Yessy Byl
Blair, Chahley, Seveny
Edmonton, Alberta

PRIVACY LEGISLATION IN THE PRIVATE SECTOR

10 MINUTE LABOUR LAWYER UPDATE

CALL CONFERENCE JUNE 2004

Effective January 1, 2004, federal legislation ensured that the private sector in both federal and provincial jurisdictions would be subject to privacy legislation.

The Federal Personal Information Protection and Electronic Documents Act, (“PIPEDA”) effective January 1, 2001, contains a rather unusual provision. Section 30 (1) provides that the Act did NOT apply to the regulation of protection of personal information within the provinces, and only applied to federal undertakings. However, section 30 (2) goes on to provide that section 30(1) ceases to be of effect three years after the effective date of PIPEDA, i.e. January 1, 2004. The purpose of this section is to ensure that the provinces enacted their own privacy legislation applicable to the private sector, failing which, PIPEDA would apply. Whether or not Parliament has the jurisdiction to enact such legislation is a constitutional question left for another day and forum. Regardless, the provinces which have not enacted their own legislation have apparently assumed that PIPEDA does apply within their jurisdiction. Since the European Community has declared that they will not trade with jurisdictions without privacy protection, it is not likely that any of the provinces will challenge the constitutionality of s. 30 of PIPEDA.

Legislative update

Only the provinces of Quebec, Alberta and British Columbia have enacted their own legislation. Apparently only the Quebec legislation has been officially approved as substantially similar to PIPEDA, which leave the lovely conundrum of what actually is the state of privacy legislation in Alberta and British Columbia. Nonetheless, these two provinces have been operating under the assumption that the provincially enacted legislation applies and have, I’m told, been given assurances that their legislation will be approved very shortly.

The fact that most provinces have not enacted their own legislation has resulted in an interesting situation with respect to “personal employee information” which is specifically included and provided for in the Alberta and B.C. Acts. Section 4(1)(b) of PIPEDA provides that the Protection of Personal Information Part ONLY applies to 1) personal information collected, etc., by an organization in the course of “commercial activities” OR if the personal information is about an employee who works within the federal jurisdiction. It appears, notwithstanding section 30(2), that PIPEDA would NOT apply to personal employee information with respect to employees in the private sector under provincial jurisdiction! There appears to have been no determinations made on this issue as yet.

Aside from the issue of applicability, PIPEDA presents some problems in terms of the ability of unions to collect and use “personal employee information” as discussed in previous sessions on privacy legislation but the very few recent court cases dealing with the issue have very much taken a “hands off approach”.

In Quebec, the Act Respecting the Protection of Personal Information in the Private Sector has been in force since 1993. It applies to trade unions (as being “enterprises” pursuant to the Civil Code). The wording of that legislation appears to safeguard unions’ rights to collection, use and distribution of employee information and indeed

article 18 specifically allows for the disclosure of personal information to people where the disclosure is pursuant to law or a collective agreement.

The Alberta and British Columbia legislatures have chosen to enact provisions dealing specifically with employee information. For example, in relation to the collection of personal employee information, the Alberta Protection of Personal Information Act, provides:

15(1) Notwithstanding anything in this Act other than subsection (2), an organization may collect personal employee information about an individual without the consent of the individual if

(a) the individual is an employee of the organization, or

(b) the collection of the information is for the purpose of recruiting a potential employee.

(2) An organization shall not collect personal information about an individual under subsection (1) without the consent of the individual unless

(a) the collection is reasonable for the purposes for which the information is being collected,

(b) the information consists only of information that is related to the employment or volunteer work relationship of the individual, and

(c) in the case of an individual who is an employee of the organization, the organization has, before collecting the information, provided the individual with reasonable notification that the information is going to be collected and of the purposes for which the information is going to be collected.

(3) An organization may disclose personal employee information about an individual without the consent of the individual where that information is being disclosed to an organization that is collecting that information under subsection (1).

(4) Nothing in this section is to be construed so as to restrict or otherwise affect an organization’s ability to collect personal information under section 14.

