Privacy In Cross-Border Litigation

Published in the November 2007 issue of the Lexpert Guide to the Leading U.S./Canada Cross-border Litigation Lawyers in Canada

Privacy Compliance in the Context of Canadian Litigation:

Reaching a Reasonable Accommodation

Since 2004, Canadian businesses have been subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), federal legislation that regulates the collection, use and disclosure of personal information in the context of commercial activity. This statute applies across Canada, except in three provinces (British Columbia, Alberta and Quebec) where provincial legislation deemed to be "substantially similar" to the federal Act displaces PIPEDA. For the rest of the country, however, including Ontario (which is home to Toronto, Canada's largest commercial and financial center), PIPEDA is the source of privacy-related obligations for the private sector. 1

This relatively new privacy regime has important implications for the practice of litigation in Canada. Given the volume of cross-border litigation between Canada and the United States, it will be helpful for U.S. counsel to be aware of the privacy rights and obligations in Canada. Litigation counsel need to be familiar with both their clients' and their own obligations under privacy legislation before, during and after litigation. For counsel practicing in jurisdictions that are not subject to a similar general privacy regime, the Ontario experience can help illustrate the potential impact on litigation of the adoption of broadly applicable privacy legislation.

Overview of PIPEDA

Under PIPEDA, "personal information" is broadly defined and includes any information about an identifiable individual. Before organizations may collect, use or disclose someone's personal information, they must obtain the consent of that individual. PIPEDA sets out various other obligations, including a general obligation to limit collection, use and disclosure of personal information.

Canada's consent-based privacy regime, with its emphasis on limiting collection, use and disclosure of personal information is at first glance incompatible with the litigation process, in which broad collection, use and disclosure of personal information, including personal information, is often required. Further more, it is questionable whether the adversarial nature of litigation is compatible with a consent-based privacy regime. To add to this tension, in many jurisdictions, including Ontario, the trend has been toward increased disclosure of information through the discovery processa trend that is distinctly at odds with the obligation under PIPEDA to minimize collection, use and disclosure. How then can privacy rights and obligations be reconciled with a party's rights and obligations in the context of litigation?

PIPEDA provides no general exception to the consent requirement in the context of litigation. Instead, it offers a series of discrete and sometimes awkward exceptions that apply separately to the collection, use and disclosure of personal information. We outline a few of the exceptions most relevant to the litigation process and offer some additional means of ensuring that litigation-related use of personal information does not contravene the Act.

Breach of an Agreement or Contravention of a Law

PIPEDA is unhelpfully silent regarding whether personal information may be collected, used or disclosed during the course of an initial investigation, when litigation may be contemplated but not yet initiated. The Act does, however, allow an organization to collect personal information without consent in two contexts: to investigate a breach of an agreement or a contravention of a federal or provincial law. This exception is available only if the collection of the information with the knowledge or consent of the individual concerned could reasonably be expected to compromise the availability or accuracy of the information sought.

The reference to "breach of an agreement" makes this a broad exception. It potentially covers a wide range of preliminary investigations in the commercial context where an agreement may have been breached. In addition, the reference to "laws of Canada or a province" has been interpreted to include not only federal and provincial laws, but also the common law, thereby further broadening the scope of the exception. 2

Having collected personal information under this exception, an organization can then disclose it to a named investigative body (which could be a professional governing body) or to a government institution, as long as the organization reasonably believes that the information relates to a breach of an agreement or a contravention of a law. The investigative body is then permitted by a separate exception to disclose the information as required in the course of its investigations.

Although the exceptions partially overlap, they do not relate seamlessly. Organizations engaged in investigative activity arguably face an unrealistic burden to match collection, use and disclosure of personal information to a particular exception at each step of an investigation.

Collection of a Debt Owed to the Organization

PIPEDA also allows for disclosure of personal information without an individual's knowledge or consent if the organization seeks to recover a...