British Columbia Commissioner finds that "Creep Catchers" violated province's privacy law

The Information and Privacy Commissioner of British Columbia has just released a very interesting decision and order against the "Surrey Creep Catchers". The Creep Catchers are a loosely affiliated group of people whose stated purpose is to expose online predators, particularly those who will then arrange to meet with children for nefarious purposes. Their modus operandi is to engage with people online, on dating sites and other sites, suggest they are underage and arrange a meeting. They then post video, chat logs, etc. to "expose" or shame the individuals.

In this case, two individuals who were targeted complained to the Information and Privacy Commissioner, who has found that the Creep Catchers violated the Personal Information Protection Act of BC. Most interestingly, the decision found (a) they are an "organization" for the purposes of the Act, (b) they are not engaged in journalism, so that exclusion doesn't help them, and (c) they cannot take advantage of the consent exceptions that apply for legitimate investigations.

A bit troubling is the uncritical following of the definition of journalism used in the Globe24h.com decision of the Federal Court. One will hopefully recall that case was uncontested and the Court simply adopted the restrictive definition put forward by the Office of the Privacy Commissioner of Canada:

[18] In order for s. 3(2)(b) to apply, the Organization must be collecting, using, or disclosing personal information for a journalistic purpose. In A.T. v. Globe24h.com, the Federal Court of Canada considered what constitutes journalism for the purposes of the analogous section of the Personal Information Protection and Electronic Documents Act (PIPEDA).

The “journalistic” purpose exception is not defined in PIPEDA and it has not received substantive treatment in the jurisprudence. The OPCC submits that the Canadian Association of Journalists has suggested that an activity should qualify as journalism only where its purpose is to (1) inform the community on issues the community values, (2) it involves an element of original production, and (3) it involves a “self-conscious discipline calculated to provide an accurate and fair description of facts, opinion and debate at play within a situation”. Those criteria appear to be a reasonable framework for defining the exception. None of them would
apply to what the respondent has done.

[19] I use the above three criteria to determine whether an organization is carrying out its activities for a journalistic purpose under s. 3(2)(b) of PIPA.

I have cautioned before that one should be cautious in applying Globe24h because the entire court case was unopposed and the Court appears to have simply adopted the OPC's argument without too much critical discussion.

It should also be noted that the BC statute applies to a broader range of "organizations" than PIPEDA, for example. If this case were to arise under the federal statute, I'm not sure the OPC would be able to find jurisdiction.

Here is the summary of the decision prepared by the OIPC:

Two individuals complained that an organization improperly collected, used and disclosed their personal information. The organization had induced each individual to have online communication with a fictitious woman over the age of 18, subsequently conveyed that this decoy was under the age of 16, and arranged a meeting to confront each man for attempting to lure a minor. The organization video-recorded the encounter and disseminated the video on social media. The Acting Commissioner found that the organization collected, used and disclosed the complainants’ personal information contrary to the Personal Information Protection Act because it had not obtained their consent and had no other authority to collect, use or disclose their personal information. He ordered the organization to stop collecting, using and disclosing the complainants’ personal information, to destroy all of their personal information in its custody or under its control, and to ask others who disseminated the information to remove and destroy it as well.​

U.S. (correctly) identifies some Canadian privacy laws as trade barriers

The United States Trade Representative has released its latest Report on Foreign Trade Barriers [PDF] which specifically identifies certain Canadian provincial privacy laws as non-tariff trade barriers. It points to the public sector privacy laws in British Columbia and Nova Scotia and singles out Canadian federal government procurement of cloud services:

Cross-Border Data Flows

The strong growth of cross-border data flows resulting from widespread adoption of broadband-based services in Canada and the United States has refocused attention on the restrictive effects of privacy rules in two Canadian provinces, British Columbia, and Nova Scotia. These provinces mandate that personal information in the custody of a public body must be stored and accessed only in Canada unless one of a few limited exceptions applies. These laws prevent public bodies such as primary and secondary schools, universities, hospitals, government-owned utilities, and public agencies from using U.S. services when personal information could be accessed from or stored in the United States.

The Canadian federal government is consolidating information technology services across 63 email systems under a single platform. The request for proposals for this project includes a national security exemption which prohibits the contracted company from allowing data to go outside of Canada. This policy precludes some new technologies such as “cloud” computing providers from participating in the procurement process. The public sector represents approximately one-third of the Canadian economy, and is a major consumer of U.S. services. In today’s information-based economy, particularly where a broad range of services are moving to “cloud” based delivery where U.S. firms are market leaders; this law hinders U.S. exports of a wide array of products and services.

This has prompted Daniel Tencer to write in the Huffington Post that "U.S. Pushes Canada To Loosen Privacy Laws". These laws were designed to thwart the USA Patriot Act by requiring public bodies in those jurisdictions to only allow personal information to be stored in Canada and only accessed from within Canada.

As a practitioner of privacy law who has to deal with these statutes on a regular basis, I tend to agree and think the fine citizens of Nova Scotia and British Columbia would be better off without them. I have seen, on many occasions, government functionaries simply say "no" to non-Canadian vendors because of privacy risks they do not understand, denying their citizens access to leading-edge, cost saving technology. It is much simpler and easier to say "no"

The BC law came into being as a result of a public sector trade union objecting to the possible outsourcing of medicare claims processing to the Canadian subsidiary of a US corporation. When the union realized it would not get public support for their jobs, they might be able to create a spectre of the US government getting their mitts on sensitive information under the Patriot Act. The result was the BC legislation. (Ironically, the outsourcing still took place after a very convoluted corporate structure was put in place.)

Similarly, a back-bench NDP politician stood up in the legislature and raised the exact same spectre. A short while later, Nova Scotia passed the Personal Information International Disclosure Protection Act. While the Nova Scotia law is much more flexible than the B.C. statute, both are a ham-fisted response to a really nuanced issue. Instead of asking the question about the real risk to data, the default answer is always "no" when a non-Canadian vendor puts forward a cloud computing solution to a government agency.

If these laws were designed to prevent non-Canadian vendors from getting a piece of government business, they've done that quite well. But they do not actually accomplish the objective of keeping personal information out of the hands of U.S. authorities under all circumstances. To begin with, if the Americans want data that's in Canada, they are likely to get it. Canada, the United States and most western democracies engage in a very high level of cooperation that includes mutual legal assistance treaties and ad hoc information sharing. If US agencies are interested in an individual who has ties to Canada, the Federal Bureau of Investigation can make a formal request of the Royal Canadian Mounted Police or CSIS to obtain the relevant information on their behalf. (Most Canadian privacy laws actually permit this sort of information sharing under treaties or informal arrangements.) And if you are concerned about covert access to this sort of data, American laws do not prohibit federal agencies from infiltrating computers and networks outside of the United States. Some have suggested that information is safer from U.S. authorities in the U.S. because of this.

In addition, any person or corporation with sufficient ties to the United States can be compelled to hand over data regardless of where it is. This can include fully Canadian corporations with assets in the U.S. This can also take place if handing over the data would violate Canadian laws. The Huffington Post article refers to the Canadian federal government's decision to give a massive cloud "shared services" contract to Bell Canada when U.S. vendors were disqualified from even submitting a proposal. Does this make the data "safe" from the Americans? Not really, since the parent company of Bell Canada is publicly traded on the New York stock exchange. They simply can't ignore a U.S. court order.

