Canada's privacy law faces legal challenge: if Canadian courts rule PIPEDA unconstitutional and strike it down, the ramifications for Canadian and worldwide businesses will be profound.

Just two days before key phases of Canada's national privacy law, the Personal Information Protection and Electronic Documents Act PIPEDA), went into effect January 1, the Quebec Court of Appeal cleared the way for the province's attorney general to contest the constitutional validity of the law.

PIPEDA applies to businesses and provincial commercial activities, governing how businesses manage and protect customer information. The law is meant to protect the private information that consumers give to companies in the course of doing business. It imposes significant restrictions on the collection, use, and disclosure of personal information nationwide unless a province enacts its own "substantially similar" privacy legislation.

Similar provincial legislation has so far been introduced in British Columbia, Alberta, and Quebec, whose private-sector privacy law has been in place since 1993 and was recently deemed substantially similar to PIPEDA by the federal cabinet. Ontario, which failed to introduce its own private-sector privacy legislation in 2003, is under the jurisdiction of the federal law until an acceptable provincial equivalent is passed sometime this year.

Ann Cavoukian, Ontario's information and privacy commissioner, told the Toronto Star that Quebec's constitutional challenge is "unfortunate" because it came just days before the most important phase of the federal law went into effect. "If anything, this will create greater uncertainty and confusion," she said.

Why PIPEDA?

PIPEDA's path has been fraught with challenges and criticism, and not just in Quebec. The federal law--introduced in 2000 but until recently limited in application to federally regulated companies such as airlines, banks, and telecommunications providers--requires every Canadian business to appoint a privacy officer or contact person and implement systems to ensure customer information is secure, accurate, collected with appropriate consent, and not used beyond a specific stated purpose. Businesses that do not follow the law can be taken to court or publicly exposed.

PIPEDA proponent Michael Geist, the Canada research chair in Internet and e-commerce at the University of Ottawa and technology counsel for law firm Osler Hoskin & Harcourt LLP, says maintaining a federal privacy law is essential "because the provincial mish mash of laws that would fill the void would create uncertainty and costs for the business and privacy communities." Without PIPEDA, he says, provincial alternatives that may potentially conflict would magnify costs and create uncertainty for large and small businesses.

The Canadian business community has long supported a national privacy standard, in part because dealing with one federal privacy law is much preferred to the alternative: complying with dozens of provincial laws. At a Senate committee hearing on PIPEDA, the Canadian Chamber of Commerce stated that the business community views a coordinated national framework as essential. The Information Technology Association of Canada lauded the government for showing initiative in attempting to create a uniform law applying to all companies, regardless of their location. At the same hearing, the Canadian Association of Internet Providers emphasized "the importance of having uniform legislation, if not between Canada and the rest of the world, certainly within Canada ... Allowing each jurisdiction to tailor additional laws could create a patchwork of legislation that effectively would prevent electronic commerce from crossing provincial borders."

In addition, without PIPEDA, doing business with the world would be challenging for Canadian companies. The European Union allows its member countries to share personal customer information only with other nations that meet the EU's privacy standards. PIPEDA received the EU's seal of approval in 2002, meaning Canada meets those standards now, but a successful court challenge against the federal law could lead to a "data blockage" between Canada and the European Union that could stifle overseas e-commerce, experts contend. Geist says each individual province would be forced to obtain its own adequacy finding, resulting in a regulatory nightmare that could force foreign businesses to question whether the Canadian market was worth the additional compliance costs.

Why Not PIPEDA?

Quebec's position, outlined in a December 17 court order, is that PIPEDA "interferes with Quebec's constitutional competence in matters of civil rights" and that the federal government has exceeded its jurisdiction. According to Quebec, the federal government does not have the jurisdiction to declare whether a provincial privacy law dealing with the private sector is or is not valid or that federal law can overlap this provincial turf.

Experts say a constitutional challenge, which may come before the Quebec Court of Appeal at any time and make it to the Canadian Supreme Court later this year or in early 2005, would create uncertainty in a business community already struggling to understand and comply with rules designed to protect the privacy of customers and employees. Geist warns that the looming court case could convince companies to put their compliance efforts on hold in provinces that do not currently have their own legislation.

