APPLICATION OF PIPEDA TO SASKATCHEWAN CHARITIES AND NON-PROFITS

Transcription

1 APPLICATION OF PIPEDA TO SASKATCHEWAN.' ".' '-' -- - "-, ,- -..' CHARITIES AND NON-PROFITS \.-- )

2 () "

3 TABLE OF CONTENTS A. PIPEDA GENERALLy 1 B. ApPLICATION OF PIPEDA TO SASKATCHEWAN CHARITIES AND NON-PROFITS 2 1. Employee Personal Information 2 2. Donor Information and Other Personal Information 3 C. CONCLUSIONS 6

4

5 1 A. PIPEDA GENERALLY On January l, 2004, the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") took full effect. Subject to certain narrow exceptions l, PIPEDA applies to either of the following two circumstances (see section 4): Where an "organization" collects, uses or discloses "personal information" in the course of "commercial activity". OR Where "personal information" about an employee of an "organization" is collected, used or disclosed in connection with a "federal work, undertaking or business". PIPEDA does not apply to organizations that are subject to provincial privacy legislation that has been designated by the federal government as being "substantially similar" to PIPEDA. To date, Alberta, British Columbia, Ontario (with respect to Ontario's health information protection legislation) and Quebec have legislation in place that has been designated "substantially similar" to PIPEDA. Saskatchewan does not have any legislation that has been designated as "substantially similar" to PIPEDA. Thus, PIPEDA applies to all Saskatchewan organizations to the extent they collect, use or disclose personal information in either of the two circumstances described above. 1 Principally, where personal information is collected, used and disclosed for "personal or domestic purposes" or for "journalistic, artistic or literary purposes" (see subsection 4(2».

6 2 The balance of this paper will focus on PIPEDA and its application to the activities of charities and other non-profits operating in Saskatchewan. B. APPLICATION OF PIPEDA TO SASKATCHEWAN CHARITIES AND NON- PROFITS 1. Employee Personal Information It is important to note at the outset that PIPEDA has very limited application to personal information about employees of an organization. The general rule is that PIPEDA does not apply to personal information about an organization's employees unless the information is being collected, used or disclosed in connection with a "federal work, undertaking or business". In other words, for provincially regulated organizations, PIPEDA does not apply to their collection, use or disclosure of employee personal information as long as that collection, use or disclosure is for employment purposes. If, however, a provincially regulated organization made a secondary use or disclosure of employee personal information for a commercial purpose (such as selling an employee list to a marketing company), PIPEDA would apply. The position of the office of the privacy commissioner of Canada on the application of PIPEDA to employee personal information can be found in its Fact Sheet on the topic ( 05 d 18 e.asp). Given that most charities and many non-profits operating in Saskatchewan are provincially regulated in all respects, the application of PIPEDA to employee personal information will be very limited.

7 3 It is worth noting that the "substantially similar" provincial legislation in British Columbia, Alberta and Quebec does apply to employee personal information. 2. Donor Information and Other Personal Information The key issue for Saskatchewan charities and non-profits from a privacy law perspective will be the extent to which PIPEDA applies to personal information about donors, members and other individuals who interact with the organization. As noted above, PlPEDA applies to all organizations where they collect, use or disclose personal information in the course of "commercial activity". For charities and other non-profits, therefore, the most important question will be whether (and if so, to what extent) they engage in "commercial activity". s. 2(1) of the PIPEDA defines "commercial activity" as follows: 2(1) "[C]ommercial activity" means any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists. For charities and non-profits, it is firstly important to note that selling, bartering or leasing donor, membership and other fundraising lists is deemed to be commercial activity. This activity is, therefore, clearly caught by PlPEDA and all of the various requirements of PIPEDA will apply to this activity. Most importantly, this means that charities and non-profits engaging in these activities must obtain an appropriate consent from the subject individuals in order to collect, use and disclose their personal information in this fashion.

