Untangling the Web of Canadian Privacy Laws
Total Page:16
File Type:pdf, Size:1020Kb
Reproduced by permission of Thomson Reuters Canada Limited from Annual Review of Civil Litigation 2020, ed. The Honourable Mr. Justice Todd L. Archibald. Shining a Light on Privacy: Untangling the Web of Canadian Privacy Laws BONNIE FISH AND ALEXANDER EVANGELISTA1 It was terribly dangerous to let your thoughts wander when you were in any public place or within range of a telescreen. The smallest thing could give you away. George Orwell, 1984 I. THE GENESIS OF PRIVACY LITIGATION Although there are more Canadian privacy laws than ever before and the right to privacy has quasi-constitutional status,2 Canadian citizens have never had greater cause for concern about their privacy. Our devices make public a dizzying amount of our personal information.3 We share information about our preferences and location with retailers and data brokers when shopping for online products and when shopping in physical stores using our credit cards, payment cards or apps. Smart homes and smart cities make possible Orwellian surveillance and data capture that previously would have been illegal without a judicial warrant.4 The illusion of anonymous or secure internet activity has been shattered5 by large scale privacy breaches that have exposed the vulnerability of our personal information to hackers.6 The COVID-19 crisis raises new privacy concerns as governments and private institutions exert extraordinary powers to control the outbreak, including the use of surveillance technologies.7 1 Bonnie Fish is a Partner and the Director of Legal Research at Fogler, Rubinoff LLP, Alexander Evangelista is an associate in the litigation department of Fogler, Rubinoff LLP. The authors thank Emily Duncan, articling student, Fogler, Rubinoff LLP, for her research assistance with this paper. 2 Lavigne v. Canada (Office of the Commissioner of Official Languages), 2002 SCC 53, [2002] 2 S.C.R. 773 (S.C.C.) at para. 22. 3 Cameron F. Kerry, “Why Protecting Privacy is a Losing Game Today and How to Change the Game” (2018) <https://www.brookings.edu/research/why-protecting-privacy-is-a- losing-game-today-and-how-to-change-the-game/>. 4 Ellen P. Goodman & Julia Powles, “Urbanism under Google: Lessons from Sidewalk Toronto” (2019) 88 Fordham L.R. 457 at 477-478. 5 Paul M. Schwartz & Danile J. Solove, “ The PII Problem: Privacy and a New Concept of Personally Identifiable Information” (2011) 86 N.Y.U.L. Rev. 1814 at 1836-37. 6 In 2018 Cambridge Analytica harvested the personal data of millions of people’s Facebook profiles without their consent and used it for political advertising purposes. Confessore, “Cambridge Analytica and Facebook: The Scandal and Fallout So Far” (2018) online: NY Times.com. 7 Framework for the Government of Canada to Assess Privacy Impactful Intiatives in response to Covid-19, priv.gc.ca; Arjun Karpal, “Use of Surveillance to fight Annual Review of Civil Litigation / 544 As concern for privacy has grown, the web of privacy laws has become increasingly complex and tangled. The Supreme Court has declared that privacy protection is necessary to preserve a free and democratic society and so ruled that privacy breaches engage Charter rights and privacy laws have a quasi- constitutional status. The Federal and provincial legislatures have addressed privacy concerns with a raft of legislation that governs the collection, use, and disclosure of personal data. Our courts have recognized a number of torts that offer remedies for breaches of personal privacy. This paper is intended to offer guidance in navigating the expanding landscape of Canadian privacy laws. The fundamental argument advanced is that the starting point for analyzing any privacy problem is the quasi- constitutional status of privacy laws. The paper begins by exploring that quasi- constitutional status and how privacy breaches engage the Charter. With this analytical framework in place, the paper then provides an overview of the statutory privacy schemes and common law privacy torts. The final section explains how the available statutory, Charter, and common law remedies fit together. II. WHY IS PRIVACY LITIGATION SO COMPLICATED? Privacy litigation is complicated because privacy is a broad concept with personal and public dimensions that can engage Charter, statutory and common law protection. The protection of privacy is partially addressed by privacy statutes and partially by the common law. As the Supreme Court has confirmed, privacy laws are quasi-constitutional and some breaches of privacy engage Charter rights. The statutory regimes address personal privacy as it relates to the collection, use and disclosure of personal data by governments and private sector organizations.8 However, data protection laws do not cover the entire privacy field. While there is a direct connection between data collection and personal privacy,9 protection of personal data is distinct from the right to privacy in life. Privacy extends to activities, decisions, thoughts, bodies and communications.10 One commentator explains how the concepts interact: Coronovirus raises concerns about government power after pandemic endsº CNBC, (March 26, 2020) <https://www.cnbc.com/2020/03/27/coronavirus-surveillance-used- by-governments-to-fight-pandemic-privacy-concerns.html> . See also ``How Volun- teers From Tech Companies Built a Coronavirus-Tracking Site in Six Daysº, Christina Farr, CNBC, March 24, 2020 <https://www.necn.com/news/national-international/ volunteers-from-tech-companies-built-coronavirus-tracking-site/2250388/>. 