Late last week, the Supreme Court of Canada (SCC) passed on a chance to shed some light on what it considers to be "reasonable" collection of personal information. It dismissed the Alberta Information and Privacy Commission's appeal of an Alberta Court of Appeal decision that found "reasonable" collection of personal information to not necessary mean an organization must employ the "best" or the "least intrusive" methods.

As we noted in an earlier post, the Alberta Court of Appeal overturned the Commissioner's ruling and stated that Leon's Furniture Limited was justified in collecting driver's licence and licence plate information from customers picking up furniture. Leon's argued that the observance of such policy was for fraud prevention and deterrence purposes only and that it assisted police in any ensuing fraud investigations. The Commissioner claimed that Leon's policy was a violation of Alberta's Personal Information Protection Act (PIPA or Act), as collection of the disputed information was not "reasonable" under section 11 of the Act and it constituted a "condition of supplying a product or service" under section 7(2) of the Act. Both claims were rejected.

In deciding in favour of Leon's, the Alberta Court of Appeal made a few notable findings:

  1. The court recognized that the privacy statute identifies two competing values, the right to protect information and the need to use it – one does not trump the other and a balancing is called for.
  2. The "reasonableness" standard imposed under Section 11 of PIPA only requires organizations to collect personal information to the extent it is reasonable for meeting the purposes for which the information is collected, and "[i]t is not open to the [Commissioner] to change 'reasonableness' to either 'necessity', 'minimal intrusive', or 'best practices'. These are not interpretations that are available given the plain wording of the statue."
  3. The "reasonableness" standard does not require business to defer, in all instances, its interest to that of an individual's privacy interest. "[The Commissioner] is not empowered to direct an organization to change the way it does business, just because the [Commissioner] thinks he has identified a better way. So long as the business is being conducted reasonably, it does not matter that there might also be other reasonable ways of conducting the business".

The Court of Appeal's decision is an important win for private sector businesses, and needless to say, the Alberta Privacy Commissioner Frank Work was dismayed with the SSC's dismissal of its appeal. In his news release, the Commissioner expressed his concern that the decision "could be used to challenge what were thought to be reasonable, nationally accepted limits on the collection of personal information by private sector organizations. We are moving backwards."

Overall, the Court of Appeal's interpretation of the privacy act is an important one for business in Alberta and B.C., which has privacy legislation similar to PIPA. Although the privacy legislations governing personal information differ across the provinces, territories and federally, the message from Alberta may translate into other jurisdictions to limit the Commissioner's discretion. Whether this judgment alters the decisions of privacy commissioners in future dealings with businesses remains to be seen.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.