In Canada, we have some of the most stringent privacy legislation in the world, and in my public records research, I’m constantly coming up against privacy laws that complicate my work and keep me from finding as much information about private citizens as I’d like. As a private citizen myself, however, I’m grateful for these laws, which seem to get strengthened whenever they’re challenged in the courts.
Even with police searches, the trend seems to be toward recognizing privacy interests. In a recent ruling, for example, the Supreme Court of Canada declared unanimously that a specific search warrant is required to search the contents of a personal computer or cellphone. The Court drew a distinction between computers, which contain a large amount of personal information, and other types of receptacles in the home. When it comes to privacy concerns, the computer must be treated as a separate place:In effect, the privacy interests at stake when computers are searched require that those devices be treated, to a certain extent, as a separate place. Prior authorization of searches is a cornerstone of our search and seizure law. The purpose of the prior authorization process is to balance the privacy interest of the individual against the interest of the state in investigating criminal activity before the state intrusion occurs. Only a specific, prior authorization to search a computer found in the place of search ensures that the authorizing justice has considered the full range of the distinctive privacy concerns raised by computer searches and, having done so, has decided that this threshold has been reached in the circumstances of a particular proposed search.
In another recent decision, however, the Supreme Court highlighted the importance of freedom of speech when it conflicts with privacy concerns. In a case that involved a union photographing and videotaping people crossing a picket line during a strike, the Court struck down Alberta’s privacy legislation. The Court stressed the basic importance of freedom of expression in the context of labour disputes, saying the law imposed undue restrictions on the union’s ability to communicate and promote its case during a legal strike. It gave the province a year to make appropriate changes.
Meanwhile, Manitoba, which recently enacted its Privacy Information Protection and Identity Theft Prevention Act (“PIPITPA”), may also have to make some changes, as it based its legislation on the Alberta model. Manitoba is now the fourth Canadian province to enact general private sector privacy protection legislation (the others are British Columbia, Alberta and Quebec), the key feature of which is the breach notification provision: an organization must notify affected individuals if personal information under the organization’s control is lost, accessed or disclosed without authorization.
Finally, this news is a good reminder that being in contravention of privacy laws can cost businesses: the Federal Court recently ordered Bell Canada to pay $21,000 in damages in connection with conducting a credit check on a customer without consent.
Wondering about the various public and private sector privacy legislations in Canada? This site has a good overview.