In 2018, the Office of the Privacy Commissioner of Canada (“OPC”) began a reference to the Federal Court under subsection 18.3(1) of the Federal Courts Act (the “Reference”) in the context of an OPC investigation into a complaint made by an individual against Google. The complainant alleges that Google is contravening the Personal Information Protection and Electronic Documents Act (“PIPEDA”) by continuing to display links to news articles concerning the complainant when his name is searched using Google’s search engine. He requested that Google remove the articles from search results using his name (otherwise known as de-indexing).
In the costs motion (Kaplan v. Casino Rama, 2019 ONSC 3310) arising from the litigation regarding the Casino Rama breach, Justice Belobaba awarded costs to the defendant, saying there was neither public interest nor a novel issue sufficient to warrant costs being awarded to the plaintiffs. Justice Belobaba was of the view that the very basis for bringing the class action was questionable, a fact which played a role in the plaintiffs having to pay. This decision may have class counsel more closely scrutinizing the merits of bringing data breach class actions.
In an earlier decision released on May 7, 2019, Justice Belobaba dismissed the plaintiffs’ motion for certification, finding that the proposed class action “collapsed in its entirety” at the common issues stage.
In a further development in the on again/off again transborder data flows consultation, the Office of the Privacy Commissioner of Canada (“OPC”) has announced it is on again.
The OPC made the announcement on June 11, 2019 and characterized this new consultation as a “re-framing” of the prior, withdrawn one. Our commentary on the on again/off again process can be found here, here and here.
The OPC said it had decided to change its approach to consultation in light of the publication by the federal government of its Digital Charter on May 21, 2019 which suggested to the OPC that “transborder data flows may be dealt with in an eventual new federal privacy law.”
Children’s privacy is increasingly in the regulatory spotlight, and a new consultation paper from the UK suggests that even organizations which do not specifically target children may have regulatory obligations. Canada doesn’t currently specifically regulate children’s privacy, but in light of the Office of the Privacy Commissioner of Canada’s (“OPC”) recent Guidelines for Obtaining Meaningful Consent (“Meaningful Consent Guidelines”), the OPC may take a similarly broad approach to the interpretation and application of privacy laws.
UK Information Commissioner’s Approach
On May 31, 2019, the UK’s Information Commissioner’s Office (“ICO”) wrapped up a month and a half long public consultation on its draft Age appropriate design code of practice (“Code of Practice”).
On May 12, 2019, the Alberta Court of Appeal released a decision from a summary dismissal application that should resolve any confusion that may have arisen at the crossroads of that province’s limitations act and its privacy legislation, the Personal Information Protection Act, SA 2003, c P-6.5 (“PIPA”).
In Alberta, in order to have a cause of action related to a privacy breach claim, claimants must first go before the Office of the Information and Privacy Commissioner of Alberta (“AB OIPC”) and obtain a final order against an organization. Only then does a claimant have a cause of action against the organization for damages for loss or injury that the individual has suffered as a result of the breach by the organization.
On May 22, 2019, the Office of the Privacy Commissioner of Canada (“OPC”) held its annual forum in Toronto, Ontario. Federal Commissioner Daniel Therrien headed the annual forum along with his provincial counterparts Jill Clayton, the Information and Privacy Commissioner of Alberta, and Michael McEvoy, the Information and Privacy Commissioner of British Columbia.
The forum provides the OPC with an opportunity to update practitioners and stakeholders on current and upcoming privacy matters as well provides an opportunity to discuss and share perspectives. Not surprisingly, the topic of transborder data flows dominated the discussion. Here are three key takeaways from the forum.
The federal government announced a new “digital charter” today, emphasizing Canadians’ control over their own personal information and hinting at a “strong enforcement” regime aimed at global internet companies that violate privacy laws.
The digital charter does not have the power of law, but is rather “set of principles that all government policy and legislation will be measured against.” There is no time left in the current federal government’s mandate to reform existing privacy laws and the charter is a halfway measure, signalling to Canadians, and to social media and internet companies especially, that change is coming and what that change might look like.