So what's the solution to this "problem"? It would be the policy that the federal government purports to have, but does not seem to have followed in the shared services contracting. That is to do a full privacy impact assessment in all cases which fully evaluates all of the risks to privacy associated with the project, including what risks that cross-border data flows might introduce. And when I saw all the risks, I mean with a fully-informed understanding of the circumstances under which non-Canadian governments might get their hands on the data. In some cases, the risk introduced by crossing the border may be unpalatable, but at least it is an informed decision.

The current practice of simply saying no to non-Canadian vendors is a non-tariff trade barrier.

Massive BC privacy breach involves millions of health records

The Canadian Press, via the CBC, is reporting on a series of new data breaches from British Columbia that likely involved millions of health records. And, as with the HRSDC breaches, portable electronic USB storage devices are involved.

It appears that the province is not planning to notify everyone involved.

B.C. privacy breach shows millions affected - British Columbia - CBC News:

Ministry notifying more than 38,000 people about shared data

The personal-health data of millions of British Columbians has been accessed without proper authorization, and in the most serious cases, the provincial government says it will notify 38,486 individuals of the breaches by letter.
Health Minister Margaret MacDiarmid made the announcement as part of an ongoing investigation into research-grant practices between ministry employees and researchers at the universities of B.C. and Victoria.

MacDiarmid said that during three separate instances in October 2010 and June 2012, the health information was saved on USB sticks and shared with researchers or contractors without the proper permission or protocols.

McDiarmid said the data did not include names, addresses or financial information, but it wasn't supposed to be shared with other health researchers.

Also included was data from Statistics Canada's Canadian Community Health Survey, including information on the mental, physical and sexual health of individuals, as well as their lifestyles and the use of health services.

“We don't have any evidence at all that any of this information was used for any purpose other than health research. There is minimal if any risk that this information that would be used in a way that would be harmful to these individuals.”
MacDiarmid said her ministry decided to write the letters following discussions with the Office of the Information and Privacy Commissioner.

Elizabeth Denham, the information and privacy commissioner, also said Monday her independent investigation should be complete in the coming weeks, and she will then issue a public report with findings and recommendations.

Seven ministry workers have already been fired, sparking two separate lawsuits.

British Columbia bridge implements plate-based tolling

The Golen Ears Bridge in British Columbia is the first toll highway/bridge in Western Canada to follow the lead of Toronto's 407 ETR to implement electronic tolling using plate identification.

Spokespeople are attempting to soothe privacy fears, but I'm not sure it goes far enough:

Vehicles crossing Golden Ears Bridge will be tracked, TransLink says

...

But TransLink spokesman Ken Hardie said people shouldn't worry about their privacy being invaded.

He said billing agents who send toll bills by mail will be the only ones who usually have access to who crosses the bridge.

Police conducting criminal investigations will also have access, he said, just as they are able to access digital video recorded at SkyTrain stations.

Private individuals will be out of luck.

"If a jealous husband comes along and says, 'I want to know if my wife went across the bridge at a certain time', he won't be able to. That information is protected," he said.

Hardie said TransLink conducted a privacy impact assessment on Golden Ears bridge tolling, and had it approved by the Freedom of Information and Privacy office in Victoria.

"We've taken all the steps to satisfy them [privacy officials] that the records will be kept and managed in an appropriate way," he said.

"The key issues are what kind of record is being created, how long do you keep it, how do you store it and who has access to it," said Hardie.

If you ask me, police shouldn't get any of the information unless they show a warrant and spouses should know that an ordinary civil subpoena will probably pry that info loose from TransLink without too much hassle.

PIPA review released in BC

The Special Committee of the BC Legislature reviewing the Personal Information Protection Act has recently released its report:

April 17, 2008: Special Committee Recommends Changes to Streamline B.C.’s Private-Sector Privacy Law Media Releases Special Committee to Review the Personal Information Protection Act 4th Session 38th Parliament Committees

SPECIAL COMMITTEE RECOMMENDS CHANGES TO STREAMLINE B.C.’S PRIVATE-SECTOR PRIVACY LAW

VICTORIA – The Special Committee to Review the Personal Information Protection Act submitted its Report to the Legislature this afternoon. The all-party committee was appointed in 2007 by the Legislative Assembly to review the act that regulates the collection, use and disclosure of personal information by private-sector organizations in the province. During the past year, the committee received 39 submissions.

The key findings from the consultations are that the act seems to be working well overall for private-sector organizations operating in British Columbia, while the public is not as aware of the purpose, rules and scope of the act. The act also aligns with the federal and Alberta private-sector privacy laws.

The report, titled Streamlining British Columbia’s Private Sector Privacy Law, was unanimously adopted by all committee members. The report contains 31 recommendations, including:

• Making private-sector organizations accountable for personal information they transfer for processing outside Canada
• Requiring organizations to notify affected individuals of privacy breaches in certain circumstances
• Banning the use of blanket consent forms by provincially regulated financial institutions
• Revising consent exceptions to better address business practices in the insurance industry
• Permitting disclosure of personal contact information for health research
• Retaining the minimal fee for access to personal information
• Streamlining the complaints process in the province’s privacy laws
• Strengthening the Information and Privacy Commissioner’s oversight powers

“Keeping personal information private is vitally important,” said committee chair Ron Cantelon, MLA. “We want to enhance safeguards, but at the same time, balance that goal against imposing unnecessary regulations on business, particularly small businesses.”

The members of the Special Committee to Review the Personal Information Protection Act are:

Ron Cantelon, MLA Nanaimo-Parksville

Harry Lali, MLA Yale-Lillooet

Leonard Krog, MLA Nanaimo

Mary Polak, MLA Langley

John Rustad, MLA Prince George-Omineca

Information about the committee’s work can be found on its website at http://www.leg.bc.ca/cmt/pipa/index.asp, or by contacting the committee chair, Ron Cantelon, MLA, or any committee member.

B.C. introduces law governing access, privacy of electronic health records

British Columbia's government has just recently introduced legislation specifically tailored for privacy and access to electronic health records.

E-HEALTH STATUTE INCREASES PATIENT ACCESS AND PRIVACY

April 10, 2008

Ministry of Health

E-HEALTH STATUTE INCREASES PATIENT ACCESS AND PRIVACY

VICTORIA – A new e-Health (Personal Health Information Access and Protection of Privacy) Act introduced today moves British Columbia a step closer to the goal of giving citizens access to their health records and medical information, while strengthening privacy protection, said Health Minister George Abbott.

“This new e-Health legislation moves us forward in meeting our throne speech commitment to give citizens better access to their health records and medical information so they can engage in a more informed role in their own health-care choices,” said Abbott. “eHealth will give patients faster, safer and better health care by providing authorized health-care professionals with secure access to patients’ information to make the best and most timely clinical decisions.”

British Columbia is the first province in Canada to create a specific legislative framework governing access and privacy for electronic health information databases. While other provinces have access and privacy legislation governing personal health information, British Columbia will be going above and beyond the provisions of the Freedom of Information and Protection of Privacy Act with new legislation containing specific provisions to address access to information and protection of privacy of electronic health information.

“As e-Health information becomes a more widely accessible and used tool in our health-care system, we want to ensure British Columbia has a framework that allows for the most effective medical and health-research related use of electronic health database information,” said Abbott. “But we also have to ensure that the framework surrounding use of electronic health information is to the highest standards of privacy protection.”

Individuals will be able to block access to their own information in Health Information Banks from all health professionals, with the only overriding clause being in the case that the person is incapacitated in an emergency or with the person’s consent. Maximum fines for violations of the act have been increased from $2,000 under the Pharmacists, Pharmacy Operations and Drug Scheduling Act to $200,000 under the new act.

The act specifically prohibits disclosing information from electronic databases for market research, while creating a Data Stewardship Committee that will evaluate requests for the disclosure of data for health research or planning purposes.

