PIPEDA: A CONSTITUTIONAL ANALYSIS - Goodmans

More documents

Recommendations

Info

320 THE CANADIAN BAR REVIEW [Vol.85 The “adequacy” of the level of protection afforded by a third country is assessed in light “of all the circumstances surrounding a data transfer operation or set of data transfer operations.” 22 Particular consideration is given to the nature of the data; the purpose and duration of the proposed processing operation or operations; the country of origin and final destination; and the laws, professional rules, and security measures that are in force within the third country. The Directive also allows for “derogations” from the transfer requirements to third countries in certain circumstances. Under Article 26, Member States may transfer personal data to a third country which does not ensure an adequate level of protection if, among other reasons enumerated in the section, the data subject has given unambiguous consent to the proposed transfer, the transfer is necessary on public interest grounds, or the transfer is necessary for the performance of a contract between the data subject and the controller or between the controller and a third party. 23 Furthermore, under Article 26(2), data may be transferred if the controller adduces adequate safeguards (usually in the form of contractual clauses) with respect to the protection of the privacy and fundamental rights and freedoms of individuals. Even where safeguards have been adduced by the controller, however, the third-party transfer is reviewable upon the objection of the European Commission or of any Member State. 24 C. Significance of the Directive to PIPEDA Canada has been approved by the European Commission as having adequate data protection under PIPEDA specifically, and can freely trade personal information with the European Union. As the Commission’s decision is binding on all Member States, States are significantly limited in their ability to suspend data flows to Canada on the basis that the country does not ensure adequate privacy protection. 25 The fact that the Directive restricts data transfer to third parties on a nation-by-nation basis is significant to the issue of PIPEDA’s constitutionality, and in particular, raises the question whether a 22 Ibid. Art. 25(2). 23 Ibid. Art. 26(1). 24 Ibid. Art. 26(3). Specifically, an objection may be made “on justified grounds involving the protection of the privacy and fundamental rights and freedoms of individuals.” The procedure for review of the proposed safeguards is set out in Art. 31(2) of the Directive. 25 T. Ling, M. Miasek, and A. Gates, “EU Says Canada Privacy Law ‘Adequate’” (January 2002), online: Baker & McKenzie Publications .
2006] PIPEDA: A Constitutional Analysis 321 successful constitutional challenge by Quebec will jeopardize Canada’s ability to trade personal information with European Union countries. The direct impact of the “third country” restriction will be addressed below in relation to the federal trade and commerce power. 3. The Personal Information Protection and Electronic Documents Act PIPEDA was enacted by Parliament in 2000, and was implemented in stages before fully coming into force on January 1, 2004. Parts 2 through 5 of the Act deal primarily with the use of electronic records in court, the electronic proliferation of federal publications, and doing business with the federal government electronically. These parts are not constitutionally suspect, and are therefore beyond the scope of Quebec’s challenge to the legislation. This challenge is limited exclusively to Part 1 of the Act. A. The Scope of Part 1 of the Act Subject to a limited number of exceptions, Part 1 applies to all organizations that collect, use or disclose personal information “in the course of commercial activities.” 26 It also applies to personal information about employees of organizations that collect, use or disclose such information in connection with the operation of a federal work, undertaking or business. 27 Part 1 thus does not apply to personal employee information that is collected, used or disclosed by a provincially-regulated employer. Neither does it apply to government institutions such as government departments or Crown Corporations that are governed by the federal Privacy Act; 28 to any individual that collects, uses or discloses personal information purely for personal or domestic purposes; or to any organization that collects, uses or discloses personal information exclusively for journalistic, artistic, or literary purposes. 29 “Personal information” is defined under Part 1 as any information about an “identifiable individual,” except employee information such as the name, title, business address, or telephone number of an employee of an organization. 30 Similarly, personal information includes “personal 26 PIPEDA, supra note 1, s. 4(1)(a). 27 Ibid. s. 4(1)(b). This provision would apply to employees carrying out federallyregulated activities, such as banking, telecommunications, aeronautics, marine shipping, broadcasting, and interprovincial transportation; ibid. s. 2(1). 28 R.S. 1985, c. P. 21. 29 Supra note 1, s. 4(2). 30 Ibid. s. 2(1).
Page 1 and 2: PIPEDA: A CONSTITUTIONAL ANALYSIS J
Page 3: 2006] PIPEDA: A Constitutional Anal
Page 7 and 8: 2006] PIPEDA: A Constitutional Anal
Page 27: 2006] PIPEDA: A Constitutional Anal

PIPEDA: A CONSTITUTIONAL ANALYSIS - Goodmans

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?