Showing posts with label PIPEDA. Privacy. Show all posts
Showing posts with label PIPEDA. Privacy. Show all posts

Friday, January 07, 2011

This Week At The Ontario Court of Appeal: 11-01-07

Each week, Wise Law Blog reviews recent decisions by the Ontario Court of Appeal.

Ontario (Labour) v. Enbridge Gas Distribution. Regular readers of Court of Appeal decisions know that Justice Watt's Hemingwayesque introductions to his decisions are frequently lyrical, so before we discuss the decision, enjoy the introduction:
[1] Explosions damage and destroy things. Sometimes, their victims are people. Like here. An explosion damaged and destroyed several buildings. Hurt some people too. And killed others. This explosion was preventable. If only...

[2] A contractor using a backhoe displaced a natural gas pipeline. Natural gas crept into the basement of a two-storey commercial plaza. A source of ignition entered the mix. An explosion and fire followed. Buildings were damaged and destroyed. People were injured. And seven people were killed.
The action in question deals with the province's subsequent action against Enbridge (and the company hired to accurately locate the existing pipelines, Precision Utility) in regards to the gas explosion. At trial, the defendants moved for a summary dismissal, which the trial judge granted. The province successfully appealed that dismissal to Superior Court and got a new trial. The defendants then sought leave to appeal.

The defendants' dismissal argument was that prosecution was barred under the Occupational Health and Safety Act because the information was not laid within the time required by the Act. They further argued that there was no statutory duty on them under the Act as they were not "employers" by the relevant definitions. Finally, they argued that the shifting theory of guilt advanced by the prosecutors merited dismissal. The motion judge accepted these arguments; the Superior Court appeal judge did not.

The Court declined to grant the defendants leave to appeal for multiple reasons. Firstly, Justice Watt stated that the basis of liability advanced by the prosecutor did not amount to a new theory of liability even if some facts may have changed over the course of the initial trial. Secondly, he stated that since Enbridge and PUL had contracted with one another to perform services, both were considered "employers" under the Act, and that therefore the Superior Court's decision was neither obviously wrong nor of doubtful correctness. Thirdly, he stated that the the question of the limitation period was a mixed one of both fact and law, and therefore this weakened the ground for appeal. Finally, he stated that the grounds for appealing based on Enbridge's providing of information to the digging company were too specific to take a potential appeal into the realm of generally important law. Read-the-whole-case file: 4, both for Watt's entertaining style and his easily followed explanation of what constitutes a worthy appeal.

Citi Cards Canada v. Pleasance. Citi Cards obtained a credit card-related judgement against Mr. Pleasance for approximately $11,000 and sought to enforce it through a sheriff's sale of Mr. Pleasance's home. However, the sheriff would not conduct the sale without mortgage discharge statements from TD Canada Trust, who owned the note on the home, and who refused to provide those statements to Citi. Citi applied for an order requiring the bank to produce the documents. The application judge dismissed their application on the basis that the documents contain personal information and therefore the bank was barred from releasing the information due to the Personal Information Protection and Electronic Documents Act. (Which was, in fact, the bank's reason for refusing to disclose.) The judge also noted that Citi had an alternate remedy available to it: it could move to examine Mr. Pleasance's wife. Citi appealed.

The Court dismissed the appeal, finding that the Act did in fact apply in this instance. The Court reaffirmed that financial information disclosed to a mortgagor qualified as personal information under the Act, and agreed with the application judge that the exemptions available under s. 7(3) of the Act did not apply to Citi's request. Citi had argued that the wording of the act meant that personal information could be disclosed whenever the organization [i]or[/i] the individual whose information could be collected was legally obligated to provide it. The Court disagreed wholly with this argument, suggesting that the language used plainly suggested that this was not the case and the legal obligation exemption only applied where the organization, not the individual whose information was at question, was required to disclose. Read-the-whole-case rating: 2.

Simmons v. Hamber. Hamber, a partner at Harrison Pensa LLP, was retained to do the necessary legal work for two transactions between the L.J. Simmons Group and Anchordale Holdings, the personal holding company of John Simmons. Mr. Simmons chose to declare personal bankruptcy, and as a part of this the Simmons Group and Anchordale Holdings agreed to a deal where the Group's existing debt to Anchordale would be converted into non-retractable, non-voting preference shares with no value. Mr. Hamber prepared the transaction, having been hired by another member of the Simmons Group, and was retained by both the Group and Anchordale. Seven years later, Mr. Simmons came to a dispute with his partners in the Group and was terminated, and subsequently brought action against Mr. Hamber for breach of professional duty in failing to discuss with Mr. Simmons the need for independent legal advice or alternatives to the transaction. The trial judge dismissed the action and Mr. Simmons appealed.