The e-Health (Personal Health Information Access and Protection of Privacy) Act will also introduce legislative changes so medical researchers can approach individuals regarding health research studies, while respecting personal privacy and patient confidentiality. Individual requests by researchers to contact persons for health research from database information will require the specific approval of the Information and Privacy Commissioner.

“Patients and former patients can provide invaluable information in chronic disease research,” said Barbara Kaminsky, CEO of the Canadian Cancer Society. “Previously, researchers we fund could not even contact individuals who were willing to assist us in this vital work. Now we have a viable way to expand our research while respecting individual privacy.”

The Province recognizes that medical research and the privacy of British Columbians are equally important. The legislation will create an effective balance between individual rights and public responsibilities. It will also enable government to make objective decisions on the appropriate disclosure of health information for secondary purposes.

Amendments are also being made to the Pharmacists, Pharmacy Operations and Drug Scheduling Act to provide similar access, privacy and penalty provisions regarding PharmaNet. PharmaNet is internationally recognized as a world-class secure electronic network that protects patient safety. It protects patients from potentially dangerous medication errors, duplications and dangerous combinations of different medications. It records all prescriptions dispensed at B.C. community pharmacies in a central database and checks for interactions.

From the Canadian Press:

The Canadian Press: B.C. introduces law governing access, privacy of electronic health records

B.C. introduces law governing access, privacy of electronic health records

1 day ago

VICTORIA — British Columbians will soon be able to use their computers to view their health records, Health Minister George Abbott said Thursday after introducing legislation governing access and privacy for electronic health information databases.

British Columbia became the first province in Canada to create a legislative framework with specific provisions to address access and protection of electronic health information.

The e-Health Personal Health and Information Access and Protection of Privacy Act could eventually create paperless medical offices, allowing physicians to store information about patients on their computers as opposed to the banks of individual file folders in most offices, Abbott said.

"I'm pretty confident we got it right here," he said. "I'm very pleased with the balance with the legitimate access to personal information that a physician may require and the protection of the sanctity of those records that is so important to the patient."

The e-Health law gives medical researchers access to the electronic health database but ensures privacy, Abbott said.

Individuals can block access to the their own information in health data banks, except in cases where the person is incapacitated in an emergency or with the individual's consent.

Abbott said the new law prohibits disclosing information from electronic health databases for market research. The government will create a committee that evaluates requests for data for health research or planning purposes.

Maximum fines for violating the act have been will be $200,000.

The Opposition New Democrats said they want patient privacy ensured. They also said the act suffers from credibility issues.

Opposition health critic Adrian Dix wondered whether the bidding process for a $108 million contract for the software to store electronic medical records was tainted by alleged conflict of interest by a former top bureaucrat.

"The electronic medical records process is mired, unfortunately, in problems with the bidding process and problems with conflict of interest," he said. "We're talking about access to personal medical records and the credibility of that process is put in jeopardy."

The Health Ministry received a letter of concern about the bid process from an unnamed company whose bid for the electronic medical records contract was rejected.

And Dr. Tom Elliott, of Vancouver, went public with his concerns, saying his electronic records software met more than 95 per cent of the bid guidelines but didn't make the shortlist.

Other concerns involved the relationship between Ron Danderfer, a former assistant deputy minister of health, and Dr. Jonathan Burns, a Fraser Valley emergency room doctor and health contractor who developed and promoted a widely used health records device.

Danderfer and Burns were members of a steering committee overseeing the $108 million contract, aimed at getting the province's doctors on common software for medical records.

Only six companies were chosen to be involved and last year Burns listed one of the winning companies as a partner on his website.

The company, Wolf Medical, denied there had ever been a financial link between the two.

Abbott has said a government review found Danderfer was not involved in the selection or evaluation process for the health records project.

An internal government letter addressed to the Health Ministry from the Labour Ministry said last year the bid process was not influenced by Danderfer and Burns.

"While news media reports appear to link the Burns/Danderfer matter with the electronic medical record procurement, we can confirm that neither of these individuals were involved in evaluating proponent proposals or proponent software demonstrations and testing at any stage of the evaluation process," said the Nov. 7 letter from Richard Poutney, assistant deputy labour minister.

"We have not received any information that would link this matter to the electronic medical record procurement," it said.

In December, RCMP confirmed an investigation involving Danderfer while he was employed at the Health Ministry. The Mounties also asked the government to withhold results of an internal audit until their probe is complete.

Danderfer was placed on mandatory leave last July and retired last October after 35 years of service with the B.C. government.

Privacy Commissioners Release New Video Surveillance Guidelines

The Privacy Commissioners of Canada, British Columbia and Alberta today have released Guidelines for Overt Video Surveillance in the Private Sector to help businesses consider privacy matters when deciding whether to and how to implement overt video surveillance. (I wonder whether they'll also produce guidelines on covert surveillance?)

From the media release:

Privacy Commissioners Release New Video Surveillance Guidelines

Privacy Commissioners Release New Video Surveillance Guidelines

OTTAWA, March 6, 2008 — Private-sector organizations considering video surveillance systems must take specific steps to minimize the impact on people’s privacy, say video surveillance guidelines released today.

The new guidelines set out how companies should evaluate the use of video surveillance and ensure any surveillance they undertake is conducted in a way that respects privacy rights and complies with the law.

These guidelines have been endorsed by Jennifer Stoddart, the Privacy Commissioner of Canada, Frank Work, the Information and Privacy Commissioner of Alberta, and David Loukidelis, the Information and Privacy Commissioner for British Columbia.

“We have seen a dramatic increase in the use of surveillance cameras by private-sector organizations. Many of our day-to-day activities are now captured by these cameras,” says Commissioner Stoddart.

“There are some legitimate reasons to conduct video surveillance, but privacy laws in Canada impose restrictions and obligations when, where and how businesses can conduct this kind of surveillance,” says Commissioner Loukidelis.

“These guidelines make it clear that businesses must carefully evaluate why they are installing video surveillance equipment, and what they will do with the information that is collected,” says Commissioner Work.

The Commissioners say it is disturbing to hear stories about video surveillance operators deliberately pointing cameras to ogle women, as well as surveillance images of people caught in unflattering situations finding their way onto video sharing sites like YouTube and Vimeo.

The new guidelines are aimed at businesses subject to the Personal Information Protection and Electronic Documents Act, or PIPEDA. They are also targeted at businesses subject to the provincial Personal Information Protection Acts in Alberta and British Columbia.

The overarching principle for video surveillance – which stems from the key legal test under the federal and provincial laws – is that it should be used only for purposes that a reasonable person would consider appropriate in the circumstances.

The guidelines state that, in order to limit the impact on privacy, cameras should be positioned to avoid capturing the images of people not being targeted (e.g., someone walking outside a store). As well, cameras should not be used in areas where people have a heightened expectation of privacy, such as washrooms, and through building windows.

The guidelines also say:

• People should be notified about the use of cameras before they enter the premises.
• Individuals whose images are captured on videotape should, upon request, be given access to this recorded personal information.
• Organizations must ensure that video surveillance equipment and videotapes are secured and used for authorized purposes only.
• Individuals who operate video surveillance systems should understand the privacy issues related to surveillance and their obligations under the law.
• Video surveillance recordings should be retained only as long as necessary and destroyed securely.

The complete guidelines for private-sector organizations are available at www.privcom.gc.ca, www.oipc.ab.ca and www.oipc.bc.ca. The Office of the Privacy Commissioner of Canada and the Office of the Information and Privacy Commissioner for British Columbia have previously published guidelines for the use of video surveillance in public places by police and law enforcement authorities.

