Maurushat, Alana --- "Ecuyer et Aéroports de Montréal: Canada's private sector privacy law sidelined by labour code" [2003] PrivLawPRpr 33; (2003) 10(3) Privacy Law and Policy Reporter 56

---

Ecuyer et Aéroports de Montréal: Canada’s private sector privacy law sidelined by labour code

Alana Maurushat UNIVERSITY OF HONG KONG

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA)^[1] entered into force as of January 2001, causing many Canadian corporations and organisations to re-examine and modify their access to and the utilisation of personal information protocols to meet the requirements of the legislation.^[2] PIPEDA is a federal Act which applies to federal works, undertakings, and businesses. The purpose of the Act is to provide a unified and clear overarching umbrella of privacy provisions that counter the effects of rapid technological advancement which increasingly facilitates the circulation and exchange of personally identifiable information and, consequently, the potential for escalating privacy rights violations. To fulfil its purpose, PIPEDA contemplates a procedure whereby a complainant whose information privacy has been breached may file a complaint with the Privacy Commissioner of Canada, and obtain remedies in the Federal Court.

Section 11 confers powers upon the Privacy Commissioner of Canada to receive, make and investigate complaints regarding breaches of privacy under PIPEDA and to report findings of the investigation. Under s 14, a complainant may, after receiving the Commissioner’s report, apply to the Federal Court for a hearing in respect of any matter which the complaint was made, or that is referred to in the Commissioner’s report. Under s 16, the Federal Court may award remedies, including awarding damages.

Since the enactment of PIPEDA, the Privacy Commissioner has commenced investigations culminating in 156 reported findings.^[3] The Federal Court of Canada has only had the occasion to examine PIPEDA in one recent decision, Ecuyer et Aéroports de Montréal.^[4] Remarkably, this very first decision calls into question the status of PIPEDA as a complete code for federal works and undertakings.

The plaintiff in the case, Diane L’Ecuyer, is the former Director and present Supervisor of the Access to Information Group at Dorval International Airport in Montreal. In March 2000 she made a harassment and abuse of power claim against another employee who was Vice Director of Exports. Several meetings were held between the plaintiff and representatives of Dorval Airport where union representatives and the Coordinator of Employee Relations for Dorval were present. Ecuyer requested access to documents held by her employer under PIPEDA. The plaintiff received a letter to the effect that Dorval Airport was refusing her request to obtain a copy of the documents. Dorval Airport subsequently sent a copy of the letter to two union representatives as well as the Coordinator of Employee Relations.

Ecuyer filed a complaint with the Privacy Commissioner of Canada alleging that she had not explicitly consented to having copies of the letter requesting documents sent to third parties. In response to the allegations, Dorval Airport claimed that consent was implicit given that the union representatives and the Coordinator of Employee Relations had intervened in previous meetings.

Clause 4.3 of Sch 1 of PIPEDA specifies that knowledge and consent are required of the individual for the collection, use, or disclosure of personal information, except where inappropriate. Clause 4.5 of the same Schedule further states that personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Finally, s 5(3) of PIPEDA provides an objective standard stating that an organisation may collect, use or disclose of personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

The Commissioner found that under cl 4.3 and s 5(3) of PIPEDA, there had neither been direct nor implied consent for the employer to have sent the letter to the union representatives. Satisfied that a reasonable person would have considered disclosure to union representatives inappropriate, he ruled that the complaint was well founded.

With respect to the Coordinator of Employee Relations, the Commissioner found the opposite. In his view, the employer was in compliance with cl 4.5 of PIPEDA, noting that a reasonable person would have considered communication with the Coordinator of Employee Relations appropriate under the circumstances.

The Commissioner advised Dorval Airport that in future situations it should allow individuals with requests the opportunity to decide whether copies should be sent to third parties. Apparently, the organisation has since followed this advice when dealing with information requests.

Not content with the Commissioner’s findings, Ecuyer applied to the Federal Court for a hearing on the matter pursuant to s 14 of PIPEDA. She contended that information was disclosed to third parties without requisite prior consent as provided in cl 4.3 of Sch 1 and s 5(3) of the Act. Dorval Airport countered with arguments that neither the Privacy Commission nor the Federal Court of Canada had jurisdiction in this matter. In their opinion, the Canadian Labour Code is the governing legislation giving exclusive jurisdiction to a tribunal or arbitrator depending on the wording of the clause in the collective agreement.

The Federal Court of Canada agreed with Dorval Airport, holding that the Canadian Labour Code is in fact the governing legislation, in this case giving exclusive jurisdiction to an arbitrator. While it is not uncommon in Canadian law for various authorities to have concurrent jurisdiction over a similar subject matter, the court is often called upon to determine who will have ‘lead’ or ‘superior’ jurisdiction. Pursuant to s 57 of the Canada Labour Code, the Court determined that an arbitrator as outlined in the collective agreement between union employees and the Dorval Airport had exclusive jurisdiction over the matter.

The Court also pronounced that, even if the Privacy Commissioner and Federal Court had proper jurisdiction, the plaintiff’s demand could not succeed as s 7(3)(i) of PIPEDA permits disclosure of personal information without prior consent providing it is lawful. In this case, s 36(1) of the Canada Labour Code mandates that the union agent is the exclusive negotiator, thereby, failure to send a copy of the letter to such authorities would contravene s 94(1) of the Code.

The decision has increased the uncertainty surrounding the application of PIPEDA. Firstly, it is no longer clear under what circumstances the Privacy Commissioner and Federal Court will have jurisdiction. Secondly, it is unclear whether the interpretation of s 7(3)(i) of PIPEDA requires entities to examine all other potentially applicable legislation containing provisions on information access to see whether these provisions or those provisions of PIPEDA would prevail. Because of this, federal entities may have to once again examine and alter their access to information policies. In doing so, these federal entities may have to develop multiple information privacy policies in order to conform with multiple sets of rules: the Canada Labour Code in employment areas where a collective agreement is involved, and PIPEDA for other matters. The decision has opened the door to further contestations of jurisdiction because of the open-ended nature of the exception in s 7(3)(i). In the end, PIPEDA may take a back seat to the Canada Labour Code and possibly more legislation to follow. l

Alana Maurushat teaches law at the University of Hong Kong; <[e-mail]>.

Endnotes

[1]. Personal Information Protection and Electronic Documents Act, SC 2000, cl 5.

[2]. Only specific sections entered into force in 2001, while the entirety of the legislation will take effect on 1 January 2004.

[3]. For the Commissioner’s Findings see <www.privcom.gc.ca/cf-dc/ index_e.asp>.

[4]. Ecuyer et Aéroports de Montréal, 2003 CFPI 573. Decision only available in French.