The Court of Appeal agreed with the trial judge. Citing the Rules of Professional Conduct of the Law Society of Upper Canada, they found that in the circumstances of this situation there was no obligation on Mr. Hamber to recommend independent legal advice to Mr. Simmons. Mr. Hamber had been informed by Mr. Simmons' partner that shares in the Group had no value in and of themselves, and that the debt owed to Mr. Simmons was of no substance, and was entitled to rely on that since he was informed by the individual who he normally dealt with in regards to the Simmons Group's affairs. Further, Mr. Simmons' position as an experienced businessman who had been through previous share restructurings rightly gave Mr. Hamber the view that he understood the simple transactions that were taking place.

The Court also agreed with the trial judge that Mr. Hamber did not have a duty to discuss alternatives with Mr. Simmons, as that action was rooted in Mr. Simmons' claim that he and the other partners had an additional agreement of which Mr. Hamber was unaware. As the transactions Mr. Hamber were aware of were relatively straightforward, there was no breach of duty to discuss alternatives. Read-the-whole-case rating: 3 for a readable examination of lawyer's duties in these circumstances.
- Christopher Bird, Toronto
Visit our Toronto Law Firm website: www.wiselaw.net

Thursday, July 16, 2009

Canada Privacy Commissioner: Facebook Violates Privacy Law

A report released today by Canada's Privacy Commissioner finds that that Facebook is in violation of PIPEDA, Canada's Personal Information Protection and Electronic Documents Act, and calls upon Facebook to comply with Canadian privacy legislation.

See: Report of Findings into the Complaint Filed by the Canadian Internet Policy and Public Interest Clinic (CIPPIC) against Facebook Inc.Under the Personal Information Protection and Electronic Documents Act by Elizabeth Denham, Assistant Privacy Commissioner of Canada

A news release from the Office of the Commissioner summarizes the report:

OTTAWA, July 16, 2009 — In order to comply with Canadian privacy law, Facebook must take greater responsibility for the personal information in its care, the Privacy Commissioner of Canada said today in announcing the results of an investigation into the popular social networking site’s privacy policies and practices.

“It’s clear that privacy issues are top of mind for Facebook, and yet we found serious privacy gaps in the way the site operates,” says Privacy Commissioner Jennifer Stoddart.

...The Privacy Commissioner’s report recommends more transparency, to ensure that the social networking site’s nearly 12 million Canadian users have the information they need to make meaningful decisions about how widely they share personal information.

The investigation also raised significant concerns around the sharing of users’ personal information with third-party developers creating Facebook applications such as games and quizzes. (There are more than 950,000 developers in some 180 countries.) Facebook lacks adequate safeguards to effectively restrict these outside developers from accessing profile information, the investigation found.

The report recommended a number of changes, including technological measures to ensure that developers can only access the user information actually required to run a specific application, and also to prevent the disclosure of personal information of any of the user’s friends who are not themselves signing up for an application.

The investigation also found that Facebook has a policy of indefinitely keeping the personal information of people who have deactivated their accounts – a violation of the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s private-sector privacy law. The law is clear that organizations must retain personal information only for as long as is necessary to meet appropriate purposes.

Recommendations to Facebook included the adoption of a retention policy whereby personal information in deactivated accounts is deleted after a reasonable length of time.

Facebook has agreed to adopt many of the recommendations stemming from the Privacy Commissioner’s investigation or, in some cases, has proposed reasonable alternatives to the measures recommended. However, there remain a number of recommendations that Facebook has not yet agreed to implement.

“We urge Facebook to implement all of our recommendations to further enhance their site, ensure they are in compliance with privacy law, and ultimately show themselves as models of privacy,” says Assistant Commissioner Elizabeth Denham, who led the investigation on behalf of the Office.

CBC News also reports on the Privacy Commissioner's findings today:
Facebook shares personal information with developers who create games and quizzes in a way that breaches Canadian privacy law, the office of the Privacy Commissioner of Canada has found.
The popular social networking site, which is used by 12 million Canadians, doesn't have enough safeguards to prevent those third-party developers from getting "unauthorized" access to users' personal information, said the report released Thursday by assistant privacy commissioner Elizabeth Denham.
The report also found Facebook continues to breach the Personal Information Protection and Electronic Documents Act in three other ways:
  • It keeps information from accounts deactivated by users indefinitely and does not make it clear that users can also choose to delete their accounts rather than just deactivate them. Nor does it explain the difference in its privacy policy.
  • It keeps the profiles of deceased users for "memorial purposes," including this in its terms of use. That means users cannot opt out.
  • It allows users to post personal information about non-users without their consent. For example, it allows them to tag photos and videos of non-users with their names, and provide Facebook with their email addresses to invite them to join the site. It keeps the addresses indefinitely.