By John Jager, CIPP/US, CIPP/G, CIPP/C

Over the past few years there have been a growing number of cases where organizations subject to a decision from a privacy commissioner have sought to have those decisions modified or overturned by the courts. The most notable of these cases is Canada (Privacy Commissioner) v. Blood Tribe Department of Health —where the court ruled on the federal privacy commissioner’s ability to view documents for which solicitor-client privilege was claimed. However, others include Information and Privacy Commissioner of Alberta and United Food and Commercial Workers, Local 401 and Leon's Furniture Limited v. Alberta (Information and Privacy Commissioner).

In May 2013, in Economical Mutual Insurance Company v. Information and Privacy Commissioner for British Columbia, the Supreme Court of British Columbia ruled in favour of an applicant who sought to have set aside portions of an order issued by the information and privacy commissioner of BC (OIPC).

Background in Economical

As part of its home insurance policy renewal process, Economical obtained an individual’s Canadian Property Loss Score (CPLS) and used it in making its underwriting decision without the consent of the individual concerned. After conducting an investigation, the OIPC determined that Economical’s collection of the CPLS was for a reasonable purpose but that Economical had not given the complainant proper notice of its purpose for collecting the credit information.

The OIPC issued a number of orders that applied not just to the complainant but to all of Economical’s policyholders. The orders included providing all home insurance policyholders who have not been provided adequate notice and all present and future applicants for home insurance with notice that a credit score based on their credit information may be obtained for the purpose of assessing future risk of loss in connection with underwriting their policies, and to review the consents obtained from home insurance policyholders since the Personal Information Protection Act (PIPA) came into force on January 1, 2004, in order to ascertain whether these individuals have been provided with notice that a credit score based on their credit information may be obtained for the purpose of assessing future risk of loss in connection with underwriting their policies.

Economical’s appeal to the Supreme Court sought to set aside the orders, except as they pertain to the complainant.

Court’s Decision

The Supreme Court found that while the insurer’s right to collect the information raised a general question applicable to all policyholders, the consent issue did not. The consent issue was focused on the particular consent that the complainant had given and did not raise the issues of the consent that other policyholders may have given, and no evidence was led concerning such consents. The court determined that the OIPC made the orders without giving Economical the opportunity to make submissions on the remedies in regard to consents that not been in issue in the inquiry and so rendered the process unfair and breached the rules of procedural fairness.

The court noted that section 50(1) of the PIPA authorizes the commissioner to decide all questions of fact and law arising in the course of the inquiry. However, it does not provide an overriding authority to decide facts and issues that are not before the inquiry—in making its decision, the commissioner had to confine its orders to the ambit of the question before it.

The Supreme Court therefore ruled that the orders are not reasonable and must be set aside.

Implications

The above case should give organizations subject to an order from a privacy commissioner pause for thought. Orders should be carefully reviewed by counsel to ensure that the order is consistent with the jurisdictional reach of the privacy commissioner, whether the relevant privacy law is overreaching or if the interpretation of the law goes beyond the intent or wording of the law, or if the commissioner’s order goes beyond the scope of the inquiry.

John Jager, CIPP/US, CIPP/C, CIPP/G, is vice president of research services at Nymity, Inc., which offers web-based privacy support to help organizations control their privacy risk. He may be reached at john.jager@nymity.com.

Read more by John Jager:
CANADA—BC Supreme Court Case Indicates Importance of Access Policies
CANADA—Bill Would Allow for Warrantless Communication Interception
CANADA—Cases Underscore Importance of Structured Privacy Program