Just before Christmas, the Ontario Superior Court of Justice released a decision on an interlocutory motion to strike portions of an affidavit. The applicant had not relied upon PIPEDA in its notice of motion, but argued that PIPEDA supported the motion as part of the evidence in question had been collected from a computer without consent. Justice Cullity dealt with the PIPEDA argument and ultimately ruled that the federal privacy law has its own procedure for redress. He also declined to find whether PIPEDA was violated in this case. Once again, the Courts have declined to be persuaded by an applicant's argument that the federal privacy law should exclude evidence in a civil matter.

Osiris Inc. v. 1444707 Ontario Ltd., 2005 CanLII 47731 (ON S.C.)

[83] Finally, I should refer to Mr Belmont's reliance on the provisions of the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 in a factum he filed in support of the motion by Osiris. This was not a ground mentioned in the notice of motion. In the factum, and at the hearing, Mr Belmont submitted that VDG had clearly violated the prohibitive provisions of the statute by obtaining, and using, the Documents without the consent of their owners. This violation was said to be an additional ground on which the document should be excluded from the record.

[84] For the following reasons, I do not accept Mr Belmont’s submission. The statute creates a procedure in which complaints of breaches of its provisions are to be received by the federal privacy commissioner and under which hearings maybe conducted in the Federal Court after the Commissioner has made a report. I do not believe that, on this motion, I can properly be expected to bypass that procedure and, in effect, usurp the statutory jurisdiction under the guise of deciding a question of admissibility. Even if I were permitted to do this, it is by no means clear to me that either VDG, or Mr Nasir, has infringed the provisions of the statute.

[85] The general statutory prohibition is contained in section 5 (3) and provides that an "organization" (including a person or a partnership) may collect, use or disclose personal information only for purposes that a "reasonable person would consider appropriate in the circumstances". Personal information is defined as meaning information "about" an identifiable individual. Section 4.3 of Schedule 1 to the statute provides that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, "except where inappropriate". Section 7 (1) (b) and 7(2) (d) indicate that it will be appropriate to collect or use personal information.

... if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes relating to investigating a breach of an agreement ...

[86] Quite apart from the jurisdictional question - and the question when the contents of communications to or by an individual are to be considered to be information "about" him or her - I would not be prepared to find on the evidence that Nasir was not entitled to collect the information pursuant to section 7 (1) (b), and that VDG was not entitled to use it pursuant to section 7 (2) (d). According to his evidence, Nasir had considered his employment to be protected by an agreement ensuring Mr Albrecht's continued position as President of RealTime 7. He considered that agreement to have been breached by the dismissal of Albrecht, and his purpose in obtaining access to Mr Rajput's computer was to protect himself by investigating "what the Kulkarnis were up to."

[PIPEDA] :: [Evidence] :: [Litigation]

Labels: information breaches, privacy