PIPEDA Review II: Private Right of Action?

In Ottawa, there’s talk of an election. From a privacy perspective, this raises questions not only about the fate of Bill C-29 (PIPEDA amendments) but also the anticipated-later-this-year second review of PIPEDA. Even if there isn’t an election, no one knows for sure about the timing of the enactment of C-29 in relation to the review. It’s even possible that the enactment of C-29 might wait to see what further changes could be incorporated as a result of the review. But what should the second review address?

The federal Privacy Commissioner has suggested in one speech that she’d like the power to fine.  Leaving aside technical language changes, we should be thinking about what else should make the list.

In the United Kingdom, the Conservative – Liberal Democrat coalition government has recently released a new piece of legislation: the “Protection of Freedoms” Bill 2010-2011. Coalition politicians claim the bill, expected to get Royal Assent in early 2012, would restrict “state intrusion” in people’s lives and restore “civil liberties”.  Since privacy is closely linked with civil liberties, the bill caught my eye.

The Bill is not without criticism and a good representation of that may be found here. Essentially, the legislation has been is characterized as “a list of legislative pet hates, many introduced by New Labour, that the coalition wants to do away with”.

As we think about a PIPEDA review, anything of use for Canada in these “pet hates”?  Not a lot but one notion does stand out.Some of the UK proposals are good: previous convictions for consensual gay sex will be erased (think “right to forget” in privacy terms) and children in schools will no longer be fingerprinted without parental approval.  But the one thing that does provoke further consideration is that private use of CCTV cameras will fall under a statutory code of conduct, with citizens able to apply for a judicial review if they believe CCTV is being used inappropriately. Paradoxically and in addition, there is also to be a Surveillance Commissioner to provide oversight for the new rules.

Private use of CCTV would fall under Canadian privacy legislation and there is an interesting example of the application of privacy law to CCTV use in this BC Privacy Commissioner Order from 2009. You also have the 2004 decision of Eastmond v. Canadian Pacific Railway & Privacy Commissioner of Canada.

But what I like about one aspect of the UK legislative proposal is that it puts the matter into the hands of citizens by permitting applications for judicial review.

While doing it in different ways, Privacy Commissioners in this country have been at the forefront of privacy protection and are to be commended for their efforts. But Privacy Commissioners also represent potential “chokepoints”. If you have an indifferent Privacy Commissioner or if funding flags, then resources get either underutilized or stretched and, sooner or later, things will fall between the cracks. For PIPEDA enforcement, I’m not suggesting the Office of the Privacy Commissioner of Canada (“OPC”) not do what it does but a legitimate question does exist as whether it should be the only route to follow for those with privacy complaints. Consider this a “don’t-put-all-your-eggs-in-one-basket” point.

While I doubt anyone would complain about Jennifer Stoddard’s work, she won’t be there forever. And if you think I’m paranoid about the potential for a less than stellar Privacy Commissioner — just think back to her predecessor, George Radwanski.

If the UK wants to enable citizens to directly protect their privacy where CCTV is concerned — by making an application for judicial review — why shouldn’t we do the same in Canada? Except instead of an application for judicial review, why not a private right of action in PIPEDA?

Statutory tort statutes for breach of privacy exist in British Columbia, Manitoba, Saskatchewan and Newfoundland so precedents for a privacy-related private right of action do exist. Financing a lawsuit isn’t for the faint-hearted so potential abuse doesn’t strike me as a reason not to consider such a proposal. This may be a great or terrible idea but a little outside-the-box thinking and discussion can’t hurt. So, maybe it’s time to consider adding a private right of action to PIPEDA – even if it only stimulates discussion about what should be considered in PIPEDA Review II.