Since Canada's Federal privacy legislation was first introduced in 2000, a significant constitutional issue about its scope has been lingering in the background. The Personal Information and Protection of Documents Act (PIPEDA) purports to apply not only to federal businesses, but also to businesses that would normally fall within provincial – not federal – constitutional jurisdiction. Restricting PIPEDA to federal businesses would dramatically limit its scope. Many businesses chose not to challenge the point. This changed with State Farm Mutual v. Privacy Commissioner (Canada).

State Farm challenged the constitutionality of PIPEDA, but the Federal Court concluded that it did not need to decide the issue. In another significant ruling, which disposed of the case, the Court found that an insurance company investigation done in defence of a lawsuit against an insured was not "commercial activity", a threshold for the application of PIPEDA. Thus, PIPEDA did not apply in any event.

The State Farm Case

State Farm arose from a car accident in New Brunswick. State Farm insured the person who was allegedly responsible. In anticipation of a lawsuit, State Farm hired counsel for the insured and hired private investigators to do video surveillance of the person who was expected to sue. Before suing, the plaintiff asked State Farm, pursuant to PIPEDA, for all personal information it had about him, including any surveillance. State Farm refused on the ground that PIPEDA did not apply to it.

The plaintiff complained to the Privacy Commissioner. Ultimately, State Farm applied to the Federal Court for a ruling that PIPEDA did not apply. State Farm said that the defence of civil litigation was not a "commercial activity," a prerequisite to the application of PIPEDA, and that its application to State Farm was unconstitutional, since it is provincially regulated. The Attorney General for Canada intervened to defend the constitutional issue.

Not "Commercial Activity"

PIPEDA provides that its privacy regime applies to organizations that collect, use or disclose personal information in the course of "commercial activities." The Privacy Commissioner took the position that State Farm's activities were commercial in nature, given that State Farm had surveillance done because of its insurance contract with the defendant, which was part of State Farm's commercial business. State Farm disagreed, saying that the defence of civil litigation, including the activities of a defendant's agents, including State Farm and the private investigators, is not commercial activity.

The Federal Court agreed with State Farm. The Court held that since the primary activity was the defence to a civil tort claim, it was not a commercial activity contemplated by PIPEDA. The primary activity was the dominant factor, not the incidental relationship between insured and insurer, or attorney and client. The Court observed that this approach is consistent with how other privacy regimes deal with evidence collected for civil litigation.

Notably, the Court also observed that this ruling did not necessarily mean the Privacy Commissioner had no authority to investigate to test the bona fides of the exemption. However, since the requested information was the subject of a claim of privilege, the Privacy Commissioner's investigative authority was very limited. The Privacy Commissioner had not taken the steps required to challenge privilege claims made in an investigation.

The Constitutional Issue

Given its ruling on commercial activity, the Court concluded that it was unnecessary to decide the constitutional issue. However, the decision does summarize the position of the Attorney General, founded on the federal Trade and Commerce power. Among other things, the Attorney General submitted that national regulation was necessary because the effectiveness of any provincial law protecting an individual's information is undermined once personal information flows out of the province. In turn, a national scheme was viewed as necessary to ensure the integrity and effectiveness of the protection of personal information.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.