Electronic Documents Act (PIPEDA)
4 addresses the protection of personal information in the hands of private sector organizations. This law applies to all personal
information collected, used or disclosed by the federally regulated private sector
(e.g., the telecommunications and airline industries) as well as all private sector
commercial activity that crosses provincial or national borders. It also applies to any
purely intra-provincial collection, use and disclosure of personal information that
takes place in a province that has not enacted legislation considered substantially
similar to PIPEDA.
5 To date, three provinces have enacted private sector data
protection laws that are considered substantially similar. These are Quebec,
6
Alberta,
7 and British Columbia.
8 As a result, personal data collected in the course
of commercial activity in each of those provinces is governed by separate provincial
legislation. The substantially similar laws of Alberta, BC and Quebec will also apply
in some circumstances to non-commercial activities of organizations within those
provinces.
PIPEDA is applicable only to personal information that is collected, used and
disclosed in the course of commercial activity. The patchwork of data protection
laws in Canada can lead to somewhat uneven data protection from one province to
another. For example, PIPEDA does not apply to political parties in Canada,
although B.C.’s Personal Information Protection Act applies to political parties in
that province.
In addition to specific data protection laws, it is possible to sue for breach of
privacy. Such suits are governed by the private law of each province. The Civil Code
of Quebec provides recourse for breach of privacy rights in that province.
9 In British
Columbia, Manitoba, Saskatchewan and Newfoundland specific statutes provide a
right of action for breach of privacy.
10 Courts in other provinces have recognized a
tort of ‘intrusion upon seclusion’.
11 Privacy class action law suits for large scale data
breaches have also become more common. These may rely upon causes of action for
Health Information Privacy and Access Act, SNB 2009, c P-7.05; Personal Health Information Act,
SNS 2010, c 41; Health Information Act, RSPEI 1988, c H-1.41; Health Information Privacy And
Management Act, SY 2013, c 16; Health Information Act, SNWT 2014; Public Health Act, SNu
2016, c 13.
4 S.C. 2001, c. 5 [PIPEDA].
5 PIPEDA, s. 26(2)(b).
6 Act respecting the protection of personal information in the private sector, CQLR c P-39.1.
7 Personal Information Protection Act, SA 2003, c P-6.5.
8 Personal Information Protection Act, SBC 2003, c 63.
9 Civil Code of Québec, CQLR c CCQ-1991, ss. 3, 35–41.
10 Privacy Act, RSBC 1996, c 373; The Privacy Act, RSM 1987, c P125; The Privacy Act, RSS
1978, c P-24; Privacy Act, RSN 1990, c P-22.
11 See, e.g. Jones v. Tsige, 2012 ONCA 32; Trout Point Lodge Ltd. v. Handshoe, 2012 NSSC 245.
The threshold for the statutory or common law torts is relatively high. For example, the tort of
intrusion upon seclusion requires not only an unjustified intrusion upon someone’s seclusion but
that it also be of a kind that would be “highly offensive to the reasonable person” (Jones, at para 70).
56
T. Scassa
4 addresses the protection of personal information in the hands of private sector organizations. This law applies to all personal
information collected, used or disclosed by the federally regulated private sector
(e.g., the telecommunications and airline industries) as well as all private sector
commercial activity that crosses provincial or national borders. It also applies to any
purely intra-provincial collection, use and disclosure of personal information that
takes place in a province that has not enacted legislation considered substantially
similar to PIPEDA.
5 To date, three provinces have enacted private sector data
protection laws that are considered substantially similar. These are Quebec,
6
Alberta,
7 and British Columbia.
8 As a result, personal data collected in the course
of commercial activity in each of those provinces is governed by separate provincial
legislation. The substantially similar laws of Alberta, BC and Quebec will also apply
in some circumstances to non-commercial activities of organizations within those
provinces.
PIPEDA is applicable only to personal information that is collected, used and
disclosed in the course of commercial activity. The patchwork of data protection
laws in Canada can lead to somewhat uneven data protection from one province to
another. For example, PIPEDA does not apply to political parties in Canada,
although B.C.’s Personal Information Protection Act applies to political parties in
that province.
In addition to specific data protection laws, it is possible to sue for breach of
privacy. Such suits are governed by the private law of each province. The Civil Code
of Quebec provides recourse for breach of privacy rights in that province.
9 In British
Columbia, Manitoba, Saskatchewan and Newfoundland specific statutes provide a
right of action for breach of privacy.
10 Courts in other provinces have recognized a
tort of ‘intrusion upon seclusion’.
11 Privacy class action law suits for large scale data
breaches have also become more common. These may rely upon causes of action for
Health Information Privacy and Access Act, SNB 2009, c P-7.05; Personal Health Information Act,
SNS 2010, c 41; Health Information Act, RSPEI 1988, c H-1.41; Health Information Privacy And
Management Act, SY 2013, c 16; Health Information Act, SNWT 2014; Public Health Act, SNu
2016, c 13.
4 S.C. 2001, c. 5 [PIPEDA].
5 PIPEDA, s. 26(2)(b).
6 Act respecting the protection of personal information in the private sector, CQLR c P-39.1.
7 Personal Information Protection Act, SA 2003, c P-6.5.
8 Personal Information Protection Act, SBC 2003, c 63.
9 Civil Code of Québec, CQLR c CCQ-1991, ss. 3, 35–41.
10 Privacy Act, RSBC 1996, c 373; The Privacy Act, RSM 1987, c P125; The Privacy Act, RSS
1978, c P-24; Privacy Act, RSN 1990, c P-22.
11 See, e.g. Jones v. Tsige, 2012 ONCA 32; Trout Point Lodge Ltd. v. Handshoe, 2012 NSSC 245.
The threshold for the statutory or common law torts is relatively high. For example, the tort of
intrusion upon seclusion requires not only an unjustified intrusion upon someone’s seclusion but
that it also be of a kind that would be “highly offensive to the reasonable person” (Jones, at para 70).
56
T. Scassa