All three privacy commissioners are statutorily mandated to oversee compliance with the Acts and are advocates and guardians of privacy and the protection of personal information rights of Canadians.

Privacy Commissioners come out against national (RF)ID cards

The Federal, Provincial and Territorial Privacy Commissioners came out yesterday against proposed RFID embedded super drivers licenses designed to facilitate border crossings:

Nova Scotia News - TheChronicleHerald.ca

Keep drivers' information in Canada — officials

Privacy commissioners slam plan to produce national identity cards

By DIRK MEISSNER

The Canadian Press

Wed. Feb 6 - 6:15 AM

VICTORIA — Personal information about Canadian drivers must stay in the country as plans are developed to introduce high-tech driver’s licences in Canada that will be accepted as identification at United States border crossings, Canada’s privacy commissioners said Tuesday.

The commissioners issued a joint statement that called on Ottawa and provincial and territorial governments participating in the so-called enhanced driver’s licence programs to ensure the personal information of participating drivers stays in Canada.

The commissioners also said they continue to voice their opposition to any plans to introduce national identity cards and systems.

British Columbia and the federal government reached an agreement last month to start issuing the enhanced driver’s licences on a trial basis. Ontario is examining a similar licensing program.

The enhanced licences, equipped with radio frequency chips, allow border officials to access personal identity information. They can be used as an alternative to a Canadian passport.

Jennifer Stoddart, Canada’s privacy commissioner, said her office is monitoring the progress of the enhanced driver’s licence program and recently received a government privacy-impact analysis. She said her office is not yet ready to give the green light to the licence program.

"Maybe our positions are more nuanced than that when we say with all these progressive and incremental steps towards measures that increasingly limit Canadians’ privacy, this is what you should be looking for," Stoddart said.

"These are the steps you need to follow," she said. "Have you chosen the least privacy-invasive route?"

David Loukidelis, B.C.’s privacy commissioner, said Canadians need to be reminded that a Canadian passport is a well-established, highly secure identification document.

"These enhanced driver’s licences or EDL programs do raise concerns about security and privacy of personal information on a number of fronts," Loukidelis said.

There are concerns that the radio frequency technology on the chips embedded into the licences could be skimmed by others or used to track individuals, he said.

The commissioners are concerned about the transfer across borders of databases containing personal information about Canadians, Loukidelis said.

"We don’t do that now with passport databases and we don’t see why we would need to do anything differently when it comes to enhanced driver’s licences."

The B.C. government has received 800 volunteers for the enhanced driver’s licence program within the first two days of the pilot project.

John van Dongen, Intergovernmental Affairs Minister, said 500 licences will be issued in British Columbia.

He said the information contained in the licences provides border officials with proof of citizenship, a photograph to confirm identity and status to legally cross the border.

"They do not access medical records," he said. "They do not access driver’s records. They do not access fines, tickets, penalties. They do not access accident history. None of that information is of any interest to the border agencies in either country."

Alberta privacy commission to rule on bar scans

Personal information practices of bars and nightclubs are coming under increasing scrutiny, particularly with repect to video surveillance in Nova Scotia and the practice of scanning identification documents. Complaints related to the latter practice are pending in British Columbia and Alberta. It appears that a decision of the Alberta Commissioner is to be expected shortly: Alberta privacy commission to rule on bar scans.

Guidance on asking for ID in credit card transactions

The Information and Privacy Commissioners of Alberta and British Columbia, along with the Privacy Commissioner of Canada, have released a guidance document on requiring photo ID of individuals paying for goods and services by credit card. All three have concluded it is reasonable.

See the OIPC website and the guidance document: Photo Identification Guidance.

BC Commissioner: Student records can be shared to protect public safety

Proably not a surprise for those who regularly work with the provincial public sector privacy laws in Canada, which usually contain a public interest and "health and safety" override:

Records of troubled B.C. students can be shared: privacy commissioner

Universities in British Columbia can share confidential medical records about troubled students if there's a perceived a threat to public safety, the province's privacy commissioner says.

Responding to a U.S. government report issued June 13 on the April 16 massacre at Virginia Tech that left 33 people dead — including the student who fired the gun — David Loukidelis said a university student's confidential medical records can be shared — regardless of the student's age.

"The laws in B.C. fully enable university and college officials to take steps to protect individual and indeed public safety," Loukidelis told CBC News on Monday.

The U.S. report says schools, doctors and police often do not share information about potentially dangerous students because they can't figure out complicated and overlapping privacy laws.

Loukidelis said there's a long list of exemptions in B.C.'s privacy laws that allow a student's private information to be shared for the good of public safety.

Tim Rahilly, senior director of student and community life at Simon Fraser University in Vancouver, said he often noticed the beginning of problems with students and wondered whether that information could be shared.

He said the university would ask the student whether it can talk to the student's parents about the concerns.

"The student can say no and if they are above the age of majority we are a little bit hamstrung," Rahilly said.

Loukidelis said if a student denies a request to share personal information with their parents or school officials, an assessment can be made.

Video

Nil Koksal reports for CBC-TV (Runs: 2:28)

Play: QuickTime »

Play: Real Media »

BC auto body shops object to auto insurer's credit-card policy

Auto body repair shops in British Columbia are complaining to the province's privacy commissioner about the public auto insurer requiring that the shops hand over customer credit card information in the course of routine audits.

I wonder whether there's anything in the customer's policy allowing ICBC to collect this information?

Check it out:

Auto body shops take aim at ICBC's credit-card policy

Neal Hall, Vancouver Sun

Published: Monday, August 13, 2007

An association representing auto body shops and automotive glass repair companies has filed a complaint with B.C.'s information and privacy commissioner about having to hand over customer credit card numbers to the Insurance Corp. of B.C.

The United Auto Trades Association of B.C. says disclosure of a customer's personal and financial information during ICBC audits should not be done without a customer's written consent.

The complaint, obtained by The Vancouver Sun, says the disclosure without written consent is "clearly unlawful."

"It's of concern to us," said Gerry Preddy, vice-president of the association. "We've had examples of files being lost [by ICBC]."

The association, in its complaint, cites the federal Personal Information Protection Act, which states: "An organization must not, as a condition of supplying a product or service, require an individual's consent to the collection, use or disclosure of personal information beyond what is necessary to provide the product or service."

ICBC demands such information during audits of auto body and glass repair shops that participate in ICBC's Glass Express Program to make sure shops are charging the vehicle insurance deductible amount.

"When a customer makes a claim, they are required to pay a deductible," explained ICBC spokeswoman Kate Best, "so repair shops provide ICBC with credit card information to confirm the payment of the deductible."

ICBC's position is that audits of repair shops are reasonable to verify payments, she said.

"The matter is currently before the information and privacy commissioner and ICBC will await the ruling," Best said.

The association says while membership in the glass express program is voluntary -- about 700 businesses and 60 per cent of glass repair shops participate in the program -- shops would suffer a drastic loss in business if they withdrew or refused to hand over the financial information of customers during ICBC audits.

The association made a final submission to the privacy commissioner on July 30, pointing out a recent B.C. Court of Appeal decision "confirmed that the collection and disclosure must be authorized by law."

The appeal court, in its ruling involving Royal City Jewellers & Loans Ltd., struck down a New Westminster bylaw allowing police to collect financial and personal information about people selling or pawning items to second-hand stores and pawn shops. The shops still collect the information but take the position they won't hand it over to police without a court order or search warrant.

Royal City Jewellers launched the court challenge, stating it was an invasion of privacy for law-abiding customers.

