The Supreme Court of Canada recently denied leave to appeal a controversial decision from the Alberta Court of Appeal concerning the meaning of “personal information”.
In March of 2011, the Alberta Court of Appeal held that, in the appeal of a 2009 lower court decision (dismissing an application for judicial review of a decision by an adjudicator appointed by the Alberta Privacy Commissioner), driver’s license numbers are “personal information” and, therefore, protected under Alberta’s Personal Information Protection Act, but license plate information is not “personal information”. The decision has generated considerable debate about the definition of personal information and the types of information that organizations are allowed to collect, use or disclose without consent of the individual.
The case, Leon’s Furniture Ltd. v. Alberta (Information & Privacy Commissioner), arose from an incident in a furniture store. A customer purchased a table but did not take immediate delivery. The next month, the customer’s mother arrived to pick up the table, but was required to produce her driver’s license before she could take delivery. The mother strenuously objected to this collection of information but ultimately provided consent to the collection of her driver’s license and license plate information under protest. The mother later filed a complaint with the Alberta Privacy Commissioner.
The Privacy Commissioner delegated the matter to an adjudicator who held that the store’s policy of collecting driver’s license numbers and license plate numbers was unreasonable under Alberta’s privacy legislation. However, the Alberta Court of Appeal disagreed.
Regarding license plates, the Alberta Court of Appeal found that, in order for license plate information to be protected as personal information, the information must uniquely relate to an individual and not an object – i.e., the fact that the object may be owned by an individual does not necessarily make the number associated with that object to be personal information about that individual. The Court reasoned that the same analysis would apply to a vehicle identification number and to the street address of a home. The Court of Appeal also imported a “reasonable expectation of privacy” analysis and held that as vehicle license numbers are widely visible to the public, it is contrary to common sense to hold that they contain personal information.
The Court also made an interesting comment about the adjudicator’s ruling. It said that it was unreasonable to conclude that the appellant’s policy was unreasonable just because the adjudicator thought that there were other ways the appellant could operate its business. The Court emphasized the balancing of an organization’s need to use information against privacy rights and took issue with the notion that “privacy rights prevail in all circumstances over the legitimate need to use information”.
Given the very broad definition of personal information in Canadian privacy statutes, organizations in Canada often struggle to classify what is “personal information” and what is not. Is it information that can somehow be linked to an individual, however remote that possibility may be? This case provides some guidance in narrowing the scope because the Court noted that although the licence plate number could be connected to a database containing other personal information, that fact was not “determinative”. Having actual access to a database that may provide the link between the collected information and the individual seemed to be a significant factor to the Court in deciding whether or not to classify the information as personal information.
Based on this reasoning, the status of other types of information such as IP addresses, long considered by privacy advocates as a form of personal information, is now in doubt. If IP addresses are not personal information, does that mean they can be freely tracked, collected, used and disclosed?
While Leon’s injects some pro-business common sense into the privacy debate, organizations still must remain cautious when deciding which types of personal information to gather and how to gather them. The prudent course of action is always to obtain consent before collecting, using or disclosing any information linked to an individual.