Wednesday, March 18, 2015
PIPEDA and the Dine-and-Dash by Greg
CBC reported recently on the use of social media to identify a couple involved in a dine-and-dash at a Regina restaurant. But before we see too many businesses adopt a similar strategy, let's note that there are some significant privacy risks arising out of that course of action.
Restaurants and other organizations engaged in commercial activity in Saskatchewan are regulated by the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 ("PIPEDA") in their collection, use and disclosure of the personal information of customers. And it's well-established that video footage of an individual is personal information under PIPEDA's definition of "information about an identifiable individual". (That conclusion is particularly obvious in a case where the express purpose of releasing footage is to identify the individuals involved.)
As a result, a business releasing footage for the purpose of identifying individuals may only do so in accordance with the authorizing provisions of PIPEDA.
In principle, an organization is permitted to disclose information for the purpose of collecting a debt owed by the individual to the organization: PIPEDA, section 7(3)(b). So there's no serious issue as to whether disclosing footage of individuals who have left without paying is for a valid purpose - though the organization may run into trouble if it's incorrect as to whether a debt is actually owed.
More significantly, though, an organization is also required to limit its disclosure of personal information to what is appropriate in the circumstances: section 5(3).
On that front, disclosure of information in a manner which makes it available online without restriction may raise significant liability issues. See e.g. here at para. 58 as to the problems with posting information on unsecured websites in the context of a defamation claim - and note that under PIPEDA (unlike in the defamation context), the truth of the information being made available is not a defence.
Beyond the inherent risks of posting information online, the appropriateness standard may become even more difficult to reach when a business' intention is to have information shared among people who may not know the individuals involved, with the mere hope that it will eventually be passed along to somebody who may be able to apply it for the organization's purpose.
And PIPEDA makes an organization liability for damages caused by humiliation or otherwise where it discloses personal information inappropriately: section 16(c).
So how could the show-and-shame approach go wrong?
Suppose one of the individuals in a photo released on social media had recently moved between cities for the purpose of escaping from an abusive relationship - and the former partner was able to determine the individual's new location because of the organization's sharing of the photo online. Under those circumstances, it's highly questionable that the sharing would be found to be appropriate - and the business responsible could be required to pay damages for humiliation, emotional suffering, and the cost of relocating the individual to a safe location.
Fortunately, the actual incident in the news seems to have been resolved without any such issues. But any organization should be careful before making a habit of putting photos online to track down non-paying customers - as the liability risk could far exceed the payment which might be recouped.
Tuesday, February 10, 2015
Saskatchewan Labour Relations Board's New Appellate Authority by Greg
Among many other changes to Saskatchewan's employment and labour law, the Saskatchewan Employment Act, SS 2014, c S-15.1 ("SEA") provided the Saskatchewan Labour Relations Board with the responsibility to hear appeals of adjudicators' decisions in employment standards and occupational health and safety matters. And while most of the new language in the SEA remains to be interpreted, the Board's new appellate authority has been considered in several cases.
Chairperson Love described the standard of review applid by the Board in these matters in Wieler v Saskatoon Convalescent Home, 2014 CanLII 76051 (SK LRB) ("Wieler") at para. 12, a case where the Board upheld an adjudicator's decision that a release signed by an employee barred any further occupational health and safety complaint:
(T)he applicable standard of review of questions of law is correctness, for questions of mixed fact and law, reasonableness, and for questions of fact which may be considered errors of law, reasonableness.
The Board has also applied a correctness standard to questions of natural justice. In 101193093 Saskatchewan Ltd v Selimos, 2014 CanLII 76054 (SK LRB), Chairperson Love remitted a wage assessment back to the adjudicator on natural justice grounds in a case where it was unclear whether the appellant employer received notice that the hearing would proceed in his absence.
The balance of the cases considered by the Board to date have generally involved little challenge to the conclusions reached by adjudicators. See Prairie Oasis Travel Plaza Inc v Sayed, 2014 CanLII 76052 (SK LRB) and Judy’s Korner Tavern v Samoleski, 2014 CanLII 76055 (SK LRB).
The Saskatchewan Court of Appeal has granted leave to appeal from the Board's decision in Wieler due to the novelty and importance of the Board's new appellate authority, as well as the viability of an argument that OHS rights are of a class of protections which cannot be waived by contract. As a result, the resolution of the case bears watching.
However, the Board's analysis that it should apply well-established standards of review (including deference to an adjudicator's findings) appears to be well-founded, particularly compared to alternatives which might have blurred the lines between the Board's appellate authority under Part IV of the SEA and its policy functions respecting labour relations under Part VI.
Thursday, February 5, 2015
C-51 and Privacy - The End of Purposive Analysis by Greg
The British Columbia Civil Liberties Association notes that part of the reason for concern with Bill C-51 lies in a significant intrusion into Canadians' privacy. But the problem with the Conservatives' anti-terrorism legislation is even more striking than it might appear at first glance.
Federal government institutions - including CSIS and the RCMP - are governed by the Privacy Act (Canada) in their collection, use and disclosure of personal information. And the Privacy Act sets clear requirements as to the circumstances in which personal information may be collected, used or disclosed: collection is permitted only if the information "relates directly to an operating program or activity of the institution" (section 4), and use and disclosure is limited to a closed set of purposes along with the initial purpose for collection or consistent purposes (sections 7 and 8, respectively).
