Interview with Fasken Martineau DuMoulin LLP

May 2004

Terry McQuay, Nymity's President, discusses privacy in Quebec with Karl Delwaide of Fasken Martineau DuMoulin LLP.  Louise Béchamp and Jeffrey Kaufman of Fasken Martineau DuMoulin LLP will speaking to Quebec's experiences with Privacy Legislation on May 17th at Nymity's Employee Privacy Conference.

Nymity: Why did Quebec create a private sector privacy Act in 1994?

Delwaide:  Firstly, in Canada in general and in Quebec more particularly, there was an increasing awareness on questions related to privacy. For example, the Quebec Charter of Rights, adopted in 1975, includes a specific provision to the effect that “every person has a right to respect for his private life”. Moreover, in 1980, the Organization for Economic Cooperation and Development (“OECD”) adopted guidelines on the protection of Privacy and Transborder Flows of Personal Data. In 1982, the Quebec National Assembly enacted the Act respecting Access to Documents Held by Public Bodies and the Protection of Personal Information. As its title enounces, this statute governs not only access to information held by public institutions, but also sets the boundaries for public agencies’ obligations to protect personal information they collect on individuals.
At the beginning of the nineties, the Legislature adopted a revised Civil Code for the province of Quebec (to come into force in 1994), which included provisions on the enjoyment and exercise of civil rights. The new Civil Code of Quebec included specific provisions granting to every person a right to the respect of his reputation and privacy (articles 3 and 35).

As part of a chapter covering the aspects of the respect of reputation and privacy, the new Civil Code of Quebec included provisions with respect to the right of a person to establish a file on another person and to limit the information to be gathered and used in that regard. The Act respecting the Protection of Personal Information in the Private Sector has been enacted in order to establish the particular rules to be followed for the exercise of the rights and obligations set up by the new Civil Code of Quebec with respect to the collection, use and communication of personal information.

Nymity: As Quebec’s Act has been in effect for 10 years, what have been largest challenges complying with the Act?

Delwaide:  The Act respecting the Protection of Personal Information in the Private Sector brought a new perspective in the way of conducting business in Quebec. Most enterprises (that’s the word used under the Quebec Privacy Act, instead of organization used in PIPEDA) had to adapt their business practices related to the management of personal information. Although there were general provisions in the Quebec Charter of Rights covering privacy, not many enterprises had been confronted with the needs to change their way of doing business in that domain.

With the Quebec Privacy Act, the enterprises had to question themselves in the same manner that PIPEDA requires the rest of Canada to do now. The enactment of the Quebec Privacy Act required the enterprises to review the type of information they collected, used or communicated for the conduct of their business. The enterprises had to identify the purposes for which they truly needed to collect, hold, use or communicate personal information. They had to distinguish between what is useful or helpful versus what is necessary to achieve the purposes they have identified. Moreover, in order to avoid contestation, they had to revise all the consent forms that they used in the past in order to make them “perfectly fit” with the requirements of the Act. Finally, the individuals concerned were guarantied a right to access their personal record and to ask for its rectification. For many enterprises, this right of access and rectification clearly brought some concerns in their right to manage information they considered to be their own.

Nymity: What about for employee privacy?

Delwaide: Quebec employers were facing the same type of concerns with respect to employees’ privacy. More particularly, the employers were worried about the facts that they could obtain from previous employers when they wanted to hire a new employee: How could they get the truth about an employee’s past employment history and performance? On the other side of the coin, Human Resources officers were concerned when they were requested to give information on a previous employee to a new employer.

Many adjustments had to be made in the type of files that employers were holding on employees: Could an employer keep all the information collected during the selection process? Is this information truly needed as an integral part of the employee’s file once he has been hired?

Nymity: What impact has PIPEDA in Quebec?

Delwaide: PIPEDA did not come as a “shock” to Quebec’s enterprises. They are already accustomed to the principles that are embodied in that type of privacy legislation. However, many enterprises realized that the Federal Parliament and the Quebec National Assembly did not discuss the need to “merge” the respective legislative requirements into one single comprehensive scheme, in order to avoid discrepancies in the application of the statutes. The enterprises are now facing the challenge of complying with many sets of rules governing privacy, depending on the province they are conducting their business operations. This is why our FMD National Practice Group on Privacy and Information Protection took the position that barring any major business reason, organizations must adopt privacy compliance measures that meet the strictest requirements of both federal and provincial legislations of every Canadian jurisdiction in which they do business. For some enterprises, this may become a nightmare if each and every province adopts its own privacy legislation with their own requirements in the day-to-day application. Unless the province of Quebec is successful in its constitutional challenge against PIPEDA…

Nymity: Please explain Quebec constitutional challenge and the possible outcomes

Delwaide:  On December 17, 2003, the Quebec Government referred to the Court of Appeal of Quebec a constitutional question that can be translated in the following manner: “Does Part 1 of the Protection of Personal Information and Electronic Documents Act, S.C. 2000, c. 5, exceed the legislative competence that the Constitutional Act of 1867 conferred to the Federal Parliament?”.