Cameras coming to BC buses

Video cameras are coming to public transportation in British Columbia. Probably not breaking news, but I find the following quote to be interesting:

"Many proponents of the system say the public is already recorded on video in malls, ATM machines, and various other areas. Cameras on buses and other public areas, they believe, is simply a natural extension."

With cameras in many places, where is it not a natural extension? Once they are commonplace in one public area, it's very easy to justify putting them in another locale.

BCNG Portals Page (R)

Closed-circuit TV cameras coming to buses

By Kevin Diakiw Black Press

Aug 03 2007

Cameras will be installed on all buses in the coming months, but privacy watch-dogs are concerned about how they’ll be used.

TransLink will spend $4 million for camera installation, primarily as a measure for driver safety. However, TransLink spokesman Ken Hardie said cameras will be placed on various areas of the bus, and will not simply be focused at the driver.

“I believe actually there will be more than one camera on the bus, there will be a number of different views,” Hardie said Wednesday.

The expansion of Closed Circuit Television cameras (CCTV) onto buses has been sold primarily as a device to prevent assaults on drivers.

Hardie said they will have several uses.

“Let’s say taggers, who can create mayhem inside a bus, just by leaving graffiti and other damage,” Hardie said. “... now buses might not leave them the kind of anonymity that they love to have when they do their work.”

It’s that kind of “function creep” that concerns civil libertarians.

“I am concerned about this notion ... now that we’ve got them on the bus ... let’s point them all over the bus and let’s catch the kids with crayons in the back seat while we’re at it,” said Micheal Vonn, policy director for B.C. Civil Liberties Association.

She’s also concerned about who would have access to the images.

Hardie said the video will be “recorded on board” to a hard drive and overwritten every week. A special team with Coast Mountain Bus Ltd. would be the only people with access to the video, unless required by police or court.

Many proponents of the system say the public is already recorded on video in malls, ATM machines, and various other areas. Cameras on buses and other public areas, they believe, is simply a natural extension.

“The question is to what degree are we becoming immune to the idea we should not be on film whenever we’re outside of our house,” Vonn said.

With scores of people already on any particular bus witnessing what’s going on, many feel the public expectation of privacy is low.

Vonn has heard the argument and disagrees.

“If I’m in a restaurant having a private conversation with a friend, a server can overhear snatches of what I’m saying,” Vonn said. “It’s quite different than having my Waldorf salad bugged and my entire conversation recorded.”

Hardie said TransLink is working with the B.C. Privacy Commissioner and will be submitting a privacy impact assessment as part of the process.

At the end of the day, the public will be safer with the presence of cameras on the region’s buses, he said.

“For one element, to know their actions are being recorded will make them think twice, there will be a deterrent effect in some respects,” Hardie said.

TransLink is hoping it will serve not only as an effective investigative tool for police, but will lead to stiffer penalties when perpetrators go to court.

Federal Privacy Commissioner releases privacy breach guidelines

The Federal Privacy Commissioner has just released privacy breach guidelines, which are similar to guidelines produced by the Ontario and British Columbia commissioners. Here is the press release, with links to the guidelines:

News Release: Privacy Commissioner releases privacy breach guidelines (August 1, 2007) - Privacy Commissioner of Canada

Privacy Commissioner releases privacy breach guidelines

Ottawa, August 1, 2007 – New guidelines will help organizations take the right steps after a privacy breach, including notifying people at risk of harm after their information has been stolen, lost or mistakenly disclosed, says the Privacy Commissioner of Canada, Jennifer Stoddart.

The guidelines outline some of the key steps in responding to a breach, such as containing the breach, evaluating the risks associated with it, notifying the people affected and preventing future breaches.

“It’s clear that most businesses take seriously their responsibilities under Canada’s private-sector privacy law. I want to thank the industry groups, civil societies groups and privacy commissioners' offices that helped my office in developing these,” Commissioner Stoddart says.

The Office of the Privacy Commissioner (OPC) has become increasingly concerned about privacy breaches and breach notification following some major data breaches in recent months. Earlier this year, Commissioner Stoddart urged the federal government to amend the Personal Information Protection and Electronic Documents Act (PIPEDA) to make it mandatory for businesses to notify people when their personal information has been breached.

“Our new voluntary guidelines do not take away from the need for breach notification legislation,” the Commissioner says. “I would once again urge the Minister of Industry and his cabinet colleagues to help better protect Canadians by making breach notification a legal requirement for businesses.” The guidelines call on businesses to notify people that their personal information has been compromised in cases where the breach raises a risk of harm. For example, there may be a risk of identity theft or fraud in cases where sensitive personal information has been lost or stolen.

Organizations are also encouraged to inform the appropriate privacy commissioner(s) of a privacy breach. (In British Columbia, Alberta and Quebec, provincially regulated businesses should speak to their provincial privacy commissioners. In Ontario, breaches involving personal health information must be reported to the provincial commissioner.)

The OPC is currently investigating two high-profile privacy breach cases involving large amounts of personal information.

In one case, the Canadian Imperial Bank of Commerce reported to the OPC the disappearance of a hard drive containing the personal information and financial data of close to half a million clients of its subsidiary, Talvest Mutual Funds.

The other investigation, being conducted jointly with the Information and Privacy Commissioner of Alberta, is looking at a breach at TJX Companies Inc., which affected thousands of Canadians who shopped at TJX’s Winners and HomeSense stores.

The new guidelines as well as a privacy breach checklist and a list of organizations which participated in the consultation process to develop the guidelines are available on the OPC website, http://www.privcom.gc.ca/.

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy and the protection of personal information rights of Canadians.

Oshawa second-hand store bylaw invades privacy

Earlier this week, the Ontario Court of Appeal, in Cash Converters Canada Inc. v. Oshawa (City) (July 4, 2007) (an appeal from Cash Converters Canada Inc. v. Oshawa (City), 2006 CanLII 3469 (ON S.C.)), overturned a City of Oshawa Bylaw that required sellers of second hand goods to collect detailed personal information about those who sell second hand goods to the stores. The bylaw was inconsistent with the Municipal Freedom of Information and Protection of Privacy Act.

Here's what the Toronto Star had to say about it:

TheStar.com - News - Oshawa second-hand store bylaw invades privacy: Court

Tracey Tyler

LEGAL AFFAIRS REPORTER

The Ontario Court of Appeal has struck down sections of a controversial Oshawa bylaw that require second-hand dealers to collect detailed personal information from people who sell them goods and transmit the data to police.

The bylaw conflicts with provincial privacy legislation, which requires the collection and retention of personal information to be strictly controlled, the court ruled Wedneday, The 3-0 decision could influence challenges to similar bylaws in other parts of the country, including Alberta and British Columbia.

“This decision comes at a time when cities are gaining broader law-making powers,” said David Sterns, a lawyer representing the Oshawa franchise of Cash Converters Canada Inc., a second-hand store that challenged the bylaw.

“The court has sent a strong signal that all forms of information gathering and surveillance by municipalities are subject to the public’s overriding right to privacy.”

Under the Oshawa bylaw, passed by the city in 2004 as part of a new licensing system for second-hand dealers, stores were required to record the name, address, sex, date of birth, phone number and height of their vendors, who also had to produce three pieces of identification, such as a driver’s licence, birth certificate or passport.

“This information is then transmitted and stored in a police data base and available for use and transmissions by the police without any restriction and without any judicial oversight,” said Justice Kathryn Feldman said, writing on behalf of Associate Chief Justice Dennis O’Connor and Justice Paul Rouleau.