Like most public-sector privacy legislation, the Privacy Act expressly authorizes the disclosure of personal information for law enforcement or investigative purposes (section 8(1)(e)). And while the Privacy Act's language may be somewhat outdated in defining those purposes, it would be a relatively simple matter to amend that permitted type of use and disclosure within the existing statutory framework which also offers some statutory protection for privacy.
Instead, Bill C-51 creates an entirely new standard. A new list of government institutions will be established by schedule. C-51 will authorize the disclosure of personal information to those institutions without any apparent purpose requirement, so long as the information is "relevant to the recipient institution's jurisdiction or responsibilities".
In other words, rather than requiring that a disclosure of personal information be justified, C-51 states that the mere fact that the recipient has some national security function is justification for the disclosure of every shred of personal information in the hands of any other government institution. And C-51 may arguably override the Privacy Act's protection against cross-institution disclosure by setting up a prohibition against civil proceedings for the disclosure of information, but absolutely no provisions offering any protection for privacy (including even basic offence provisions for the abuse of its terms).
Mind you, the interaction between C-51 and the Privacy Act is unclear. The Privacy Act would still apply in principle to recipient government institutions, though the same "security trumps everything" approach that underlies C-51 in the first place would likely be applied as justification to treat recipients' data banks as exempt (and thus not subject to personal information requests by individuals). And any collecting institution which was scheduled under C-51 but not under the Privacy Act would face absolutely no accountability for its use of Canadians' private personal information supplied by government institutions.
Moreover, it's not clear how the purpose analysis in the Privacy Act would apply to information supplied without an initial purpose even for existing government institutions. If the purpose for collection of data by the recipient is the mere fact that it has been listed as having some national security function, does that then mean the Privacy Act's "consistent purpose" analysis allows the institution to use and disclose the information on an equally indiscriminate basis?
In sum, it's a radical change in course for the Government of Canada to suggest that the bare fact that an office has some national security function serves as justification for it to collect, and other institutions to supply, potentially massive amounts of personal information which have nothing to do with any specific investigation or basis for suspicion (or indeed any existing program or activity). And there's a real risk that a wholesale data dump from other government institutions to security agencies will be accompanied by no meaningful ability to test what's been shared and why.
Friday, January 30, 2015
SFL v Saskatchewan - What Comes Next? by Greg
Obviously, today's Supreme Court decision affirming a Charter right to strike (Saskatchewan Federation of Labour v. Saskatchewan, 2015 SCC 4) will have significant ramifications for Canadian labour law. And plenty of other observers are weighing in on what the decision might mean more broadly.
But what effect will it have on Saskatchewan's own laws governing strike activity?
The immediate impact is limited to a suspended declaration that the Public Service Essential Services Act, S.S. 2008, c. P‑42.2 ("PSESA") is invalid. Which means that in theory, the PSESA could stay on the books for up to a year.
But that delay might not be required if Saskatchewan's government decides to proclaim in force the new essential services provisions of the Saskatchewan Employment Amendment Act, 2014 ("SEAA") (PDF). The SEAA represented a retreat from some of the more obviously unconstitutional aspects of the PSESA, but might still be subject to challenge on the "substantial impairment" threshold which now applies to the right to strike (as well as the right to collective bargaining).
Meanwhile, some question will also arise as to the new rules setting limiting the availability of job action under the Saskatchewan Employment Act, SS 2014, c S-15.1 ("SEA"). While the SEA's restrictions are primarily process-oriented, they too might run afoul of a substantial impairment threshold - both in general terms, and particularly if they prove unduly onerous under the circumstances of a particular planned strike.
In sum, while we now know that the right to strike exists and the PSESA represents an unconstitutional violation, there's still plenty more to be done in assessing whether Saskatchewan's legislation is Charter-compliant in its effect on strike activity. And Saskatchewan's government may have to go back to the drawing board in a few more areas than it anticipated.
Thursday, January 8, 2015
Update on Overtime Pay for Saskatchewan Retail Workers by Greg
Following up on this post, Saskatchewan's provincial government has reversed its new "interpretation" of overtime rules governing retail employees. But that doesn't look to be the end of the story.
Below is the e-mail showing the instructions given to the staff of the Ministry of Labour Relations and Workplace Safety:
Of note, the Ministry appears to have been using the new interpretation eliminating overtime for retail work beyond 8 hours in any 24-hour period unless that period coincided with a calendar day as only the start of a "gradual phase-in". The eventual intention looks to have been to restrict the availability of overtime for all Saskatchewan workers - and it's not clear that such a change will be subject to any more transparency if applied more broadly. (In that respect, it doesn't appear that anybody other than the Ministry's staff and the Retail Council of Canada were informed of the above change at the time of implementation.)
Meanwhile, it's worth noting that the supposed pursuit of flexibility in the policy change runs in only one direction: while the elimination of overtime pay would offer employers more "flexibility" in requiring employees to work more for less pay, nothing in the Saskatchewan Employment Act or the new interpretation would offer any new flexibility for employees to decline that type of work or otherwise manage their schedule.
Update: Here's the followup instruction to Ministry employees about the end of the "pilot interpretation". I'm awaiting confirmation as to whether that interpretation was, or will be, applied to any actual employment standards complaints.