Due to our constitutional division of powers, the Personal Information Protection and Electronic Documents Act is limited to regulating the collection, use and disclosure of personal information to matters that fall under the rubric of being commercial activities. It’s something that likely won’t change in any PIPEDA reform because it’s a trade and commerce law, so it’s an important concept to understand and know well in Canada.
First, it has led to some interesting cases from the Office of the Privacy Commissioner, and even the courts have weighed in on the matter. Did you know the OPC once decided a private school was not conducting commercial activities and, therefore, didn’t have to respond to an access request made pursuant to PIPEDA? In another case, the OPC said unions weren’t conducting commercial activities. This, notwithstanding the similar roles unions play as compared to employment lawyers; and we know for sure that lawyers are conducting commercial activities.
The second annoyance with the limitation is that it means PIPEDA doesn’t apply to non-federally regulated employment situations. This means it is up to each province to regulate privacy in the employment context. And, we know that only three provinces (Quebec, Alberta and British Columbia) have done so. That means there are tons of employees out there who don’t have a regime that regulates their employer’s processing of personal information. We know Ontario is considering the possibility of passing its own private sector law, and I think this is a very good reason for doing so.
The third (and last) thing I’ll mention about commercial activity is that it leaves many charities and not-for-profits constantly trying to figure out if the law applies to them. We know the taxable status of an organization is not determinative of whether it is conducting commercial activities, but surely not everything done by a charity would be considered as such — another reason the provinces should think more about getting into the privacy game.
Twenty years ago this fall, we published "The Law of Privacy in Canada," and I remember discussions with my co-authors about how the commercial activity limitation might play out. Speaking of my co-authors, one of the original ones was Barbara McIsaac. She and I worked together at a large law firm for a number of years, and we’ve stayed friends ever since. Barb announced to me this week that after 45 years of practicing law, she is going to retire at the end of the year. If not for this darn pandemic, we would certainly have gathered to celebrate her illustrious career. She was a pioneer and brilliant litigator and advisor. And, she gave me my start as a privacy professional — where I now rant about silly things like commercial activities.
Have a good weekend, everyone, and stay safe.