The Supreme Court of Canada (the SCC) released its long-awaited ruling in UFCW-Can, Local 401 v. Alberta (Information and Privacy Commissioner) on Nov.15, 2013. In its decision, the SCC unanimously held that Alberta's Personal Information Protection Act (PIPA) unconstitutionally infringes the right to freedom of expression guaranteed by the Canadian Charter of Rights and Freedoms (the charter). This decision confirms that, after a decade of legislative and judicial trends emphasizing the privacy rights of individuals, such rights, while fundamentally important, are not absolute and will have limits.
While the SCC declared PIPA invalid in its entirety, it suspended that declaration for 12 months to grant the Alberta legislature an opportunity to revise PIPA. It is noteworthy that both the appellant Attorney General of Alberta and Privacy Commissioner of Alberta requested this general declaration of invalidity, indicating that the Alberta legislature may consider using this opportunity to generally reform PIPA.
Regardless of the amendments that occur to PIPA, this decision underscores the need for organizations to continue placing a high priority on ensuring that they are meeting and exceeding the requirements of all applicable privacy laws.
Union videotaped people crossing picket line
The United Food and Commercial Workers, Local 401 (the union) represented workers at the Palace Casino in Edmonton. The union videotaped its picket line during a strike in 2006 (a standard practice in Alberta) and posted signs in the surrounding area stating that images of persons crossing the picket line might be placed on a website. While images were never placed on a website, the union used collected images for other purposes, including using the image of a management employee on satirical posters and in leaflets. Complaints were filed with the Privacy Commissioner of Alberta, whose adjudicator held that the union had violated PIPA. On judicial review and appeal, both the Alberta Court of Queen's Bench and the Alberta Court of Appeal held that PIPA, as applied to the adjudicator's order, unconstitutionally infringed the Union's Charter-protected right to freedom of expression.
PIPA, like other private-sector privacy legislation across Canada, generally prohibits organizations from collecting, using or disclosing the personal information of individuals without consent, subject to limited exceptions. Privacy legislation was adopted to recognize the rights of individuals to have their personal information protected, with consideration to the reasonable needs of organization to collect, use and disclose such personal information.
The SCC held that PIPA unconstitutionally infringed the union's right to freedom of expression as it prohibited the union from using collected images on strike-related material without consent, which the court found was expressive activity, and that such infringement was not justified under section 1 of the charter.
In coming to this conclusion, the SCC underscored the importance of individuals' rights to privacy and the ability to control their personal information, particularly in light of technological developments which have granted organizations the almost limitless ability to collect, use and disclose personal information for their own purposes. Moreover, the SCC confirmed that the protection of individual privacy rights enjoys a "quasi-constitutional" status, affirming its prior decision in H.J. Heinz Co. of Canada Ltd. v. Canada (Attorney General).
However, the SCC held that while PIPA's objective of protecting the personal information of individuals was important, its broad restrictions – which it found indiscriminately limits the collection, use and disclosure of personal information without regard for the nature of that information, the context in which it is used, and the purposes for which it is collected, used or disclosed — were disproportionate to its benefits.
Affirming the essential and well-developed right of a union to exercise its right to freedom of expression in a labour dispute, the SCC noted that the ability to strike and picket was one of the most effective bargaining strategies enjoyed by a union. The SCC highlighted the fundamental importance of freedom of expression in the context of organized labour for several reasons, including allowing workers to: exercise their charter-protected right to freedom of association; contribute to their ability to influence their working and non-working lives; alleviate the imbalance between the power of an employer and the vulnerability of individual workers; and expose issues relating to labour conditions to broader society for debate and consideration. The protections afforded by PIPA, while important, were held by the SCC to not justify the restrictions on the Union's right to freedom of expression in the context of a labour dispute.
PIPA may be completely revised
The SCC accordingly held that PIPA was unconstitutional as it restricted the union's collection, use and disclosure of personal information for legitimate labour relations purposes. The SCC declared PIPA invalid in its entirety, but suspended that declaration of invalidity for a period of 12 months to provide the Alberta Legislature an opportunity to revise PIPA in a constitutional manner.
We believe this decision confirms the following:
• Lawmakers and courts will continue regarding individual privacy rights as quasi-constitutional in nature and will continue taking steps to ensure that individuals are properly afforded such rights.
• A union's right of freedom of expression and ability to communicate and persuade the public of its cause, while not absolute, is protected by the courts. To the extent such freedom of expression for legitimate labour relations purposes contradicts applicable privacy laws, those privacy laws will be off-side of the charter.
• There is now a precedent for future harter challenges to Canada's other private-sector privacy legislation, including British Columbia's Personal Information Protection Act (BC PIPA) which was drafted in tandem with PIPA, Manitoba's recently passed The Personal Information Protection and Identity Theft Protection Act, and the federal Personal Information Protection and Electronic Documents Act (PIPEDA), upon which PIPA is closely modelled. Whether other lawmakers will take the opportunity to reform their respective privacy legislation in light of this decision remains unknown.
While we can only speculate as to the amendments that will be made to PIPA in the next 12 months, the fact that the Attorney General of Alberta and Privacy Commissioner of Alberta requested the SCC to declare PIPA invalid in its entirety given the comprehensive and integrated nature of the legislation indicates that the Alberta Legislature may be contemplating using this opportunity to generally reform PIPA.
As the Supreme Court of Canada expressly noted that PIPA was considerably broader than the federal PIPEDA, which only places limitations on personal information collected, used or disclosed in the context of commercial purposes, the Alberta legislature may take direction to restrict PIPA's application to a narrower commercial context. Alternatively, the Alberta legislature may also take inspiration from the BC PIPA, which contains a specific exception to consent requirements in circumstances where an individual's personal information is collected by observation while he or she attends a public event. If either PIPEDA or BC PIPA had governed the underlying privacy complaint against the union, compelling arguments could have been made that the union's conduct did not violate any applicable privacy laws.
For more information see:
• UFCW-Can, Local 401 v. Alberta (Information and Privacy Commissioner), 2013 CarswellAlta 2210 (S.C.C.).
• H.J. Heinz Co. of Canada Ltd. v. Canada (Attorney General, 2006 CarswellNat 903 (S.C.C.).
Brian Thiessen is a partner and Shaun Parker is an associate with Blake, Cassels & Graydon LLP in Calgary, both practising labour and employment law. Brian can be reached at (403) 260-9616 or email@example.com. Shuan can be reached at (403) 260-9771 or firstname.lastname@example.org.