The preliminary paragraphs of the Quebec Reference include preambles to the effect that PIPEDA, through the power granted to the Governor in council to make orders, would recognize a “droit de regard” (i.e. a “verification right”) over the content of the Quebec Act [paragraph 26(2) PIPEDA]. This “droit de regard” would be incompatible to the fundamental principles of the Canadian federal system. Moreover, according to the Quebec Reference, the constitutional contestation will allow the Province of Quebec to make sure that its jurisdiction over matters related to privacy and the protection of personal information are recognized and protected.

The constitutional issue will raise questions related to the provinces’ jurisdiction over proprietary and civil rights in the province, in matters related specifically to the protection of privacy and personal information. At this stage, a formal notification of the constitutional Reference has been sent to the other Attorney general of each province. No Attorney general has yet intervened before the Court of Appeal of Quebec. They are probably waiting for the question to reach the Supreme Court of Canada.

Should the province of Quebec be successful in its constitutional challenge, this would mean that the Federal Parliament has no jurisdiction to adopt legislative measures to protect personal information throughout Canada. This would mean that that type of protection measures would have to be adopted “province by province” and that if a province does not enact such legislative measures, there would be no protection afforded (in that province) with respect to the protection of personal information (unless the general common law affords such protection).

Nymity: What are the jurisdictional considerations transferring personal information across a Quebec border?

Delwaide:  Summarily, the exemption order published at the end of 2003 by the Federal Government under paragraph 26(2) of PIPEDA excludes the application of PIPEDA in the province of Quebec for any organization, other than a federal work undertaking or business, that carries on an enterprise within the meaning of section 1525 of the Civil Code of Quebec and to which an Act respecting the Protection of Personal Information in the Private Sector applies, in respect of the collection, use and disclosure of personal information that occurs within the province of Quebec.

This exemption does not apply to federal work undertaking or businesses such as a railway company, a line of ship, a line of air transportation, a radio (or TV) broadcasting station, a bank, etc. Please note also that I have personally obtained from the Superior Court of Montreal a declaratory judgment stating that the Quebec Privacy Act does not apply to the personal information managed by a federal undertaking when this personal information is collected, used or communicated with respect to what is qualified as part of the very management and operation of this federal undertaking [see Air Canada v. Commission d’accès à l’information du Québec, Montreal Superior Court, September 3, 2003 (under appeal)].

Secondly, it is worth noting that this exemption is of limited application to the collection, use and disclosure of personal information that occurs within the Province of Quebec. Clearly, this means that as soon as one of the collection, use or disclosure has a “cross-border” feature, the exemption will not apply.

Moreover, one should take note of Section 17 of the Quebec Act, which requires an enterprise in Quebec which communicates, outside Quebec, information relating to persons residing in Quebec or entrust a person outside Quebec with the task of holding, using or communicating such information on its behalf to take all reasonable steps to ensure:

1. that the information will not be used for purposes not relevant to the object of the file or communicated to third persons without the consent of the persons concerned, except in cases similar to those described in sections 18 and 23;
2. in the case of nominative lists, that the persons concerned have a valid opportunity to refuse that personal information concerning them be used for purposes of commercial or philanthropic prospective and, if need be, to have such information deleted from the list.

Practically, this means that the person exploiting an enterprise in Quebec that wishes to transfer information outside Quebec must make sure that the “receiving jurisdiction” grants the same type of protection that the Quebec Act does to personal information, or otherwise obtain a contractual undertaking from the “receiving party” to protect such information in the same manner.

Nymity:  Please compare the Quebec Act and PIPEDA

Delwaide:  This question by itself would require a lengthy interview. The Federal Government has issued an exemption order on the application of PIPEDA in the Province of Quebec, which means that in the Federal Government’s “mind”, PIPEDA and the Quebec Act are “substantially similar”. The Office of the Privacy Commissioner takes the position that the most important difference is that the Quebec Act applies also to non-profit organizations. It is correct. However, I do not agree that in the day-to-day application, both Acts are in total harmony.