8 Charnetski, The Personal Information and Electronic Documents Act, A Comprehensive Guide (Aurora: Canada Law Book, 2001) at 203. 9 Steven Hetcher, ªChanging the Social Meaning of Privacy in Cyberspaceº (2001) 15 Harv. L.J. & Tech. 149 at footnote 29. 545 / Untangling the Web of Canadian Privacy Laws While ªprivacyº includes various aspects of ªdata protectionº, these are not one and the same. The ultimate purpose of [data protection laws] was to protect individuals from data-handling activities that were potentially harmful to them. This notion of ªrisk of harmº behind [data protection laws] . is actually broader than the notion of ªprivacyº and ªprivacyº is broader than data protection, although the two notions clearly overlap.11 Common law torts provide remedies for breaches of privacy outside of data protection. This divide between statutory and common law remedies is complicated by the fact that some provincial privacy statutes create a statutory cause of action for breach of privacy. The relationship between the statutory scheme and the common law is explored more fully below in the section which addresses the intersection between tort and statute. The quasi-constitutional status of privacy laws provides context to the field of privacy and how the laws should be interpreted. We begin with an analysis of the Supreme Court's approach to privacy. III. PERSONAL PRIVACY AS A CHARTER RIGHT Long before personal privacy was threatened by the Internet and social media, the Supreme Court recognized that protection from inappropriate intrusions by the state upon personal privacy was the underlying purpose of the right against unreasonable search and seizure in section 8 of the Charter of Rights and Freedoms.12 This purposive approach to interpreting section 8 was adopted by the Court in 1982 in Hunter et al. v. Southam Inc.: Like the Supreme Court of the United States, I would be wary of foreclosing the possibility that the right to be secure against unreasonable search and seizure might protect interests beyond the right of privacy, but for purposes of the present appeal I am satisfied that its protections go at least that far. The guarantee of security from unreasonable search and seizure only protects a reasonable expectation. This limitation on the right guaranteed by s. 8, whether it is expressed negatively as freedom from ``unreasonableº search and seizure, or positively as an entitlement to a ``reasonableº expectation of privacy, indicates that an assessment must be made as to whether in a particular situation the public's interest in being left alone by government must give way to the government's interest in intruding on the individual's privacy in order to advance its goals, notably those of law enforcement.13 [emphasis in original] 10 Helen F. Nissenbaum, ªPrivacy as Contextual Integrityº (2004) 79:1 Wash. L. Rev. 119 at 123-24. 11 Charnetski, supra note 8 at 204. 12 Canadian Charter of Rights and Freedoms, Schedule B to the Canada Act 1982, 1982, c. 11 (U.K.). 13 [1984] 2 S.C.R. 145 (S.C.C.) at 160. See also the dissenting judgment of Justice La Forest in Dagg v. Canada (Minister of Finance), [1997] 2 S.C.R. 403 (S.C.C.) at paras. 65-66 where he wrote: Annual Review of Civil Litigation / 546 In 1993 R. v. Osolin, Justice L'Heureux-Dube J., dissenting but not on this point, also wrote that privacy was the fundamental value protected by section 8: The importance of privacy as a fundamental value in our society is underscored by the protection afforded to everyone under s. 8 of the Charter ``to be secure against unreasonable search or seizureº. This value finds expression in such legislation as the Privacy Act, R.S.C., 1985, c. P-21, which restricts the purposes for which information may be used to those for which it was received.14 [emphasis in original] More recently in R. v. Spencer15 the Supreme Court considered whether the constitutional protection afforded to privacy applied to child pornography stored by an accused on a computer. The police identified the Internet Protocol (IP) address of a computer the accused used to access and store child pornography through an Internet file-sharing program. They then obtained from the Internet Service Provider (ISP), and without prior judicial authorization, the subscriber information associated with that IP address. The request was made pursuant to section 7(3)(c.1)(ii) of PIPEDA and ultimately led the police to the accused who was convicted by the trial judge.