Store owners were required to send reports to police at least daily, in some cases at the time of purchase. The city argued the bylaw was meant to protect consumers from purchasing stolen goods.

But the municipality offered no evidence of a growing problem involving the sale of stolen goods to second-hand dealers, said Feldman.

Nor is there evidence that unscrupulous people are more likely to be deterred by the electronic collection and transmission of personal information, she said.

In 2003, Cash Converters purchased more than 28,000 used items from people in 2003. About 30 of those were seized by police in connection with criminal investigations.

It’s unknown whether any were confirmed as stolen, the court said.

The bylaw did not apply to pawn shops, which are provincially regulated.

See, also, James Daw's column: TheStar.com - columnists - New ruling stands up for privacy.

MySpace posting good enough for cross-examination

In case you were wondering, you really shouldn't expect that anything you post on your MySpace page will be kept private. If you are in the middle of litigation alleging that you're disabled, don't post pictures of your skiing vacation.

This recent case from earlier this month in Ontario is, I think, the first Canadian case to mention MySpace. The defendants attempted to use info from the plaintiff's MySpace page as a basis for further discoveries.

Weber v. Dyck, 2007 CanLII 22348 (ON S.C.)

PDF Format

Date: 2007-06-12

Docket: 05-CV-4343CM

2007

Weber v. Dyck

Ontario Master

Master L.A.M. Pope

Judgment: June 12, 2007

Docket: 05-CV-4343CM

Master L.A.M. Pope:

1 This action was scheduled for trial at a settlement conference held on December 1, 2006. The trial is number one on the trial list to commence the week of June 18, 2007. The defendants seek leave to bring this motion and for production from the plaintiff of information and documents pursuant to Rule 48.04(1). The information and documents relate to three activities of the plaintiff that took place subsequent to the plaintiff's examination for discovery on October 13, 2005.

2 The relief sought subparagraphs 1 (iv) and (v) of the Moving Party's Record are no longer in issue for the purposes of this motion.

3 This action arises out of a motor vehicle accident that took place on February 11, 2003 in which the plaintiff alleges that she sustained serious and permanent injuries to her left wrist and to her body, as well as emotional and psychic trauma. The action is governed by the Bill 59 insurance regime and as such the plaintiff has the onus to establish that her injuries meet the "threshold"; that is, that she has sustained a permanent serious impairment of an important physical, mental or psychological function within the meaning of section 267.5(5) of the Insurance Act in order for her to be entitled to damages.

4 At that time of her examination for discovery on October 13, 2005, the plaintiff was enrolled in year one of the Masters of Business Administration (Co-op) program ("MBA") at the University of Windsor. She testified at her examination that she earned part-time income by teaching piano and playing piano at weddings and other functions, what her plans were for employment after graduation and her vacation plans.

5 The following is the defendants' evidence that gave rise to this motion. The defendants learned that the plaintiff had a MySpace web page wherein she posted photographs of herself and announced certain information about herself. The undated photographs are of the plaintiff, for example, involved in what can be described as a somewhat physical activity in the Swiss Alps, in Paris, playing piano and at her graduation. The information exchange on the web page indicates that the plaintiff resides in Toronto and has a "new job." Further investigation revealed that the plaintiff worked as a Brand & Marketing Analyst for Level 5 Strategic Brand Advisors, that she recently completed her MBA specializing in marketing and international strategy and that she earned an ARCT (Associate of Royal Conservatory Teachers) designation. By letter dated March 30, 2007, the defendants requested production from the plaintiff of certain documents and information arising out of the information on the MySpace web page. Having received no response to that letter, Mr. Dycha wrote again to Mr. Leschied by letter dated May 2, 2007 and in that letter, Mr. Dycha added to his request for production additional documents and information.

Should leave be granted pursuant to Rule 48.04(1)?

6 The defendants seek leave to bring this motion for production pursuant to Rule 48.04(1) which provides that the consequence of a party setting an action down for trial or a party consenting to an action being placed on a trial list (as is the case here), is that the party shall not initiate or continue any motion or form of discovery without leave of the court. (emphasis added).

7 As this case is subject to the civil case management rules of Rule 77, it was placed on the trial list at the settlement conference held on December 1, 2006. There is no evidence that either party did not consent to the action being placed on the trial list. In my view, the consequences of placing a case managed action on a trial list are more serious than with a non-case managed case. This is evidenced by comparing the provisions of Rule 48.07 with subrules 77.14(2) and (4). The latter rules require a certification by the plaintiff that all examinations, production of documents and motions arising out of examinations and production of documents have been completed before the settlement conference date. Essentially, the parties who consent to an action being placed on the trial list declare that they are ready for trial. Subrules 77.14(2) and (4) support the purpose of the civil case management rules of reducing unnecessary cost and delay, facilitating early and fair settlements and bringing proceedings expeditiously to a just determination while allowing sufficient time for the conduct of the proceeding. In this case, the parties consented to the case being placed on the trial list with two exceptions as requested by the defendants and as ordered by Justice Nolan; firstly that the plaintiff deliver her x-rays by December 15, 2006, and secondly that the case be assigned an alternate trial date in the event the defendants did not have their expert reports by the June 18, 2007 trial list. The x-rays were delivered by the date ordered.

8 In order for the plaintiff to succeed in obtaining the right to further production of information and documents after a case has been placed on a trial list, they must first meet the requirements of Rule 48.04(1). The test for granting leave was aptly described by E.M. Macdonald J. in Hill v. Ortho Pharmaceutical (Canada) Ltd., [1992] 11 C.P.C. (3d) 236 (Ont. Gen. Div.) at 239, as follows:

The authorities make it clear that setting a matter down for trial is not a mere technicality of procedure. Before it can be vacated to permit any further discovery or other interlocutory proceedings, there must be a substantial or unexpected change in circumstances such that a refusal to make an order under s. 48.04(1) would be manifestly unjust.(emphasis added)

9 Plaintiff's counsel argues that the defendants were aware at the time of the mediation on July 26, 2006 and at settlement conference on December 1, 2006, that the plaintiff had graduated and therefore they should have brought this motion before agreeing to place the matter on the trial list. They further argue that given that the defendants consented to placing this matter on the trial list with the knowledge of the plaintiff's graduation, they should not be granted leave.

10 Firstly, there is no evidence before me of the above-noted allegations of the plaintiff. Secondly, it appears that Mr. Leschied provided Mr. Dycha with a copy of the plaintiff's transcript by letter dated December 20, 2006, several weeks following the settlement conference, (when the matter was placed on the trial list.) Moreover, the only evidence before me is that the defendants learned that the plaintiff had graduated on or about December 20, 2006, and that she had obtained a job and moved to Toronto when they discovered her MySpace web page. Therefore, it is my view that not only has the plaintiff had a substantial change in circumstances since this mater was placed on the trial list relating to her educational status, there has been a substantial change relating to her career, employment status and her place of residence. Albeit not all of these changes could be considered unexpected given her educational status at the time of her examinations for discovery, the test for leave does not require that the change in circumstances be substantial and unexpected. Therefore, I find that because there has been a substantial change in circumstances of the plaintiff since placing this matter on the trial list, it would be manifestly unjust in these circumstances not to grant leave for the defendants to bring this motion.

Rule 48.04(2)(b)(i) exception

11 The defendants submit that this motion falls within the exception set out in subrules 48.04(2)(b)(i). That rule provides that notwithstanding this matter being placed on the trial list, the plaintiff has a continuing obligation, pursuant to Rule 30.07, to disclose further relevant documents that come into her possession after serving an affidavit of documents or discovers that the affidavit is inaccurate or incomplete. If the plaintiff fails to make production of relevant documents she will be subject to the consequences set out in Rule 30.08. Rule 1.03 provides that a "document" includes data and information in electronic form.

