October 30, 2013
The nature of privacy law–as well as its practice–has changed in a number of ways in recent years. Lexpert sought the comment of partner Patrick Flaherty for its article on how and why privacy has changed–and how practitioners may best navigate the developments in the area. Excerpts of two sections of the article that feature Patrick’s comments are below.
In conjunction with its growth, privacy law has moved from the background to the foreground. “Two things happened that turned privacy law from a one-off sideshow to the front lines of all areas of practice in which business law firms engage,” Flaherty says. “The first was a statutory evolution, with the introduction of PIPEDA in 2011 and its provincial equivalents in Alberta and B.C. afterwards; the second was a market force reflected by the digitization of information collection and storage, and the rise of things like online commerce and social media, all of which led to exponential growth in the amount of personal information being collected, store and used for business purposes.”
How Far Does Privacy Law Reach?
As the Privacy Commissioner of Canada notes in Privacy Handbook for Lawyers: PIPEDA and Your Practice, no general litigation exemption exists in the Act (although such an exemption does appear in provincial privacy legislation in Alberta, British Columbia, and Quebec).
“It thus falls to counsel to consider the extent to which his or her freedom to collect, use and disclose personal information is limited by PIPEDA and the rights it vests in individuals to control collection, use and disclosure of their information,” says Patrick Flaherty of Torys LLP.
But issues with PIPEDA’s application to litigation remain. “The Privacy Commissioner of Canada has expressed the view that both Ferenczy and State Farm should not necessarily be viewed as authority that PIPEDA does not apply to litigation generally, particularly since both cases were decided in the factual context of activities in defence of personal injury claims against individuals, which are said to be different than, for example, litigation by or between commercial organizations,” Flaherty notes.
It may also be significant that the facts in these cases related only to the collection and not the use or disclosure of information. “Use and disclosure has not been specifically addressed in the case law,” Flaherty says, “Moreover, the Federal Privacy Commissioner has entertained complaints by individuals about the use and disclosure of personal information in litigation and has not applied the same reasoning the courts used in Ferenczy and State Farm regarding the scope of commercial activity.”