a year in privacy: highlights for the courts and the commissioner
TRANSCRIPT
A Year in Privacy
Highlights from the Courts and the Commissioner
elderCommunications & Privacy Law
12 May 2010 © David Elder 2010 1
Meeting Your Privacy Obligations, Canadian Institute, Toronto
The Blockbusters
FacebookCase Summary #2009-010
Ads not always “secondary purposes” Issues with third party applications, deletion/deactivation, protection of info re
deceased users and non-users
AbikaCase Summary #2009-009
Principle 4.6 intended primarily to address matters of objective, verifiable fact, not subjective opinion
Collection without consent, no disclosed purposes
Deep Packet Inspection Case Summary #2009-010
Use of DPI for network management purposes is acceptable with appropriate notice and implied consent,
12 May 2010 © David Elder 2010 2
Festival Circuit
Data Augmentation (Case Summary #2009-004)
Matching/sorting of publicly available personal information with geo-demographic data does not require consent
Publicly Available Information (Case Summary #2009-13)
eMail address posted on website may be “public available information”
ID Verification (Case Summary # 2009-012)
Verification of non-suspicious ID not required
Compliance with Subpoena or Warrant (Case Summary # 2009-005)
Summons requiring appearance in court does not authorize direct disclosure of personal information without consent
Consent for Collection (Case Summary #2009-007)
Innocent 3d parties filmed by PI Consent or depersonalization required
12 May 2010 © David Elder 2010 3
B Movies & Made-for-TV
• Bus terminal video surveillance OK with noticeCase Summary #2009-001
• Realtor advertises condo purchase price without consentCase Summary #2009-002
• Disclosure by insurer to 3rd party medical consultants of claimant’s medical files
Case Summary #2009-003
• Airline need not collect birth date and month for travel insuranceCase Summary #2009-006
• MDT and GPS in buses OK – not used to monitor employee performance
Case Summary 2009-011
• Driver’s Licence collection not required for store membershipCase Summary #2009-14
12 May 2010 © David Elder 2010 4
From the Bench
State Farm v. The Privacy Commissioner of Canada et al., Federal Court of Canada T-604-09 (pending) Does “commercial activity” require a direct commercial relationship
between individual and organization? Is PIPEDA beyond jurisdiction of Parliament?
Privacy Commissioner of Canada v. Air Canada, 2010 FC 429 (T.D.) OPC has no right to particulars of information for which privilege
claimed
R v. Wilson, [2009] O.J. No. 1067 (S.C.J.) (QL) No reasonable expectation of privacy, for Charter purposes, where
service provider agreement, privacy policy contemplates disclosure to law enforcement
12 May 2010 © David Elder 2010 5
From the Bench
R. v. Chehil, [2009] N.S. J. No. 505 (N.S.C.A) (QL), 2009 NSCA 111, 248 C.C.C. (3d) 370 PIPEDA does not create a reasonable expectation of privacy for purposes
of s.8 - Charter protection only for “biographical core” or specific and meaningful private information
Waxer v. McCarthy [2009] F.C.J. No. 252 (T.D.) (QL) unsuccessful attempt to collect personal information did not amount to
collection under Act
Speevak v. CIBC , [2010] O.J. No. 770 (QL), 2010 ONSC 1128 Settled class action respecting repeatedly misdirected faxes containing
sensitive financial information
12 May 2010 © David Elder 2010 6
12 May 2010 © David Elder 2010 7
elderCommunications & Privacy Law
www.davidelder.ca