Alberta Commissioner seeks leave to appeal Leon's case to the Supreme Court

In April, the Alberta Court of Appeal handed a significant defeat to the Information and Privacy Commissioner in Leon’s Furniture Limited v. Alberta (Information and Privacy Commissioner), 2011 ABCA 94 (CanLII), a case about whether a retailer is justified in collecting drivers' license and license plate information from customers picking up furniture. (See: Canadian Privacy Law Blog: Alberta Court of Appeal overrules province's Commissioner on license info.) Now it appears the Commissioner is taking the case to the Supreme Court of Canada. The application for leave to appeal was filed on May 26. The Court has discretion to determine whether it will hear the appeal, so it will be interesting to see whether the Court determines this to be a matter of national importance.

See also, Alberta’s privacy commissioner wants top court to overturn decision involving Leon's.

Amendments to Alberta liquor legislation to re-permit info collection

Presuably to counteract the effects of the Information and Privacy Commissioner's decision that bans siping licenses at bars in the province (Alberta Commissioner forbids license scanning), the Alberta legislature is considering Bill 42 which permits the collection of similar information:

Legislative Assembly of Alberta - Bill 42: Gaming and Liquor Amendment Act, 2009

Collection of personal information by licensee

69.2(1) A licensee may, before allowing a person to enter licensed premises, collect the person’s name, age and photograph.

(2) If a licensee has personal knowledge or reasonably believes that a person referred to in subsection (1) has, at any time within the preceding year, engaged in an activity referred to in section 69(1) or (2), the licensee may, in good faith, disclose the person’s name, age and photograph to other licensees for the purpose of allowing them to determine whether they wish to allow the person to enter licensed premises.

(3) A licensee must, as soon as possible after a request is made by a police officer, disclose to the police officer any information collected under subsection (1).

Thanks to a correspondent for pointing this out ...

Alberta Court of Appeal overrules province's Commissioner on license info

There appears to be a significant dissonance between the Information and Privacy Commissioner of Alberta and that province's Court of Appeal. The Court just released its decision in Leon’s Furniture Limited v. Alberta (Information and Privacy Commissioner), 2011 ABCA 94 (CanLII) and made some rather surprising findings.

The appeal centered around whether it is reasonable for Leon's Furniture to collect drivers license numbers and car license plate numbers when customers pick up furniture from the store. The Information and Privacy Commissioner's delegate had concluded that this was in appropriate under the Personal Information Protection Act to do so.

Two very notable findings:

• An individual's "right" to privacy does not trump the "need" of a business to collect, use or disclose personal information. A balancing is called for.
  
• A vehicle license number is not "personal information" because it is not about an individual.

Check out the full summary of this important case here: Majority of Alberta CA Slaps OIPC on Driver’s License Case « All About Information.

Missing Alberta health care provider hard drive had thousands of patient images

An unencrypted hard-drive has gone missing at Covenant Health in Alberta, leading to an investigation by the province's Information and Privacy Commissioner. The drive, it appears, contained exclusively images, but many of them would be considered to be highly sensitive including video of surgeries. The names and hospital numbers of the 3,600 relevant patients are also apparent from the directory and file naming systems. The drive apparently went missing when an employee was moving offices. Because it was not a "portable" drive, the data was not encrypted.

See: Missing hard drive had thousands of patient images - Calgary - CBC News.

Is university faculty e-mail subject to access and privacy laws?

Dan Michaluk has just blogged about an interesting case out of Alberta (University of Alberta v. Alberta (Information and Privacy Commissioner), 2011 ABQB 100) that may have a significant impact on freedom of information law, particularly in universities. It will also have an impact on cloud computing decisions by universities. The Canadian Association of University Teachers takes the position that faculty e-mail are not under the "custody and control" of the educational institution. If this is found to be the case, faculty e-mail is not within the ambit of access to information laws at all and the privacy protection provisions of those laws. And, if that's the case, such e-mails are not covered by laws that are meant to regulate the export of personal information (out of fear of the USA Patriot Act). Stay tuned ....

See Dan's post: Alberta Court set to Hear Faculty E-mail Case « All About Information

Amendments to PIPA tabled, including breach notification and regulation of export of personal information

Yesterday (October 27, 2009), the Alberta Government introduced Bill 54, the Personal Information Protection Amendment Act, 2009. The Bill includes notification requirements for export of personal information to a service provider outside of Canada and breach notification.

The principal export provision is:

Notification respecting service provider outside Canada

13.1(1) Subject to the regulations, an organization that uses a
service provider outside Canada to collect personal information
about an individual for or on behalf of the organization with the
consent of the individual must notify the individual in
accordance with subsection (3).

(2) Subject to the regulations, an organization that, directly or
indirectly, transfers to a service provider outside Canada
personal information about an individual that was collected
with the individual’s consent must notify the individual in
accordance with subsection (3).

(3) An organization referred to in subsection (1) or (2) must,
before or at the time of collecting or transferring the
information, notify the individual in writing or orally of

(a) the way in which the individual may obtain access to
written
information about the organization’s policies and
practices with respect to
service providers outside
Canada, and

(b) the name or position name or title of a person who is
able to answer
on behalf of the organization the
individual’s questions about the
collection, use,
disclosure or storage of personal information by service
providers outside Canada for or on behalf of the
organization.

(4) The notice required under this section is in addition to any
notice required under section 13.

Permitted "as required by law" disclosures are now limited to required by Canadian or Alberta law.

The breach notification provisions require notice to the Commissioner and the Commissioner may order that individuals be notified.

I'm sure we'll be hearing more about this. Here's an extract from yesterday's Hansard:

ISYSweb 8 Search Results for Bill 54

Bill 54

Personal Information Protection Amendment Act, 2009

Mr. Denis: Thank you very much, Mr. Speaker. I rise to introduce
Bill 54, the Personal Information Protection Amendment Act, 2009.
Mr. Speaker, this bill is a direct result of the hard work of the
SelectSpecialPersonalInformation Protection ActReviewCommittee,
an all-party special committee of the Legislature that in 2006
undertook a complete review of the act and tabled a report to the
Legislature in November 2007 outlining recommendations for
amendments. This bill incorporates a number of their proposed
amendments.The main proposals for change include emerging issues such as
notifying the commissioner or individuals about security breaches
that place personal information at risk and informing individuals
when services involving personal information are occurring outside
of Canada. Mr. Speaker, as required for any new legislation in a
rapidly evolving area, this bill also does some updating and finetuning
of the existing provisions of this act.

Thank you very much, Mr. Speaker.

[Motion carried; Bill 54 read a first time]

The Speaker: The hon. Government House Leader.

Mr. Hancock: Thank you, Mr. Speaker. I move that Bill 54 be
moved onto the Order Paper under Government Bills and Orders.

[Motion carried]