The Supreme Court of Canada doesn't often hear cases related to the Access to Information Act and the Privacy Act, but it did so in a decision released yesterday. In H.J. Heinz Co. of Canada Ltd. v. Canada (Attorney General), 2006 SCC 13, the Supreme Court determined that a court, in a review under s. 44 of the Access to Information Act is permitted to consider issues related to the privacy of personal information.

The s.44 scheme is generally understood to relate to confidential business information. Under the Act, if an applicant requests access to information that may be confidential business information, the head of the government body is required to give notice to the third-party who may be affected, who can make a representation that the information should not be disclosed. If the government proposes to release the information despite the third party's objections, the third party can make an application to the Court to have that decision reviewed.

The Access to Information Act does not have any similar review provision if the information in question is "personal information". In this particular case, the third party attempted to argue that the information was also personal information and should not be released. The Supreme Court of Canada concluded that a court may, on a s. 44 review, consider the personal information exemption as well as the confidential business information exemption. In the decision, the Court had some interesting things to say about privacy. Here's the headnote for the case:

Citation: H.J. Heinz Co. of Canada Ltd. v. Canada (Attorney General), 2006 SCC 13

Date: 20060421 Docket: 30417

File No.: 30417.

2005: November 7; 2006: April 21.

Present: McLachlin C.J. and Bastarache, Binnie, LeBel, Deschamps, Fish and Abella JJ.

on appeal from the federal court of appeal

Access to information — Exemptions — Personal information — Third party information — Review by Federal Court — Application by third party under s. 44 of Access to Information Act for review of government institution’s decision to disclose record — Whether third party can raise exemption for personal information on s. 44 review — Access to Information Act, R.S.C. 1985, c. A‑1, ss. 19, 20(1), 44.

A federal agency received a request under the Access to Information Act (“Access Act”) for access to certain records pertaining to the respondent company, a third party within the meaning of the Act. The agency determined that some of the records might contain confidential business or scientific information, as described in s. 20(1) of the Act, and requested, pursuant to ss. 27 and 28, that the company make representations as to why the information should not be disclosed. The company submitted its representations and after reviewing them, the agency concluded that the records should be disclosed, subject to certain redactions. The company commenced a review proceeding pursuant to s. 44 of the Access Act and, in addition to the confidential business information exemption, sought to raise the personal information exemption set out in s. 19 of the Act. The application judge concluded that the company could raise the s. 19 exemption on a s. 44 review and ordered the severance of certain records containing personal information. The Federal Court of Appeal upheld the decision.

Held (McLachlin C.J. and Bastarache and LeBel JJ. dissenting): The appeal should be dismissed.

Per Binnie, Deschamps, Fish and Abella JJ.: A third party may raise the exemption for personal information set out in s. 19 of the Access Act in a s. 44 review. The plain language of the statute, together with the legislative context and combined purposes of the Access Act and the Privacy Act, provides ample foundation for this conclusion. [22‑46]

It is apparent from the scheme and legislative histories of the Access Act and the Privacy Act that the combined purpose of the two statutes is to strike a careful balance between privacy rights and the right of access to information. However, within this balanced scheme, the Acts afford greater protection to personal information. By imposing stringent restrictions on the disclosure of personal information, Parliament clearly intended that no violation of privacy rights should occur. Where a third party becomes aware that a government institution intends to disclose a record containing personal information, nothing in the plain language of ss. 28, 44 and 51 of the Access Act prevents the third party from raising this concern by applying for review. These sections do not limit the court’s discretion to a consideration of the s. 20(1) exemption. Furthermore, s. 44 is the sole mechanism under either the Access Act or the Privacy Act by which a third party can draw the court’s attention to an intended disclosure of personal information in violation of s. 19 of the Access Act, and by which it can seek an effective remedy on behalf of others whose privacy is at stake. While the Privacy Commissioner and the Information Commissioner play a central role in the access to information and privacy scheme and have extensive responsibilities, their role is limited by an inability to issue injunctive relief or to prohibit a government institution from disclosing information. A reviewing court is in a position to prevent harm from being committed and the statutory scheme imposes no legal barrier to prevent the court from intervening. An interpretation of s. 44 that forces an individual to wait until the personal information is disclosed and the damage is done, or that imposes an onerous burden on the person seeking to avert the harm, fails to give proper content to the right to privacy and also fails to satisfy the clear legislative goals underlying the Access Act and the Privacy Act. A narrow interpretation of s. 44 would weaken the protection of personal information and dilute the right to privacy. [2] [31‑35] [45] [63] Although a review under s. 44 of the Access Act is triggered by a third party’s right to notice where requested records may contain confidential business information, Parliament’s failure to provide a similar notice where personal information is involved does not indicate that the legislature intended that s. 19 should be unavailable on a s. 44 review. The right to notice accorded to third parties follows logically from the specific nature of the confidential business information exemption and does not limit the right of review provided for in s. 44. First, in the case of confidential business information, the assistance of the third party is necessary for the government institution to know how, or if, the third party treated the information as confidential. Second, the mandatory nature of s. 19 precludes the need for a notice provision. Under the Access Act, notice is a right intended to enable a party to contest the release of information and is therefore required only where the statute contemplates the possibility of making information public, as is the case with confidential business information under s. 20(1). In the specific circumstances in which the Access Act does authorize the disclosure of personal information, a notice provision is either superfluous or has in fact been provided for in the legislative scheme (s. 8(5) of the Privacy Act). Given the underlying presumption that personal information will not be disclosed as well as the paramount importance of individual privacy, it would be absurd not to allow third parties to use the mechanism provided for by the legislature to prevent a violation of the spirit and the letter of the Access Act and the Privacy Act. Allowing the company to raise the s. 19 exemption on a s. 44 review does not create a “second tier” of third parties, but allows the only third party who has access to s. 44 to use this remedy to prevent harm from occurring needlessly. [41] [50‑58]

