Recent amendments to the PIPEDA: the Privacy Commissioner’s Discretionary Investigation Powers

/in /by

In order to improve internal operational efficiencies at the Office of the Privacy Commissioner (OPC) and to better serve Canadians, the Personal Information Protection and Electronic Documents Act (PIPEDA, the “Act”) has been amended. Some amendments have already been enacted, while others are forthcoming. The amendments are, in large part, a result of the five-year Parliamentary review of PIPEDA which is required by the Act.

We first reported on Bill C-28, which received Royal Assent on December 15th, 2010, in our Spring 2011 newsletter. Bill C-28 created a new regulatory regime to address online threats, such as spam and spyware. Two additional key amendments to PIPEDA were brought into force in April, 2011.

The Privacy Commissioner now has the discretionary power to decline to investigate a complaint, or to discontinue an investigation that is already underway.

Previously, the Commissioner was obligated to conduct an investigation of all written complaints that were filed with the OPC. Only under certain circumstances was the Commissioner allowed to decline to issue a report. Section 13(2) of the law set out the circumstances as follows:

(a) where an existing grievance or review procedure existed that the complainant should exhaust first;

(b) where other procedures existed that would be more appropriate for dealing with the complaint;

(c) where a report would not be useful, given the amount of time between when the complaint was filed and when the subject-matter of the complaint arose; and

(d) where the complaint was trivial, vexatious or made in bad faith.

Section 13(2) of the Act has been repealed and the Commissioner now has broader discretionary powers. The closing of a complaint can now be done in two scenarios:

1. where the Commissioner decides not to investigate, for the same reasons that existed under section 13(2); and

2. where the Commissioner decides to discontinue an investigation already underway, for the same reasons as set out in the former section 13(2).

The Commissioner’s discretion, however, has also been broadened to include additional circumstances, including:

  • where there is insufficient evidence;
  • where an organization has provided a fair and reasonable response;
  • where there is already an on-going investigation about the matter; and
  • where the matter has already been the subject of a report by the Commissioner.

The Commissioner also has the ability to reconsider the decision not to investigate where a complainant provides a convincing reason to do so. In the event of a discontinued complaint, a complainant can apply for relief under section 14 to the Federal Court.

In addition, the Commissioner is now empowered to enter into agreements with provincial privacy commissioners, as well as foreign authorities, in order to cooperate and share information. These amendments aim to increase the effectiveness of the OPC in dealing with

complaints. While the OPC previously had the ability to coordinate with provincial privacy commissioners, the new amendment extends this ability to foreign data protection authorities and permits the Commissioner to share information. Given that privacy issues can easily extend beyond borders, the amendments should enable the OPC to successfully address complaints involving cross-border data.

In addition to Bill C-28, the Parliamentary review of PIPEDA resulted in Bill C-29. We first reported on this Bill in our Fall 2010 newsletter. The Bill, which addresses the mandatory reporting of data breaches, personal information disclosure for the purposes of business transactions, and consent exceptions for employee information, died on the order paper earlier this Spring when the federal election was called. However, given the important subject matter, it is likely that these topics will be raised again in another Bill.

Bird Richard will continue to keep its readers apprised of further legislative developments.