Without listing all differences (our Practice Group has performed a comparative study between PIPEDA and the Quebec Act that holds on more than 25 pages), one should consider the following differences:

a) implicit consents are not accepted under the Quebec Act. This means also that “negative consent” (consent that would be obtained because a person does not answer to an organization’s request) is not acceptable under the Quebec Act [except for nominative lists; see sub-paragraph d) below] (section 14 of the Quebec Act);

b) the need-to-know principle is not established nor based on the basis of the degree of sensitivity of the personal information under the Quebec Act. However, the Quebec Act creates a specific exception to the consent provision for the personal information that needs to be accessed by the authorized employees, mandataries or agents when needed for the performance of their duties or the execution of their mandates (section 20 of the Quebec Act);

c) one may have noticed that under Section 7 of PIPEDA, the exceptions created for the collection, use or communication of personal information [by paragraphs (1), (2) or (3) of Section 7] are not coherent. For example, paragraph 7 (3) of PIPEDA authorizes the communication, without consent, to an advocate or notary, or a barrister or a solicitor, who is representing an organization… without clearly authorizing the said advocate, notary, barrister or solicitor to use the information without the consent of the person concerned. Under the Quebec Act, it is generally understood that where an exception exists to the communication of the information, the person receiving the information is allowed to use it, at least for the purposes encompassed by the exception (Sections 13 and 18 of the Quebec Act);

d) under the Quebec Act, the enterprises are authorized to use nominative lists (i.e. lists of names, addresses or phone numbers) for philanthropic or commercial solicitation. This is one of the very few exceptions where the Quebec Act authorizes the “opt-out” approach (sections 22-26 of the Quebec Act). No such exception exists under PIPEDA;

e) finally, with respect to the rights to access a file and the exceptions that are recognized by the statutes, some exceptions exist under the Quebec Act that are not recognized by the Federal Act, and vice-versa. For example, under both the Federal and Quebec Acts, an enterprise shall not give an individual access to personal information if such disclosure would likely reveal personal information about a third party. However, for the application of this exception, the Quebec Act requires that the disclosure of such personal information on a third party individual to demonstrate that it may seriously harm that third person (Section 40 of the Quebec Act). Also, paragraph 9 (3) of PIPEDA recognizes the exception with respect to personal information that would reveal confidential commercial information. No such exception exists under the Quebec Act.

Nymity: Please describe Fasken Martineau’s privacy practice and how you could help organizations with operations in Quebec.

Delwaide:  Fasken Martineau DuMoulin has set up a National Practice Group on Privacy and Information Protection. The members of the Group are found in the various domains of FMD’s professional services offered, with an emphasis in Business/Corporate Law, Labor Law and Litigation. We are a multi-disciplinary Group, which has developed a true expertise with respect to Privacy and Information Protection in all difficult areas: health, employment, customer relations, business transactions, outsourcing, finance, banking and credit, insurance, surveillance, identity theft, litigation and investigations, charitable and self-regulatory bodies, EU compliance, etc.
The experience and expertise developed by the Quebec members of the FMD National Practice Group on Privacy and Information Protection are useful to any person, enterprise or organization that wish to conduct or review his/its own privacy assessment and audit. Generally, in Quebec, FMD is recognized among the very few firms truly involved in Privacy and Information Protection matters. For example, the consent forms that we have either drafted or revised for clients have been reviewed before the relevant tribunals and have passed the test with honours.

We are proud of the work that we have accomplished with our clients in that domain as we keep them informed of the new developments as they occur. Our website, as well as our members’ biography, are useful tools to get the appropriate information and guidelines (www.fasken.com).

Nymity: In closing, what recommendations do you have for organizations with head offices outside of Quebec, but with employees and operations in Quebec

Delwaide:  In matters related to privacy, please be careful:

a) privacy includes the protection of personal information but is a broader reality under Quebec law. For example, the Quebec Charter of Rights and the Civil Code of Quebec cover other aspects of privacy that are not covered by the specific statutes covering the protection of personal information;

b) moreover, there are other statutes, such as an Act to Establish a Legal Framework for Information Technology that have impacts on the way an enterprise must manage strategic information, including information that is deemed to be confidential, by statute or otherwise; and

c) with respect to the Act respecting the Protection of Personal Information in the Private Sector, please do not take for granted that by complying with PIPEDA, you are complying on a day-to-day basis with all requirements under the Quebec Act. For example, one should not forget the obligation made by the Quebec Act to inform the person concerned when establishing a file on that person of (a) the object of the file, (b) the use which will be made of the information and the categories of persons who will have access to it within the enterprise, and (c) of the place where the file will be kept and of the rights of access and rectification. This is a supplementary obligation which is different from the one to adopt a Privacy Policy and to make it available upon request (under PIPEDA).