linked to the seller and can lead to inferences about their negotiation skills, or the
urgency of the sale.
18 The Supreme Court of Canada has ruled that an internet IP
address can constitute personal information, as it is capable of revealing a person’s
internet-based activities.
19
The protection available to personal information varies depending upon its level
of sensitivity. For example, whether consent must be express or can be implied may
depend upon the sensitivity of the information at issue.
20 Sensitive information is
generally considered to include things such as financial information or health
information. However, the Supreme Court of Canada has cautioned that the assessment of sensitivity of information must be contextual.
21 For example, while financial
information is generally sensitive, some kinds of financial information may be less
so depending on the circumstances.
22 Thus, for example, while a person’s income
may be financial information and therefore sensitive in nature, in a jurisdiction where
the law requires the publication of the salaries of identified public servants, such a
person’s salary will be considerably less sensitive information.
In addition to sensitivity, new federal guidelines on obtaining meaningful consent
to the collection, use and disclosure of personal information under PIPEDA, direct
organizations to consider the risk of harm that may flow from the proposed use of
personal information. The guidelines indicate that: “Harm should be understood
broadly, including material and reputational impacts, restrictions on autonomy, and
other factors”.
23 The higher the risk of harm, the more necessary is explicit consent.
1.3 Oversight
Oversight of the protection of personal data in Canada tends to follow the jurisdictional lines that define the statutory regimes. The federal Privacy Commissioner has
oversight over data protection under both the federal Privacy Act and PIPEDA. Each
province has an Information and Privacy Commissioner who oversees public sector
access to information, protection of privacy, and personal health information
18 PIPEDA Case Summary #2009-002, https://www.priv.gc.ca/en/opc-actions-and-decisions/inves
tigations/investigations-into-businesses/2009/pipeda-2009-002/.
19 R. v. Spencer, [2014] 2 SCR 212, 2014 SCC 43.
20 See, e.g. PIPEDA, Schedule I, Clause 4.3.6. New guidelines on consent note that sensitivity can
vary depending on the circumstances. See: Privacy Commissioner of Canada (2018c) Guidelines
for obtaining meaningful consent.
21 Royal Bank of Canada v. Trang, [2016] 2 SCR 412, 2016 SCC 50, at para 36. See also PIPEDA,
clause 4.3.4.
22 See Trang, Ibid., at para 46; Toronto Real Estate Board v. Commissioner of Competition, 2017
FCA 236, at para 174.
23 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, “Risk of
Harm”.
58
T. Scassa
urgency of the sale.
18 The Supreme Court of Canada has ruled that an internet IP
address can constitute personal information, as it is capable of revealing a person’s
internet-based activities.
19
The protection available to personal information varies depending upon its level
of sensitivity. For example, whether consent must be express or can be implied may
depend upon the sensitivity of the information at issue.
20 Sensitive information is
generally considered to include things such as financial information or health
information. However, the Supreme Court of Canada has cautioned that the assessment of sensitivity of information must be contextual.
21 For example, while financial
information is generally sensitive, some kinds of financial information may be less
so depending on the circumstances.
22 Thus, for example, while a person’s income
may be financial information and therefore sensitive in nature, in a jurisdiction where
the law requires the publication of the salaries of identified public servants, such a
person’s salary will be considerably less sensitive information.
In addition to sensitivity, new federal guidelines on obtaining meaningful consent
to the collection, use and disclosure of personal information under PIPEDA, direct
organizations to consider the risk of harm that may flow from the proposed use of
personal information. The guidelines indicate that: “Harm should be understood
broadly, including material and reputational impacts, restrictions on autonomy, and
other factors”.
23 The higher the risk of harm, the more necessary is explicit consent.
1.3 Oversight
Oversight of the protection of personal data in Canada tends to follow the jurisdictional lines that define the statutory regimes. The federal Privacy Commissioner has
oversight over data protection under both the federal Privacy Act and PIPEDA. Each
province has an Information and Privacy Commissioner who oversees public sector
access to information, protection of privacy, and personal health information
18 PIPEDA Case Summary #2009-002, https://www.priv.gc.ca/en/opc-actions-and-decisions/inves
tigations/investigations-into-businesses/2009/pipeda-2009-002/.
19 R. v. Spencer, [2014] 2 SCR 212, 2014 SCC 43.
20 See, e.g. PIPEDA, Schedule I, Clause 4.3.6. New guidelines on consent note that sensitivity can
vary depending on the circumstances. See: Privacy Commissioner of Canada (2018c) Guidelines
for obtaining meaningful consent.
21 Royal Bank of Canada v. Trang, [2016] 2 SCR 412, 2016 SCC 50, at para 36. See also PIPEDA,
clause 4.3.4.
22 See Trang, Ibid., at para 46; Toronto Real Estate Board v. Commissioner of Competition, 2017
FCA 236, at para 174.
23 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, “Risk of
Harm”.
58
T. Scassa