The British Columbia Personal Information Protection Act provides:

Collection of employee personal information

13 (1) Subject to subsection (2), an organization may collect employee personal information without the consent of the individual.

(2) An organization may not collect employee personal information without the consent of the individual unless

(a) section 12 allows the collection of the employee personal information without consent, or

(b) the collection is reasonable for the purposes of establishing, managing or terminating an employment relationship between the organization and the individual.

(3) An organization must notify an individual that it will be collecting employee personal information about the individual and the purposes for the collection before the organization collects the employee personal information without the consent of the individual.

(4) Subsection (3) does not apply to employee personal information if section 12 allows it to be collected without the consent of the individual.

Substantially similar provisions exist for the use and for disclosure of personal employee information under both Acts.

The inclusion of s.2(b) in the B.C. legislation is, I believe, a major point of difference between the Alberta and B.C. Acts. This wording appears in many of the public sector privacy acts and has been used to safeguard the unions’ rights to information relating to the role of representatives of employees. The Alberta legislature chose to provide somewhat similar protection but in the regulations:

19. Without restricting the generality of sections 14(b), 17(b) or 20(b) of the Act, an organization may collect, use and disclose personal information about an individual without the consent of the individual in the following circumstances:

(a) the collection, use or disclosure is necessary to comply with a collective agreement referred to in section 128 of the Labour Relations Code;

(b) the collection, use or disclosure is necessary to comply with an audit or inspection of or by the organization where the audit or inspection is authorized or required by a statute of Alberta or Canada, an Alberta regulation or a Canada regulation;

(c) the collection of personal information is authorized or required by a statute of Alberta or an Alberta regulation and the method of collection is by way of a form approved or otherwise provided for under that statute or regulation.
There is another interesting provision in the Alberta regulations:

7. For the purposes of sections 14(e), 17(e) and 20(j) of the Act, personal information does not come within the meaning of "the information is publicly available" except in the following circumstances:

(a) the personal information is contained in a telephone directory but only if

(i) the information consists of the name, address and telephone number of a subscriber to the directory,

(ii) the directory is available to the public, and

(iii) the subscriber can refuse to have the personal information appear in the directory;

Considering the number of cases both in the Courts and Labour Boards which have decided that employee lists with home phone numbers and addresses are to be generally considered “confidential” or “private” information, this provision is a welcome change.

Case Law Update

There have been at least a few recent cases dealing with privacy issues. Despite the very few numbers of cases dealing with issues involving collective bargaining regimes, it appears that the Courts are becoming more reluctant to interfere in the labour relations field and prefer the “hands off” approach even in relation to privacy legislation. A review of the Privacy Commissioner’s findings under PIPEDA suggest that it was assumed he had jurisdiction to deal with privacy issues within the context of workplaces governed by collective agreements (e.g. PIPED Act Case Summaries #114, 145, 179). This assumption was specifically overturned in a judgment rendered May 13, 2003 by the Federal Court Trial Division in L’Ecuyer v. Aeroports de Montreal [2003] F.C.J. No. 752. In that case, L’Ecuyer, an airport employee, had filed an harassment complaint against a manager and in the course of pursuing the complaint and in the face of complaints and discipline imposed on her, made a number of requests for access to personal information. The employer’s human resources director refused the applications for access and copied the written refusal to union representatives (whom the plaintiff had not copied on her access applications). The plaintiff complained to the Privacy Commissioner on the refusal of access and on the disclosure of “personal information” to the union representatives. The Privacy Commissioner upheld the complaint with respect to the disclosure of the information to the union representatives. The Federal Court first of all found that the Commissioner did not have jurisdiction to deal with the complaint based on the Weber decision. The Court found that the dispute arose in the context of the work relationship and therefore jurisdiction to deal with the issues lay exclusively with a grievance arbitrator. The Court did not stop with that jurisdictional finding but went on to remark on the fact that the employer had a duty to disclose its reply to the union since the union was the “exclusive spokesperson for its members on working conditions”. Indeed, the Court remarked that direct communication from the employer to an employee could constitute infringements of the Code and the collective agreement. The Court specifically referred to section 7(3)(i) of PIPEDA which allows for the disclosure of personal information without consent when such disclosure is “required by law”.

