissioner was created in 1983 under the Access to Information Act - Canada’s freedom of information legislation. An agent of Parliament, the Information Commissioner oversees the implementation of the Access to Information Act by government institutions. The Information Commissioner investigates complaints from individuals who believe they have been denied rights under the Act. The Information Commissioner is also responsible for mediating between dissatisfied applicants and government institutions.

Biographical notes on Mr. Marleau are attached.

* * * *

ROBERT MARLEAU, B.A., D.U.

Robert Marleau served Parliament and the members of the House of Commons for 31 years, 13 of which were spent as Clerk of the House of Commons. Mr. Marleau left a rich legacy of achievement, including the guide book, House of Commons Procedure and Practice, which he co-authored with then Deputy Clerk Camille Montpetit.

During his parliamentary career, Mr. Marleau held several senior positions as an advisor to seven Speakers and to Members and Senators for nine Parliaments. A franco-Ontarian, Mr. Marleau is a graduate of the University of Ottawa, where he earned a B.A. in French Literature. He joined the House of Commons in 1970 as a Committee Clerk and went on to hold such positions as Clerk Assistant of the House of Commons and Deputy Secretary General of Parliamentary Relations. In July 1987, he was appointed Clerk of the House of Commons, and served in that capacity until July 2000.

From July 2000 until his retirement at the end of January 2001, he served as Senior Advisor to the Speaker of the House of Commons. On his retirement, the House of Commons made Mr. Marleau an Honorary Officer of the House by unanimous resolution. Following his retirement from the House of Commons, Mr. Marleau was Principal of RDM Consulting, a parliamentary consulting practice with work in Canada, Africa and the Caribbean. From July 2, 2003 until November 30, 2003, he was appointed to serve as Interim Privacy Commissioner.

Mr. Marleau is the recipient of an Honorary Doctorate degree from Ottawa University, his alma mater. He is a member of the Commonwealth Society of Clerks at the Table, the Association of Canadian Clerks at the Table, and the Canada/USA Association of Clerks and Legislative Secretaries

Nova Scotia's new FOIPOP review officer

As of February 5, 2007, Nova Scotia will have a new review officer under the Freedom of Information and Protection of Privacy Act:

News Release: Department of Justice

New FOIPOP Review Officer Appointed

Department of Justice

January 11, 2007 8:20

---

Dulcie McCallum, former Ombudsman for the Province of British Columbia, is Nova Scotia's new Freedom of Information and Protection of Privacy Review Officer.

Ms. McCallum will oversee how provincial and municipal governments protect the privacy of Nova Scotians and respond to requests for access to information.

"I'm pleased that Ms. McCallum has agreed to take on this important role," said Justice Minister Murray Scott. "The courts have recognized our legislation as being among the most open, progressive information and privacy laws in the country. Ms. McCallum brings tremendous expertise and knowledge to this office, particularly in the areas of the rights of persons with disabilities and children, constitutional matters and justice issues."

Ms. McCallum received her law degree from the University of Victoria and has expertise in administrative and human rights law. Over the past 30 years, Ms. McCallum has held positions in private practice and in the public sector. She was Ombudsman for the Province of British Columbia for seven years, until 1999. Since then, Ms. McCallum has worked for government and a number of organizations, including representative on the Canadian Delegation to the United Nations, to draft the new UN Convention on the Rights of Persons with Disabilities.

"I am thrilled to be named the new FOIPOP Review Officer and am ready to serve Nova Scotians in this important office," said Ms. McCallum. "I moved to rural Nova Scotia just over a year and a half ago from Victoria, British Columbia.

"Living in Sherbrooke has been one of the most rewarding times of my life. This new opportunity, which will enable me to work throughout the province to ensure citizens' rights of access and privacy are respected, is both a great honour and privilege."

The review officer is an independent ombudsman appointed by the Governor in Council for a term of five to seven years. The review officer will accept appeals from people and organizations who are not satisfied with the response they received from government departments or other public bodies such as hospitals, universities and school boards.

The review officer may make recommendations to the public body. The public body must respond in writing to the report. If the applicant, or a third party, is not satisfied with the outcome of a review, an appeal may be made to the Supreme Court of Nova Scotia.

The selection process for a new review officer was led by the Public Service Commission. An independent selection advisory committee, chaired by Auditor General Jacques Lapointe, recruited candidates for the position. The committee reviewed 70 applications and interviewed six candidates.

Ms. McCallum will assume office on Feb. 5.

Right to Know Coalition of Nova Scotia

The new access to information advocacy organization for Nova Scotia, the Right to Know Coalition of Nova Scotia, has a new blog: Right to Know Coalition of Nova Scotia.