12 The exception allowed in Rule 48.04(2)(b)(i) relates to subsequently discovered documents. The reason for this exception was explained by Master Dash in White v. Winfair Management Ltd., (2006) 16 C.P.C. (6th) (S.C.J.) at 48 as follows:

If a document is discovered and produced by the defendant after the plaintiff has completed his oral and documentary discovery and set the action down, it would constitute an unexpected change in circumstance that could mandate leave for further discovery thereon.

13 The defendants have requested the following documents:

1. a copy of the plaintiff's file from any employment placement agencies;

2. a copy of the plaintiff's current employment file and contact information relative to her immediate supervisor and individual in charge of Human Resources;

3. all photographs and video recordings from trips.

14 The defendants clarified that they were only seeking these documents for the last year and a half.

15 The first two documents set out above were not in the plaintiff's possession at the time of her examination for discovery on October 13, 2005 because they would have been created as a result of her graduating in the summer of 2006 and her subsequent job search. I am inclined to order production of these documents given the change in circumstances in the plaintiff's employment status and the fact that her income and job responsibilities are relevant to the threshold issue and the assessment of damages. Furthermore, there is no evidence before me that the defendants were aware that the plaintiff had graduated and/or had obtained a job at the time of the settlement conference on December 1, 2006. In fact, the plaintiff's evidence is that she did not provide the defendants with a copy of her transcript until December 20, 2006, following the settlement conference, as evidenced by Mr. Lescheid's letter of that date.

16 Regarding the third request above, clearly the photographs and video recordings requested were not in the plaintiff's possession at her examination for discovery such that the defendants could have requested them. The defendants urge me to grant the order based on the reasoning of the Master in the British Columbia case of Watt v. Meier , 2005 CarswellBC 3302 (S.C.) wherein it was the Master's opinion that in the hypothetical case where the main issue were a broken leg, where the plaintiff was claiming a significant disability and the defendant wanting to challenge the extent of the disability, then it would seem inherently possible that photographs from a vacation, where you may find somebody swimming or playing beach volleyball or all sorts of activities traditional on holidays, might be highly relevant to the question of the degree of a broken leg disability. I agree with the Master's reasoning; however, based on the reasons for my decision which follow, I have distinguished the Master's hypothetical case.

17 The defendants also rely on another case from the British Columbia Supreme Court of Tupper (Guardian ad litem of) v. Holding, [2003] B.C.J. No. 216wherein the plaintiff was ordered to produce vacation photographs. In that case the plaintiff sought damages for loss of her ability to enjoy life. The court stated that the documents sought include photographs of the plaintiff on vacation, posing or sitting with friends on the beach, and in front of various tourist sites; that is, they show her enjoying life. The court held that it was reasonable to conclude that the vacation photographs may assist the defendant in its defence of the plaintiff's claim. In both this case, as well as the Watt case, the motions were brought before the actions were set down for trial; therefore, the test for leave was not an issue before those courts.

18 I decline to order production of the photographs and video recordings for several reasons. Firstly, the parties consented to this action being placed on the trial list; therefore, they were deemed to admit that they were ready for trial. Secondly and more importantly, the defendants did not request production of the plaintiff's photographs and video recordings of her trip to Vancouver which she took the year before the examination. I fail to understand how the defendants would be entitled to photographs and video recordings of trips the plaintiff took after her examination for discovery when they did not see the relevancy in seeking production of photographs and video recordings of her pre-examination trips. The change in circumstances of the plaintiff relate to her career and employment status and has no relationship to her ability to travel which she testified to the fact that her injuries do not impact on her ability to travel. Lastly, the defendants have several images of the plaintiff from her MySpace web page with which they can cross examine the plaintiff at trial. This appears to be a form of further discovery to which the defendant is not entitled.

Rule 48.04(2)(b)(iv) exception

19 The defendants submit that this motion falls within the exception set out in subrule 48.04(2)(b)(iv). That rule provides that subrule (1) does not relieve a party from any obligation imposed by Rule 31.09 to correct answers given at an examination for discovery notwithstanding that the case was placed on the trial list. They further submit that in addition to the threshold issue at trial, another issue will be to what extent, if any, the plaintiff's avocational pursuits have been affected by her alleged injuries.

20 The information sought by the defendants is as follows:

1. a list of places the plaintiff sought employment;

2. details of the plaintiff's piano performances and piano lessons including sufficient details to identify and locate the persons for whom the plaintiff performed, along with the amounts received in compensation for services;

3. details of the plaintiff's travels for recreation or otherwise including particulars engaged in during her travels.

21 The defendants clarified that they were only seeking the above information for the last year and a half.

22 The questions and answers at issue are as follows:

Re: Career goals

154. Q. What's your ultimate ambition in terms of a career?

A. I'd like to get into international marketing, work for an international firm.

155. Q. Well, what do you mean by "international marketing"?

A. Global brand strategy.

156. Q. Okay. I'm going to guess that in order to do that you're going to have to potentially move from the city?

A. Yes.

157. Q. And do you have any objection to doing that?

A. No.

Re: Travel since the accident

377. Q. And have you had to travel anywhere since the accident for recreation or otherwise?

A. yes. I've travelled --

378. Q. (Interposing) Where have you been?

A. -- last September. I went to Vancouver last September.

Re: Piano

45. Q. Right, and the material that we've been given indicates that you also like to play piano. You teach piano --

A. (Interposing) I teach piano part-time.

387. Q. And you've got, you're still teaching the kids, right?

A. Correct.

388. Q. And how many hours?

A. Between 12 and 15. It's three, three evenings a week.

23 There is no evidence before me to suggest that these answers were not correct or were incomplete when given and that any time thereafter they became incorrect. Certainly certain aspects of the plaintiff's life have changed since her examination but that alone does not mean that her answers were incorrect or incomplete when made on October 13, 2005.

24 In particular, regarding the request for a list of the places the plaintiff sought employment, it is my view that notwithstanding the fact that there has been a substantial change in circumstances, this information is not relevant to any of the issues in this action therefore it is not to be produced. Regarding the requests for production of information about the plaintiff's piano performances, piano lessons and trips, I refuse to grant these orders because it can hardly be said that the defendants are now entitled to this information when they failed to ask for the same information for the period of time prior to the examination for discovery. To order production of this information would constitute a further form of discovery to which the defendant is not entitled.

Costs

25 Both parties filed Cost Outlines, however neither of them were complete in failing to specify the partial indemnity rate and actual rate or any of the points listed which are to be made in support of the costs sought. Both counsel attached a billing statement; however, a billing statement is not a substitute for setting out the partial indemnity and actual rates. These rates are some of the considerations in determining the cost order and without them an appropriate amount for costs cannot be determined. The Court cannot be expected to extrapolate the hourly rates from the billing statement and then calculate the partial indemnity rates. As the Costs Outlines were essentially useless for the purpose intended by the Rules, and given that the defendants were successful, at least in part, with their motion, costs are fixed at $750.00 payable by the plaintiff and the defendants forthwith.

Order

26 There shall be an order as follows:

1. The plaintiff shall produce the following within 7 days;

a) a copy of the plaintiff's file from any employment placement agencies; and

b) a copy of the plaintiff's current employment file and contact information relative to her immediate supervisor and individual in charge of Human Resources;

2. Costs to the defendants fixed in the amount of $750.00 payable forthwith.

END OF DOCUMENT

B.C. privacy commissioner probes tenant database firm

Today's Globe & Mail is reporting that the British Columbia Information and Privacy Commissioner has started an investigation into TVS Tenant Verification Services, a company that provides reports on prospective tenants. See: globeandmail.com: B.C. privacy commissioner probes tenant database firm.

