(3) An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

• Is the measure demonstrably necessary to meet a specific need?
• Is it likely to be effective in meeting that need?
• Is the loss of privacy proportional to the benefit gained?
• Is there a less privacy-invasive way of achieving the same end?

[108] Weber, and the City of Regina, cases, supra, teach if the essential character of the dispute between the parties arises either explicitly or implicitly from the interpretation, application, administration or violation of a collective agreement, the dispute, if the legislature expressed itself to that effect, is within the sole jurisdiction of an arbitrator.

[109] To determine the essential characteristic of the dispute, the decision-maker examines the nature of the dispute in the factual context in which it arose and the ambit of the collective agreement.

[110] I have no hesitation in finding the essential characteristic of the dispute between the application and CP is a complaint made by the applicant against CP alleging CP's violation of PIPEDA through its collection of personal information via surveillance cameras for which it did not have the applicant's consent.

[111] Clearly, the factual matrix behind the applicant's complaint to the Privacy Commissioner is the collection of personal information. The applicant specifically engaged PIPEDA in his complaint.

[112] It is true André Corriveau filed a grievance under the collective agreement and invoked articles 28 (which deal with grievances) and 43 (which deals with human rights) of the collective agreement as did Guy Lemire in step 2 of the grievance. They also invoked a violation of PIPEDA.

[113] CP denied the grievance on March 21, 2002, stating at applicant's record, page 40:

[114] I examined the scope of article 43 of the collective agreement. Under article 43, CP and the union agree there shall be no discrimination, interference, restriction or coercion permitted in the workplace with respect to race, national or ethnic origin, colour, religion, age, sex, marital status, family status, sexual orientation, disability or conviction for which a pardon has been granted. The next subsection states CP and CAW recognize that harassment or sexual harassment is unacceptable behaviour and will not be tolerated in the workplace. I see nothing in article 43 which deals with personal information and how it may be collected in the workplace. This was conceded by counsel for CP at the hearing.

[115] As a result, I find the dispute between CP and the applicant does not arise from the collective agreement and if an arbitrator had been appointed, that arbitrator would not have any jurisdiction.

[116] There is another point to be made. By enacting paragraph 13(2)(a) of PIPEDA Parliament intended to give the Privacy Commissioner the discretion to investigate a complaint or defer it if he considered it appropriate a complainant should exhaust a grievance.

[117] In my view, a respondent to a complaint must at the earliest opportunity raise this issue with the Privacy Commissioner if that respondent thinks another review procedure is available. A respondent is not entitled to raise alternative review after the Privacy Commissioner has issued his report. It is by then, too late to argue the matter of jurisdiction on the basis of the exclusive arbitration model.

[118] A proceeding under section 14 of PIPEDA is not a review of the Privacy Commissioner's report or his recommendation. It is a fresh application to this Court by a person who had made a complaint to the Privacy Commissioner under PIPEDA and who, in order to obtain a remedy under section 16, bears the burden of demonstrating CP violated its PIPEDA obligations.

[119] In Englander, supra, Justice Blais stated at paragraph 29 and 30:

[120] I agree with Justice Blais. I also note the de novo nature of a review proceeding under the Access to Information Act and the Privacy Act is well recognized. See Dagg v. Canada (Minister of Finance), [1997] 2 S.C.R. 403, where LaForest J., dissenting, but not on this point, spoke about a de novo review.

[121] A question arose at this hearing whether the Privacy Commissioner's report was entitled to some deference. In Englander, supra, Justice Blais wrote the following at paragraph 33:

[122] I accord the Privacy Commissioner some deference in the area of his expertise which would include appropriate recognition to the factors he took into account in balancing the privacy interests of the applicant and CP's legitimate interest in protecting its employees and property.

[123] However, I do not accord any deference on the Commissioner's findings of fact because I am satisfied the evidence before me is considerably different than that gathered by the Privacy Commissioner's investigation.

4.3 Principle 3 -- Consent

The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

[186] As counsel for the applicant and counsel for the Privacy Commissioner argue, subsection 7(1) of the Act whose marginal note is "Collection without knowledge of consent" prescribes only four circumstances where that collection may take place without knowledge and consent. In other words, subsection 7(1) of the Act has given content to the words "except where inappropriate" found in section 4.3 of the Schedule. This is clear from the opening words of the subsection "[F]or the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause".

