Organizations should take note of a recent decision of the Alberta Office of the Information and Privacy Commissioner (the OIPC) in which an Adjudicator found Talisman Energy Inc. (Talisman) properly withheld personal information of a former employee (the Employee) under the Alberta Personal Information Protection Act (PIPA) on the basis of privilege.
Background
After his termination by Talisman, the Employee submitted three information access requests to Talisman to have his records produced, including all of his emails (including deleted emails), payroll information, electronic records, and personal information given to third parties, including insurance companies. Talisman withheld large amounts of information on the basis of legal privilege, information collected for an investigation or legal proceeding and third-party privacy. Moreover, Talisman refused to search deleted emails and records.
In Order P2012-04 Talisman Energy, the OIPC Adjudicator found that Talisman properly applied the privacy exceptions to access which are available to organizations under PIPA. The Employee was given two binders of personnel and payroll records after his initial request for his personal information but all other information was withheld. The Adjudicator respected Talisman's decision to withhold hundreds of pages of information on the basis of legal privilege. Talisman was also permitted to withhold records with third-party information because of the difficulty in severing the applicant's information from the records. Finally, the Adjudicator agreed that producing deleted records and emails was above and beyond the requirement for organizations to take reasonable steps to provide information under PIPA.
Claiming Privilege Before The OIPC
The OIPC has issued the Solicitor-Client Privilege Adjudication Protocol to guide organizations who wish to claim legal privilege in information privacy disputes. In 2008, the Supreme Court of Canada in Canada (Privacy Commissioner) v. Blood Tribe Department of Health held that the Privacy Commissioner of Canada does not have the authority to compel records from an organization claiming privilege. However, the Alberta Information and Privacy Commissioner has taken the position that PIPA does give the OIPC this authority based on fundamental differences between the federal and provincial privacy legislation, in particular because the Alberta privacy legislation and procedure gives the OIPC order-making power similar to that of a court, and enforceable as an order of the Court of Queen's Bench upon being filed with the Court. Moreover, PIPA section 38(3) states an organization must produce any document the Commissioner compels "[n]otwithstanding any other enactment or any privilege of the law of evidence...".
To defend claims of solicitor-client privilege, organizations are strongly encouraged by the OIPC to submit a sworn affidavit from legal counsel affirming the privilege for each record and providing justification that the withheld information meets the three criteria for the privilege established in 1980 in Solosky v. The Queen: a) the document must be a communication between a solicitor and client; b) which entails the seeking or giving of legal advice; and c) which is intended to be confidential by the parties (see the Practice Notes and Advisories on the OPIC website for additional information).
Talisman withheld the majority of information on the basis of the legal privilege exceptions to personal information access under the PIPA. Section 24(2) of the PIPA states that an organization may refuse access to personal information if the information is (a) protected by legal privilege; and/or (b) the information is collected for an investigation or legal proceeding. Talisman withheld close to 200 pages of information under this section, including in-house counsel's written file notes and email communications with human resources and payroll employees. Talisman also invoked the OIPC Solicitor-Client Protocol to withhold the information from the Adjudicator herself, submitting an affidavit and making arguments regarding legal privilege and not producing the documents in dispute to the OIPC. The Adjudicator agreed with Talisman's justification for claiming privilege.
While the OIPC has upheld legal privilege in the vast majority of cases on the issue, there has been some variance as to how the validity of a privilege claim will be determined. For example, in Order P2011-D-003 Davidson and Williams LLP, documents withheld under legal privilege by a law firm were ordered to be provided to the OIPC to ensure their claims for legal privilege were valid. The Commissioner found that section 38 of PIPA gives the Information and Privacy Commissioner the right to compel the production of documents "[n]otwithstanding any other enactment or any privilege of the law of evidence" including legal privilege, with the OIPC bound in turn to keep the information confidential. By contrast, in the present case, the Adjudicator did not press to review the documents over which privilege was claimed and did not require Talisman to delineate between information subject to solicitor-client privilege and litigation privilege.
Limiting Third-Party Information
PIPA states in section 24(3)(b) that an organization shall not provide access to personal information if it would reveal personal information about another individual. The Employee requested access to records of opinions written about him in reference to his termination of employment (before and after termination). The Adjudicator affirmed previous decisions of the OIPC that third-party opinions about an Employee, while personal information of the Employee, are also personal information of that third party. These opinions are required to be withheld under the PIPA (subject to certain exceptions for professional opinions from physicians or psychologists).
For information involving third parties other than opinions, section 24(4) of the PIPA requires organizations to sever an applicant's personal information from records when reasonable to do so. In the present case, the Adjudicator agreed with Talisman's position that severing was unreasonable as the remaining information might reasonably still identify the third party. Accordingly, the Adjudicator found that it was reasonable to withhold the document altogether.
Reasonable Response to Requests
Talisman refused to produce the deleted emails and records because it argued this would be too costly and time-consuming. The deleted items would need to be retrieved from backup tapes stored off-site, and information technology professionals would spend months locating all relevant records. While section 27(1) of PIPA requires an organization to make every reasonable effort to respond to requests for information, the Adjudicator agreed that the task of retrieving the deleted items was unreasonable given the effort, time and cost required to obtain them.
Key Takeways
The OIPC has upheld solicitor-client and litigation privilege in the vast majority of cases when organizations have made an effort to explain their reasons for claiming the privilege. The Supreme Court of Canada has held that if any legislation does permit the production of privileged information, such production should occur only when absolutely necessary. Nevertheless, an organization does run the risk of being ordered to produce privileged information if it does not provide adequate justification leading the OIPC to suspect the privilege is not being claimed in good faith.
This decision addresses both the duty of organizations to provide personal information and the right to withhold it. PIPA requires that organizations make every reasonable effort to produce information requested by applicants. While Talisman was not required to produce deleted records because they were off-site and costly to access, a previous order, F2009-023 University of Alberta, although overturned on judicial review on other grounds, intriguingly specified that simply because retrieval of deleted records is "burdensome", this will not in itself relieve an organization of its duty to respond to applicant requests. The OIPC will determine what it considers reasonable on a case-by-case basis.
The Talisman decision demonstrates that one of the goals of the OIPC is to strike a balance between individual privacy and an organization's right to possession, use and disclosure of information, considering these issues in a manner that weighs these competing factors and responds to the given circumstances.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