A more recent decision by the Privacy Commissioner dealt with evidence during the course of an arbitration hearing. In PIPED Act Case Summary #198, an employee who had testified as a witness in an arbitration case complained about the employer’s lawyer disclosing personal information when that lawyer cross examined her on her past performance evaluations. The Commissioner did dismiss the complaint on the basis that the arbitrator had the power to compel the production of information – even though it appears there was no such order, there was simply “consent” by the arbitrator to introduce that evidence.

The provisions of the Privacy Act which apply to federal public servants present quite a different set of problems because of the very detailed provisions of that legislation. However, it is interesting to see that the specific role of the union in obtaining (or trying to obtain) employment information is rarely addressed even though that Act provides for “public interest” being one of the factors to be considered in the decision as to whether to release information. (See, for example, the S.C.C. decision in Dagg v. Canada [1997] 2 S.C.R. 403.) In a recent Federal Court decision, the Court did remark upon public interest considerations in the context of a union rep’s request for information about discretionary bonuses – albeit in the context of the union’s proposal to conduct an analysis of the expenditure of public funds and not in the context of representational rights. However, one case dealing with the Privacy Act did deal with the role of the union and could be of relevance in cases dealing with the private sector. In Lavigne v. Canada Post Corp. [2002] F.C.J. No. 1143 (August 14, 2002), the Federal Court Trial Division struck a statement of claim, filed by a post office employee who claimed the employer violated his privacy rights and therefore the Privacy Act, by using personal information (date of birth) to determine the employee’s seniority ranking (as specifically provided for in the collective agreement). Relying on Weber, the Court found that since the collective agreement provided for the method of determining seniority, the use of the personal information in that context was an issue that was solely within the jurisdiction of a grievance arbitrator. This short judgement was eventually upheld by the Federal

Court of Appeal at [2003] F.C.J. No. 897 and leave to appeal to the Supreme Court was dismissed in early 2004.

Another recent Federal Court decision dealing with PIPEDA may be of some relevance although the case does not deal with a collective bargaining relationship. In Englander v. Telus Communications Inc. [2003] F.C.J. No. 975, a customer of Telus complained that telephone subscribers’ personal information was published in a directory and that Telus should not be able to charge a fee for unlisted numbers. The Court found that, in the face of “a long-standing and well established practice...to include directory listings as part of residential telephone service.....customers have a reasonable expectation that unless they subscribe to NPNS, their listing information will be published in the phone directory.” The Court referred to clause 4.3.5 of Schedule 1 of PIPEDA which refers to an organization being able to “assume” that a customer is consenting to use of information if it is a “reasonable expectation”.

Paranoic Mutterings

Generally, trying to apply the privacy laws to a collective bargaining relationship seems to be rather like fitting a square peg into a round hole. It just doesn’t fit! What becomes even more problematic, however, is the application of privacy legislation to the internal affairs of a trade union. Clearly, the Acts apply to trade unions. So do we apply privacy legislation to the actions of elected officials, for example? It may well be that PIPEDA provides an exception in section 4(a) by restricting the applicability to “commercial activities” (whatever that may be in relation to union activities), but this “commercial activities” restriction does not appear in the Alberta nor British Columbia legislation. I believe the wording of the Quebec legislation may have a similar effect to s. 4(a) of PIPEDA but I have not researched the case law on that legislation. But rest assured, there will be bargaining unit members raising privacy issues in one form or another in the future!

Generally, the Courts seem to be leaning towards deferring privacy issues to the arbitration arena. Hopefully this approach will continue since the legislation presents so many problems within the context of collective bargaining regimes. Of course, the next update topic will be “How Arbitrators are Applying the Privacy Legislation”!