Parliamentary review of PIPEDA: Report

The Parliamentary Committee on Access to Information, Privacy and Ethics has just released its report following the five year PIEDA review:

ETHI (39-1) — Fourth Report: STATUTORY REVIEW OF THE PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT (PIPEDA) — Standing Committee on ACCESS TO INFORMATION, PRIVACY AND ETHICS - Committees of the House of Commons

The Standing Committee onACCESS TO INFORMATION, PRIVACY AND ETHICS

has the honour to present its

Fourth Report

Pursuant to its mandate under Standing Order 108(2), the Committee has studied a Statutory Review of the Personal Information Protection and Electronic Documents Act (PIPEDA) and agreed to the following report:

The HTML version of this report will be available soon. In the meantime, the Committee is pleased to make available the report entitled STATUTORY REVIEW OF THE PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT (PIPEDA) (.PDF, 262 KB) in printable format.

Here are the recommendations:

47

Recommendation 1

The Committee recommends that a definition of “business contact information” be added to PIPEDA, and that the definition and relevant restrictive provision found in the Alberta Personal Information Protection Act be considered for this purpose.

Recommendation 2

The Committee recommends that PIPEDA be amended to include a definition of “work product” that is explicitly recognized as not constituting personal information for the purposes of the Act. In formulating this definition, reference should be added to the definition of “work product information” in the British Columbia Personal Information Protection Act, the definition proposed to this Committee by IMS Canada, and the approach taken to professional information in Quebec’s An Act Respecting the Protection of Personal Information in the Private Sector.

Recommendation 3

The Committee recommends that a definition of “destruction” that would provide guidance to organizations on how to properly destroy both paper records and electronic media be added to PIPEDA.

Recommendation 4

The Committee recommends that PIPEDA be amended to clarify the form and adequacy of consent required by it, distinguishing between express, implied and deemed/opt-out consent. Reference should be made in this regard to the Alberta and British Columbia Personal Information Protection Acts.

Recommendation 5

The Committee recommends that the Quebec, Alberta and British Columbia private sector data protection legislation be considered for the purposes of developing and incorporating into PIPEDA an amendment to address the unique context experienced by federally regulated employers and employees.

Recommendation 6

The Committee recommends that PIPEDA be amended to replace the “investigative bodies” designation process with a definition of “investigation” similar to that found in the Alberta and British Columbia Personal Information Protection Acts thereby allowing for the collection, use and disclosure of personal information without consent for that purpose .

Recommendation 7

The Committee recommends that PIPEDA be amended to include a provision permitting organizations to collect, use and disclose personal information without consent, for the purposes of a business transaction. This amendment should be modeled on the Alberta Personal Information Protection Act in conjunction with enhancements recommended by the Privacy Commissioner of Canada.

Recommendation 8

The Committee recommends that an amendment to PIPEDA be considered to address the issue of principal-agent relationships. Reference to section 12(2) of the British Columbia Personal Information Protection Act should be made with respect to such an amendment.

Recommendation 9

The Committee recommends that PIPEDA be amended to create an exception to the consent requirement for information legally available to a party to a legal proceeding, in a manner similar to the provisions of the Alberta and British Columbia Personal Information Protection Acts.

Recommendation 10

The Committee recommends that the government consult with the Privacy Commissioner of Canada with respect to determining whether there is a need for further amendments to PIPEDA to address the issue of witness statements and the rights of persons whose personal information is contained therein.

Recommendation 11

The Committee recommends that PIPEDA be amended to add other individual, family or public interest exemptions in order to harmonize its approach with that taken by the Quebec, Alberta and British Columbia private sector data protection Acts.

Recommendation 12

The Committee recommends that consideration be given to clarifying what is meant by “lawful authority” in section 7(3)(c.1) of PIPEDA and that the opening paragraph of section 7(3) be amended to read as follows: “For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization shall disclose personal information without the knowledge or consent of the individual but only if the disclosure is […]”

Recommendation 13

The Committee recommends that the term “government institution” in sections 7(3)(c.1) and (d) be clarified in PIPEDA to specify whether it is intended to encompass municipal, provincial, territorial, federal and non-Canadian entities.

Recommendation 14

The Committee recommends the removal of section 7(1)(e) from PIPEDA.

Recommendation 15

The Committee recommends that the government examine the issue of consent by minors with respect to the collection, use and disclosure of their personal information in a commercial context with a view to amendments to PIPEDA in this regard.

Recommendation 16

The Committee recommends that no amendments be made to PIPEDA with respect to transborder flows of personal information.

Recommendation 17

The Committee recommends that the government consult with members of the health care sector, as well as the Privacy Commissioner of Canada, to determine the extent to which elements contained in the PIPEDA Awareness Raising Tools document may be set out in legislative form.

Recommendation 18

The Committee recommends that the Federal Privacy Commissioner not be granted order-making powers at this time.

Recommendation 19

The Committee recommends that no amendment be made to section 20(2) of PIPEDA with respect to the Privacy Commissioner’s discretionary power to publicly name organizations in the public interest.

Recommendation 20

The Committee recommends that the Federal Privacy Commissioner be granted the authority under PIPEDA to share personal information and cooperate in investigations of mutual interest with provincial counterparts that do not have substantially similar private sector legislation, as well as international data protection authorities.

Recommendation 21

The Committee recommends that any extra-jurisdictional information sharing, particularly to the United States, be adequately protected from disclosure to a foreign court or other government authority for purposes other than those for which it was shared.

Recommendation 22

The Committee recommends that PIPEDA be amended to permit the Privacy Commissioner to apply to the Federal Court for an expedited review of a claim of solicitor-client privilege in respect of the denial of access to personal information (section 9(3)(a)) where the Commissioner has sought, and been denied, production of the information in the course of an investigation.

Recommendation 23

The Committee recommends that PIPEDA be amended to include a breach notification provision requiring organizations to report certain defined breaches of their personal information holdings to the Privacy Commissioner.

Recommendation 24

The Committee recommends that upon being notified of a breach of an organization’s personal information holdings, the Privacy Commissioner shall make a determination as to whether or not affected individuals and others should be notified and if so, in what manner.

Recommendation 25

The Committee recommends that in determining the specifics of an appropriate notification model for PIPEDA, consideration should be given to questions of timing, manner of notification, penalties for failure to notify, and the need for a “without consent” power to notify credit bureaus in order to help protect consumers from identity theft and fraud.

B.C. privacy commissioner to rule on ID scans in bars

According to the CBC, the Information and Privacy Commissioner has completed his inquiry related to the practice of swiping drivers' licenses at bars in that province. A decision is expected next month. See: B.C. privacy commissioner to rule on ID scans in bars.

Breach notification assessment tool

Today, the Information and Privacy Commissioners of Ontario and British Columbia have released a Breach Notification Assessment Tool to provide guidance to public and private sector bodies on what to do after a personal information breach. It is meant to be used alongside existing publications for each province:

B.C.: Key Steps in Responding to Privacy Breaches (http://www.oipc.bc.ca)

Ontario:

What to do if a privacy breach occurs: Guidelines for government organizations, (http://www.ipc.on.ca/images/Resources/up-prbreach.pdf)

What to do When Faced With a Privacy Breach: Guidelines for the Health Sector, (http://www.ipc.on.ca/images/Resources/up-hprivbreach.pdf)