Michael Geist, of the University of Ottawa and member of the federal SPAM Task Force, has instigated the first finding of the Office of the Privacy Commissioner related to spam. Not only is it the first decision of its kind, it also concludes that business e-mail addresses are not included in the so-called "business card exception" to the definition of "personal information" and that the harvesting of e-mail addresses from an organization's website does not allow the use of the consent exception that applies to "publicly available information".

The "business card exception" relies on the definition of "personal information" under s. 2 of PIPEDA:

"personal information" means information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization."

The Assistant Privacy Commissioner, in the written finding to Professor Geist, concludes that because business e-mail addresses are not listed in the definition, they are not excluded from the definition.

The "publicly available information" exception is contained in s. 7 of PIPEDA:

Collection without knowledge or consent
7. (1) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may collect personal information without the knowledge or consent of the individual only if

...

(d) the information is publicly available and is specified by the regulations.

Use without knowledge or consent
(2) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may, without the knowledge or consent of the individual, use personal information only if

(c.1) it is publicly available and is specified by the regulations;

The key provision in this case is contained in the regulation that stipulates that one can only use "publicly available information" for the purposes for which it was made available to the public in the first place:

(b) personal information including the name, title, address and telephone number of an individual that appears in a professional or business directory, listing or notice, that is available to the public, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the directory, listing or notice;

In this case, the Assistant Commissioner concluded that Professor Geist's e-mail address was posted on the University of Ottawa website to further the interests of the University. This purpose did not include receiving solicitations to buy sports tickets.

I will be interested to see if Professor Geist will take this matter to the Federal Court to provide us a more definitive conclusion on these important points.

See, also, a very good article on this incident at the Toronto Star: Football club broke email privacy rules.

Labels: information breaches, privacy, spam