[188] There is no CP official looking at the monitor at the time the cameras are capturing a person's image. Rather, that person's image is recorded on videotape. The recording is never viewed unless there is a triggering event. The recording is wiped out after 96 hours with the result that person's image is never seen if there is no event.

[189] In this context, I accept CP's argument collection of the person's information takes place when CP officials view the recording to investigate an incident. Assuming the recording captured an individual committing an act of theft asking for his/her permission to collect the information would compromise the availability of the information for the purpose of investigation.

[190] This interpretation does not strain the purposes of the exemption in paragraph 7(1)(b). Clearly, the exemption would apply if a CP official had monitored and recorded live a person attempting to commit a crime. The same result should apply if monitoring is delayed as is the case here.

[174] Applying the appropriate factors to all the evidence before me, I conclude a reasonable person would consider CP's purposes for collecting by recording the images of CP employees and others on video camera appropriate in the circumstances.

[175] I focus first on the cameras themselves and what personal information they collect and how the recordings are viewed. I find the system CP devised and implemented has several appropriate fences.

[176] The collection of personal information is not surreptitious - warning signs are displayed. The collection of personal information is not continuous - it is brief, capturing only a person's image when that person is within the footprint of the camera. The collection is not limited to CP employees - it captures the images of contractors, visitors, suppliers and trespassers. The collection is not to measure a CP employee's work performance and while it is true a camera may occasionally capture a CP employee at work outside the shops, CP could not use those images to measure that employee's productivity because such a use of the information would be a use for a purpose other than that which prompted its collection as a security measure. More importantly, the recorded images are kept under lock and key and the recordings are only accessed by responsible managers and CP police if there is an incident reported. If there are no incidents recorded which require investigations, the recordings are destroyed within an appropriate time frame.

[177] The evidence satisfies me CP has established a legitimate need to have the cameras installed where they were and to record those persons who would pass its fixed footprints. While the cross-examination of CP deponents established, in some cases, a lack of correlation between camera location and incidents and, in other cases, between cause of loss, I am satisfied, on the whole of the evidence, CP identified numerous past incidents which justify the need to have surveillance cameras in place.

[178] The applicant's emphasis on past events was misplaced in my view. The utility of these cameras is in the future deterring theft, vandalism; deterring trespassers and enhancing the security of its employees and others and the security of its goods which includes hazardous and toxic materials either on location or being transported. These cameras are also useful as a tool for investigation.

[179] Again, while the cross-examination of CP deponents showed, in some cases, the video cameras might not have caught one of the incidents mentioned in their affidavits, the evidence, as a whole, establishes on a balance of probabilities, the cameras are effective in meeting CP's needs. The evidence establishes, and the Privacy Commissioner so found, there had been no recorded incidents since they were put into place, a performance similar to that which CP had experienced itself in other locations such as Golden, B.C. As an aside, the Privacy Commissioner speculated in his report deterrence might be attributed to the warning signs but failed to appreciate warning signs and cameras go hand-in-hand - you cannot have one without the other.

[180] I find the loss of privacy was minimal. Indeed, if there were no recorded incidents, it means none of the images captured by the cameras were viewed. The Privacy Commissioner was of the view a person whose images might be recorded had a low expectation of privacy because the cameras were located to capture personal information in locations which were public places. I share his assessment. Generally, such a view accords with the thrust of the cases decided by the Supreme Court of Canada in section 8 Charter cases where an analysis of a reasonable expectation of privacy is weighed.

[181] On this point, it must be remembered the recordings are never viewed unless an incident requiring an investigation occurs. This factor, coupled with my findings of how and what the cameras capture, lead me to conclude the loss of privacy is proportional to the benefit gained from their collection.

[182] On the last factor, I am satisfied CP looked at alternatives and weighed them in the context of its operations at the Toronto Yard which, needless to say, are very extensive and are carried out over a very wide area. CP concluded, as I do, those alternatives such as fencing and the use of security guards, was not cost effective or would be disruptive of its operations. This factor, weighed with my finding about the low loss of privacy, satisfies me the last branch of the test put forward by the Privacy Commissioner is met.