Per McLachlin C.J. and Bastarache and LeBel JJ. (dissenting): A third party cannot raise the s. 19 exemption for personal information on a s. 44 review. In interpreting s. 44 of the Access Act, it is necessary to preserve the integrity of the mechanism Parliament has selected. In order to balance the competing rights of access and privacy, Parliament has selected a complaint and investigation process. Where the personal information of individuals is improperly disclosed, those individuals can bring a complaint to the Privacy Commissioner under s. 29 of the Privacy Act. There is no notice provision prior to the disclosure of a requested record that might contain exempted personal information, nor does the unlawful disclosure of exempted personal information give rise to a right of judicial review under the Access Act or the Privacy Act. By virtue of ss. 27, 28 and 29 of the Access Act, the legislative scheme provides notice prior to the actual disclosure only where the requested record may contain confidential business information. Since the right to bring a s. 44 review flows from the notice a third party receives because of the believed presence of confidential business information in the requested record, considered in its proper statutory context, s. 44 has nothing to do with the s. 19 exemption. The structure of the Access Act and of the Privacy Act suggests that Parliament intended that the protection of personal information be assured exclusively by the Office of the Privacy Commissioner. In order to give effect to the legislative intent, the complaint and investigation process contained in s. 29 must be respected. [94‑97] [106] [123]

Unless the opportunity to raise exemptions at a s. 44 review proceeding is limited to the s. 20 exemption for confidential business information, third parties who have received notice pursuant to s. 28(1)(b) will be afforded an opportunity to raise the s. 19 exemption for personal information in circumstances where no comparable right exists for a third party claiming only that the record contains personal information belonging to it. The effect of the proposed extension of the s. 44 review would be to create two categories of third parties: those who have relevant confidential business information and those who do not. Such a result would be absurd insofar as it would allow greater protection of certain individuals’ personal information, depending on the possible application of s. 20. There is no basis for such a two‑tiered system in either the Access Act of the Privacy Act. Furthermore, that right of review may not even belong to the individual whose personal information actually appears in the requested record. In the present case, only the company has the right to apply for a review, notwithstanding that the personal information contained in the record actually belongs to its employees. While both the Access Act and the Privacy Act expressly allow an authorized agent to bring complaints to the Information Commissioner or to the Privacy Commissioner, respectively, s. 44 does not so provide. [98‑102] [107]

Although a third party cannot raise the s. 19 exemption on a s. 44 review, where a government institution acts without or beyond its jurisdiction, it remains open to a party directly affected by the decision to bring an application for judicial review pursuant to s. 18.1 of the Federal Courts Act. The decision of the government institution to disclose the requested record is reviewable for jurisdictional error, and the remedy of prohibition is available. The Federal Court judge hearing the judicial review application will only decline to exercise his jurisdiction if satisfied that the statutory scheme provides an adequate alternative remedy. Here, the statutory scheme does not provide the company with an adequate alternative remedy. [108] [114] [117‑118]

In view of the critical differences between the two proceedings, there are valid reasons for refusing to collapse a s. 18.1 review within a s. 44 review. However, the Federal Court judge could proceed with both applications at the same time or consecutively, thereby addressing the concerns about unwarranted use of resources. [119‑121]

Update (20060423): Check out Michael Geist's comment on the importance of this case: Michael Geist - The Supreme Court on Privacy.

Privacy Access+to+Information Freedom+of+Information Privacy+Law Supreme+Court+of+Canada

Labels: information breaches