list of contributors - GALA

and, even amongst those who have implemented new legislation, there is still
not uniformity. For example, Ontario’s legislation takes a relatively neutral
approach to technology, and requires similar disclosure in most forms of
consumer agreements to what was agreed upon nationally with respect to
Internet agreements. Therefore, requirements for some types of contracts may
be more onerous in Ontario than in other provinces. Similarly, Ontario’s new
legislation allows consumers the remedy of credit card chargeback in the
context of any cancelled consumer agreement, not only Internet agreements as
has been enacted in some other provinces.
As a country, we have work to do to achieve harmonization with respect to
provincial consumer protection issues. In the interim, however, Ontario’s new
Consumer Protection Act, 2002 will likely have a significant impact on the
conduct and agreements of those engaged in consumer transactions in the
province.
2. Title Can you use publicly available commercial email addresses for unsolicited
marketing purposes?
Topic: Privacy Legislation
Where: Canada
When: December 2004
What Happened: An individual received unsolicited commercial email at his work email
address. When the complainant called the company that sent the email, he was
told that the email address was taken from his employer’s publicly available
website but that since he did not want to receive email from them he would be
removed from the list. About a month later the complainant received another
unsolicited commercial email, though from a different department of that
same company. That second department had obtained the email address
through the same means although a different website.
The complainant filed a complaint with the Canadian Privacy Commissioner
alleging a violation of the Personal Information Protection and Electronic
Documents Act (PIPEDA), Canada’s federal privacy legislation.
The Privacy Commissioner’s investigation revealed the truthfulness of the
facts as related by the complainant. When the Commissioner’s office spoke
with the employer, the employer submitted that email addresses were
“business information”, falling within the “business card” exception to
personal information under PIPEDA and that companies may thus use such
email addresses to contact employees for legitimate business reasons. The
employer conceded, however, that permission should be obtained prior to use
of the email address for any other purpose.
The Privacy Commissioner clarified that although PIPEDA does exclude the
name, title, business address and telephone number of an employee, email
addresses are not included in the list and are not within the “business card”
exception. Not falling within that exception, they are accordingly “personal
information” protected by PIPEDA. While the company and its employees, in
having the email addresses published, obviously consented to their being used
within a certain business scope, there was no consent for the use made, since it
was used outside of the scope for which it was made public.
Comments: This finding by the Privacy Commissioner is significant for two reasons.
First, it found that even information which is publicly available, if it is not
used for the purpose for which it was made public, is contrary to PIPEDA.