8 4 It is also very clear from the definition of "commercial activity" that an organization's status as a non-profit generally is not determinative. Organizations that are, at their core, non-profit in nature can engage in individual transactions that are commercial in nature. What is less clear is the extent to which the activities of charities and non-profits that do not involve trading in lists might qualify as "commercial activity". Significantly, the office of the privacy commissioner of Canada has issued a "Fact Sheet" on PIPEDA providing its view that the core activities of charities and non-profits will generally not fall within the scope of "commercial activity" (except, of course, for the activity described above which is deemed to be "commercial activity"). A copy of the federal privacy commissioner "Fact Sheet" can be found at 05 d 19 e.asp. While very useful, the federal privacy commissioner "Fact Sheet" is only an interpretive aid. Ultimately, it is the courts that will interpret the scope of the phrase "commercial activity" in the context of PIPEDA. Case law dealing either with the definition of "commercial activity", or the broader phrase "in the course of commercial activities", is scant. There has been no definitive pronouncement on what constitutes "commercial activity" in the context of the PIPEDA. However, the courts have identified some personal information collection, use and disclosure activities that are not sufficient to satisfy the definition and, in doing so, have begun to piece together a general guide to what is likely to satisfy the definition going forward.

9 5 ) Though obiter, the court in Ferenczy v. MCI Medical Clinici sums up the approach that the courts are likely to take in determining whether an organization's collection, use and/or disclosure of personal information constitutes "commercial activity" when it states that it is the organization's "purpose and intended use of the information that one should have regard to in determining the applicability of the [PIPEDA].,,3 This purposive approach to the definition of "commercial activity" is supported by decisions of the courts as to what does not constitute "commercial activity". For example, the court in Rodgers v. Calvert 4 held that the mere fact that consideration is exchanged during the collection of the personal information - for example, the payment of a membership fee in exchange for the services and benefits of membership in an association - is not sufficient to lead to a finding that such collection is done in the course of commercial activity.s Moreover, where personal information is collected by an agent for the personal use of the principal, that collection does not constitute commercial activity, even if the principal pays the agent for the service. 6 These examples are illustrative of the point that the purpose for which the information is collected, and not the nature of the information collection activity itself, is what matters in determining whether such collection is done in the course of commercial activities. 2 Ferenczy v. MCI Medical Clinics, 2004 CarswellOnt 1706 (ant. S.C.J.) [Ferenczy). 3 Ibid. at para Rodgers v. Calvert, 2004 CarswellOnt 3602 (ant. S.C.I.) [Rodgers]. ) 5 Ibid. at para Supra note 1 at para 30.

10 6 Given that Rodgers involved the collection of personal information of members of a not-forprofit club, this approach to the definition of "commercial activity" would also seem to be applicable in the not-for-profit context. In offering further support for a purposive approach to the definition of "commercial activity", the Ontario Labour Relations Board in I.A.RS.OJ.. Local 736 v. E.S. Fox Ltd.? held that the collection, use or disclosure by an organization of the personal information of its employees solely for employment-related purposes cannot reasonably constitute a commercial activity.8 The mere fact that an organization carries on a commercial activity cannot, on its own, render the collection, use or disclosure of employee personal information for employment-related purposes into a commercial activity.9 Therefore, ifthe purpose ofthe collection, use or disclosure is not in and of itself a commercial activity, the fact that such collection is only tangentially related to the broader commercial activity of the organization is not sufficient to render it a commercial activity itself. C. CONCLUSIONS Based on the foregoing, the following conclusions can be reached as to the application of PIPEDA to charities and other non-profits in Saskatchewan: (a) Given that most Saskatchewan charities and other non-profits will not qualify as "federal works, undertakings or businesses", PIPEDA will generally have no 7 l.a.b.s.o.i., Local 736 v. E.S. Fox Ltd., 2006 CarswellOnt 2476 (Ont. Lab. ReI. Bd.) [l.a.b.s.o.l.]. 8 Ibid. at para Ibid.

11 7 application to personal information about employees of the organization collected, used or disclosed for employment related purposes. (b) It is very clear that buying, selling and trading in donor, member or other similar lists is subject to the full application of PIPEDA. All charities and other nonprofits should, at a minimum, conduct a review of their operations to determine whether they engage in this activity and, if so, whether the requirements in PIPEDA (including the requirement to obtain an appropriate consent) are being met. (c) Most other activities of charities and non-profits will not be subject to PIPEDA unless there are particular transactions where the purpose of the collecting, using and disclosing personal information as part of the transaction is more clearly for commercial purposes. This would not include, however, such core non-profit activities such as receiving/processing donations and selling memberships.

12