MICHAEL GEIST
Thursday, October 11, 2001
When Canada's new privacy legislation took effect on Jan. 1, it meant the basic law was in place, but decisions fleshing out the meaning of the statute and the equivalent provincial privacy laws were yet to come.
Nearly 10 months later, it has become apparent that this process may prove as contentious as the enactment of the law itself. Interestingly, it will not be privacy advocates battling data collectors this time round.
Rather, the fight will be between the federal and provincial governments on the one hand, and Canada's Privacy Commissioner on the other, concerning who sets the agenda for Canadian privacy policy.
In certain respects, this should come as no surprise. When former Industry Minister John Manley spoke in favour of the legislation to a parliamentary committee in 1998, he noted that the Canadian government would not "have a residual role to play in protecting the privacy of Canadian citizens." The government, Mr. Manley continued, has "a responsibility to all."
George Radwanski, appointed last year as Canada's Privacy Commissioner for a seven-year term, speaks of his role in much the same manner. In virtually all of his public addresses, he notes that he considers himself to be the "champion of privacy rights for all Canadians."
With both the government and the Privacy Commissioner anxious to seize the mantle of key protector of personal privacy, battles over who decides what were bound to occur.
First, the Privacy Commissioner resisted publishing his decisions that interpret the new statute. When the matter was raised in a previous Cyberlaw column, as well as in a public letter from dozens of leading privacy law practitioners this spring, the commissioner responded by saying he was actively looking into publishing his decisions with the names of the parties removed.
Several months later, little progress has been made. The Canadian public still has no idea how many privacy complaints have been launched, nor how many have been resolved, since the Privacy Commissioner has not published that information. (The commissioner's office rejected requests for comments in advance of this article.) Three decisions have been made public, but one of those, focusing on video surveillance, was released by the Northwest Territories Information and Privacy Commissioner, not by the federal Privacy Commissioner.
Second, a very public battle is brewing over the implementation of provincial privacy statutes. The federal law acknowledges that the Canadian government is constitutionally prohibited from regulating certain kinds of personal information, such as some health data that falls under provincial jurisdiction.
Accordingly, the law creates a clear window for the provinces to enact their own privacy statutes. Provided that the provincial law is substantially similar to the federal law, the provincial version will govern within the province.
Several provinces, including Ontario and British Columbia, have given indications that they intend to enact their own private sector privacy legislation, while Quebec has had such legislation in effect for many years.
With several provincial initiatives on the way, the question of who decides whether the provincial laws meet the so-called substantial similarity test is an important one. Although most understood this to be a decision of the federal government through the Governor-in-Council, earlier this year the Privacy Commissioner began suggesting that the decision belonged to him.
In an appearance before an Ontario parliamentary committee hearing on a proposed privacy law, Mr. Radwanski noted that he felt it was necessary to advise the province that, in his view, their proposed law would not meet the substantial similarity test. Soon after, speaking to a group of Ontario lawyers, he reportedly commented that he was not bound by the federal government's prior assurances that the Quebec law meets the test.
Last month it became clear that the federal government was unwilling to allow this uncertainty to fester. It released what it now says is the substantial similarity test. To meet the test, provincial laws must incorporate the federal law's 10 privacy principles, as well as create an independent oversight system and a redress mechanism. The federal government noted that it would seek the Privacy Commissioner's views on the matter, but made clear that it will decide the issue.
While this should settle this skirmish, the desire for a central role for the Privacy Commissioner in formulating privacy policy seems unlikely to end. Late last month, the commissioner appeared before a Senate hearing into a proposed Privacy Rights Charter, which seeks to entrench privacy rights by filling in any gaps that may exist within the current framework. Surprisingly, the commissioner opposed the bill "in the strongest possible terms."
His opposition stemmed not from the new privacy rights created by the bill, but rather because it creates a private right of action that would enable individuals to bring lawsuits against organizations for breaching their privacy.
The commissioner noted that this was unnecessary, since Canadians can already bring their complaints to his office. Private lawsuits, he felt, would create "a very dangerous mishmash" that could create great confusion. Better, it would seem, to leave the matter of Canadian privacy policy and decision-making to him.
Michael Geist is a law professor at the University of Ottawa Law School and director of e-commerce law at the law firm Goodmans LLP. His Web site is http://www.lawbytes.com.
mgeist@uottawa.ca
Tech News
