The Office of the Privacy Commissioner of Canada (“OPC”) has found the Canada Border Services Agency (“CBSA”) responsible for the intrusive actions taken by reality TV producers – a private sector company – the party that was responsible for obtaining and releasing personal information of a detainee. While the OPC conceded that the collection of the detainee’s personal information was part and parcel of what the CBCA is permitted to do, it found that by allowing TV cameras to be present during that collection, the CBSA permitted a “real-time disclosure” of that personal information in violation of its obligations under the Act. This an unusual, and expansive, understanding of the concept of “disclosure”.

Background

The media has recently reported that the hit reality television series, Border Security: Canada’s Front Line, will not be returning for a fourth season after the OPC recommended that the CBSA end its participation in the program.

Border Security began airing in 2012 and had an audience of several millions of Canadians. In short, the program captured encounters between CBSA officers and the public and showcased what happened when people try to smuggle (among other things) Colorado marijuana, firearms, too much currency, and/or Chinese Peking duck into the country. It also highlighted situations where people attempted to enter Canada without the required documentation.

The Incident

On March 13, 2013, the show filmed the CBSA raiding a construction site in Vancouver, where officers found Oscar Mata Duran hiding. Officers proceeded to question Mr. Duran about his identity, immigration status, and employment. Mr. Duran had provided his verbal consent to be video recorded during this initial interrogation. Subsequently, Mr. Duran was processed at an immigration detention facility, where he was presented with a consent form in Spanish that would allow a private production company, Force Four Production, to film his interactions with the CBSA during his time at the detention centre. Following his stay at the detention centre, Mr. Duran was deported to his home country, Mexico.

The British Columbia Civil Liberties Association ( “BCCLA”) subsequently filed a complaint on Mr. Duran’s behalf, alleging that the CBSA’s participation in the television program violated, among other things, the laws regarding disclosure of personal information by a government agency. The CBSA argued that the program educated the public in Canada and around the globe “about the CBSA’s contribution to keeping Canada safe and prosperous, and would demonstrate the challenges that CBSA officers face and the professionalism with which they carry out their mandate”.

The Law on Personal Information

The Privacy Act is legislation that recognizes a right to privacy by protecting Canadians’ personal information collected by the federal government. The Act applies to the federal public sector, which includes about 250 departments, agencies, and Crown corporations.

Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form. Section 4 of the Act states that “no personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution.”

Section 8 of the Act governs the rules regarding disclosure of personal information and provides that:

Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be disclosed by the institution except in accordance with this section.

Section 8(2) lists various circumstances where personal information may be disclosed, which includes when, “in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure”.

The OPC’s Finding

By way of the Finding, the Privacy Commissioner applied sections 3, 4, and 8 of the Privacy Act in order to determine whether the CBSA violated federal law by failing to obtain Mr. Duran’s consent prior to disclosing his personal information. In the end, the Commissioner concluded that the CBSA violated the Privacy Act by engaging in the television program and disclosing people’s personal information in the process.

What makes this Finding particularly interesting is that the Commissioner essentially applied the Privacy Act to the CBSA due to the intrusive actions taken by Force Four Productions – a private sector company – the party that was responsible for obtaining and releasing Mr. Duran’s personal information. Normally, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) applies to businesses and organizations in the private sector that use, store, and collect personal information. However, the Commissioner found that due to the CBSA’s contractual relationship with Force Four Productions, and the Agreement that governed this relationship, the private actor’s conduct could be imputed onto the CBSA, thereby implicating the Privacy Act.

The Commissioner clearly stated that as a matter of principle, federal government institutions cannot contract out of their obligations under the Privacy Act. The Commissioner found that “the spirit and intent of the Act would be completely thwarted should federal government institutions have the authority to enter into agreements to facilitate the engagement of activities for which the institution itself may not be authorized.”

In this case, the CBSA and Force Four Productions had an Agreement whereby the CBSA would facilitate access to customs controlled areas to allow the production company to film the enforcement operations. There are two parts of the Agreement that provided the basis for the Commissioner’s overall Finding.

Firstly, the Commissioner found that the CBSA played an integral role “in providing the necessary conditions for filming to take place . . . and that the CBSA [had] substantial control over the collection of personal information by Force Four.” Secondly, the Commissioner found that the CBSA controls the circumstances under which Force Four can film, and maintains control over the footage. The agency also controlled when and how footage is collected, and had the right to review the footage; to comment and approve the footage; to obtain an episode upon request; and to use and reproduce the footage for training purposes.

As a result, the Commissioner found it was not necessary to determine whether the CBSA actually participated in the collection of personal information itself. Rather, he found that the CBSA’s facilitation and control over the filming process “implicates the collection of personal information”, and therefore the CBSA had certain obligations under section 8 of the Privacy Act regarding any subsequent disclosure of that personal information (paras. 81-82):

However, the question of whether the CBSA can be said to be participating in the collection of personal information for the purpose of the Program is not determinative of our finding in this case. In our view, the CBSA is first collecting personal information in the context of its enforcement activities and thereby has a responsibility under the Act for any subsequent disclosure of the information that is collected for, or generated by, such activities.

Following our investigation, we are of the view that there is a real-time disclosure of personal information by the CBSA to Force Four [the producer] for the purpose of Filming the TV Program. Under section 8 of the Act, unless the individual otherwise provided consent, this personal information collected by the CBSA may only be disclosed for the purpose(s) for which it was obtained, for a consistent use with that purpose, or for one of the enumerated circumstances under section 8(2).

Lessons for Business Contracting with the Federal Public Sector

The Privacy Commissioner’s Finding raises a number of potential red flags for private individuals and businesses that contract with government institutions.

This case appears to suggest that when a private entity enters into an agreement with a federal government institution, and the collection of personal information is involved, the OPC may find the government actor to be in violation of the Privacy Act for actions the private entity took if:

  • the government actor provides the necessary conditions for the collection of personal information to take place;
  • the government actor has “substantial control” over the collection of personal information;
  • the government actor controls the circumstances under which the private actor can collect personal information; or
  • the government actor controls the personal information itself.

This could very well result in the end of a potentially very profitable contractual relationship.

It remains unclear whether this Finding will have any precedential value moving forward. However, individuals and businesses that work alongside the federal government would do well to exercise caution in their contractual relationships by first conducting privacy assessment in order to determine how personal information will be collected, used, stored, and transmitted.