With a review set to start next month, the Personal Information Protection and Elec-tronic Documents Act (PIPEDA) could be facing a few potential changes, one of which may concern the order-making powers of the act.
At the moment, the role of the Office of the Privacy Commissioner is that of an ombudsman and as a result, according to the OPC, "the commissioner has no power to order an organization to cease or change a practice or release personal information. Nor can the commissioner award damages."
The commissioner can, however, initiate court action with the consent of an individual, and the OPC notes that the commissioner "has done so on occasion where organizations have refused to implement her recommendations."
For example, a recent PIPEDA case involved complaints against two law firms who were accused of collecting credit information without the clients' knowledge or consent during the litigation process. The firms, which chose not to be identified under PIPEDA, initially declined to implement the OPC's recommendations, but later agreed to do so after being contacted by litigation counsel, which avoided the need for the OPC to proceed with an application in the Federal Court.
Federal Privacy Commissioner Jennifer Stoddart commented at the recent International Association of Privacy Professionals Privacy Academy in Toronto that of the 401 complaints closed by the office last year, 40 per cent were settled over the course of investigation.
The OPC's PIPEDA review document, released earlier this year, outlines several points to consider when the legislation is reviewed. One of these concerns the commissioner's powers under PIPEDA. The document adds that while some see the ombudsman approach as making PIPEDA less effective, others see the model as being more accessible, informal, and flexible.
The Canadian Bar Association noted that PIPEDA should follow the tribunal model adopted by the Canadian Human Rights Commission in its recommendations to the Privacy Commissioner last month, elaborating on its formal submission from 2005.
"An impartial, rotating panel should be established with order-making powers and ability to award damages, with a cap on general damages. The Office of the Privacy Commissioner should retain investigative powers and advocacy role. If the commissioner determines that a complaint is 'well founded,' the commissioner should be required to issue a finding within six months and this finding should be referred to the tribunal.
Both complainants and respondents would be able to seek judicial review of a decision of the tribunal," says the CBA's submission.
Brian Bowman of Pitblado LLP in Winnipeg, chair of the national privacy and access law section of the CBA, told Law Times, "Currently the privacy commissioner's findings can only be advanced to Federal Court by the complainant or the commissioner with the complainant's consent and there isn't the ability for the organization which, in some cases, has been labelled a privacy infringer by the commissioner . . . to appeal that to the Federal Court.
"The danger is that organizations will be accused of invading privacy by the commissioner but won't be able to take steps to get judicial review to possibly defend themselves."
Bowman said there has been a lot of debate about the role and powers of the privacy commissioner.
"Some would argue that the commissioner has all the power that they need and they simply should use them more fully. We simply took the position that the structure should be changed and a new tribunal should be adopted and that tribunal, however, would have order-making power," he said.
Bowman noted that the Commons standing committee on access to information, privacy and ethics will be conducting the PIPEDA review, with hearings expected to begin Nov. 20 and continue for at least a month. Launched in 2001, PIPEDA will undergo a mandatory review by Parliament every five years.
Speaking at the recent IAPP conference, Lorene Novakowski, a lawyer with Fasken Martineau DuMoulin LLP in Vancouver, also noted that the summary form of the commission's findings is not necessarily helpful for organizations to understand new laws.
The findings of the OPC under PIPEDA are also generally looked upon by the Federal Court as being a non-binding precedent. Novakowski told Law Times that "that's created some concern [because] we're looking to these decisions as guiding us and giving us guiding principles and yet decision-makers are saying that they are not binding as precedent."
At the moment, the OPC also does not usually provide the names of respondents of complaints received under PIPEDA. Novakowski recently noted that only two complainants have been named out of more than 300 findings.
The lack of naming of parties or enforcement of the recommendations has led to a "lack of interest in compliance by many organizations subject to PIPEDA," noted Novakowski.
"If you look at what legal theorists have said about the traditional ombuds-model, one of the tools that the ombudsperson has had to engender enforcement has been the naming of the parties, because you have the reputational risk issue," she added.
Novakowski also added that it is of value to have some consistency across Canada between the enforcement models for the federal PIPEDA legislation and the provincial legislation.
Other issues brought up by the OPC in its review document include consent, such as collection and disclosure for law enforcement or national security purposes, the duty to notify, and the transborder flows of personal information.