Geist further contends that, by establishing a national privacy minimum but enabling provinces to enact their own substantially similar legislation, PIPEDA establishes an appropriate compromise between the interests of the federal and provincial governments. Moreover, it creates regulatory efficiencies by allowing businesses to address privacy compliance through a single national standard.

Critics have called PIPEDA a "tax," a "multi-dimensional mess," "unhinged," "vague," "ungainly" and "constitutionally suspect." Further, the law's critics believe the costs of keeping PIPEDA are too high. They say the federal law does an inadequate job of protecting privacy, whereas provincial laws might offer legislation tailored to their situations that better protects citizens' privacy. Opponents also accuse PIPEDA of being inconsistent, vague, difficult to interpret, and expensive to comply with. Provincial alternatives, they say, may be much clearer and less costly.

"The only way to actually live with PIPEDA is to interpret it in ways that ignore its plain meaning--and that can hardly encourage greater respect for the law," wrote Richard C. Owens, executive director of the Centre for Innovation Law and Policy, in a Toronto Star editorial. "PIPEDA risks eroding respect for the law, it impedes business unnecessarily, and it threatens to cause constitutional disorder."

The Stakes Are High

Despite their disagreements, both sides agree that the ramifications of the constitutional challenge are enormous.

Experts believe the federal government will argue that the Canadian constitution grants it legislative authority to make laws related to trade and commerce. Geist says the trade and commerce power covers both inter-provincial and international trade as well as general trade and commerce regulation that affects the whole country. The federal government will argue that PIPEDA is general in nature with broad application, it is monitored by the federal privacy commissioner, the provinces could not enact an equally effective statutory framework, and the failure to include a single province could create a data haven that jeopardizes the protection of all personal information. Geist predicts that the decision of the Canadian courts will have a huge impact on the future of privacy in Canada.

PIPEDA proponents fear that if the law is declared unconstitutional it will be replaced with a patchwork of provincial laws. Even if these are clearer and less costly to comply with than PIPEDA, dealing with dozens of different privacy laws would be a nightmare for businesses in Canada and worldwide. Also, the collapse of PIPEDA would require creating new data transfer agreements with the European Union.

Critics believe their case for over turning PIPEDA is strong. The Quebec government, along with PIPEDA critics, say the federal privacy legislation is expensive. But it the alternatives--the absence of legislation or multiple provincial statutes--may be far costlier for business, consumers, and Canada's credibility in the global marketplace.

References

Geist, Michael. "Canada Badly Needs a National Standard." Toronto Star. 2 February 2004.

Privacy Commissioner of Canada. Available at http: //www.privcom.gc.ca/legislation/02_06_01_01_e.asp (accessed 6 February 2004).

Ontario Ministry of Agriculture & Food. Available at http: //www.gov.on.ca/OMAFRA/english/rural/facts/elecdoc.htm (accessed 6 February 2004).

Owens, Richard. "Federal Privacy Law Is a Dog's Breakfast." Toronto Star. 2 February 2004.

PIPEDA's 10 Privacy Principles

1. Accountability--An organization is responsible for the personal information under its control and must designate an individual who is responsible for the organization's compliance.

2. Identify Purposes--The purposes for which the information is collected should be identified on or at the time of collection of the information.

3. Consent--The knowledge and consent express or implied--of the individual is required for collection, use, or disclosure of personal information in a commercial activity.

4. Limiting Collection--Information is to be collected for specific purposes and can only be used for those purposes.

5. Limiting Use, Disclosure, and Retention of Personal Information--Personal information can only be used, disclosed, and retained for the purposes for which it was collected and must not be retained longer than needed.

6. Accuracy--Personal information must be accurate, complete, and current.

7. Safeguards--The organization must protect personal information against loss or theft as well as unauthorized access, disclosure, copying, use, or modification.

8. Openness--The organization's privacy policies must be made readily available to anyone.

9. Individual Access--Individuals have the right to know what personal information about them has been collected, how it is being used, and to whom it has been disclosed, as well as to challenge its accuracy and completeness, and have it corrected.

10. Challenging Compliance--Individuals should be able to address any challenges concerning compliance to the individual accountable for the organization's compliance.

Nikki Swartz is Associate Editor of The Information Management Journal. She may be contacted at [e-mail].