Oct 8, 2020

A decision by the Québec Access to Information Commissioner highlights the importance of compliance with both ‎federal and provincial privacy legislation

D’Allaire c. Transport Robert (Québec) 1973 ltée, 2020 QCCAI 152 (CanLII)

The Commission d’accès à l’information du Québec (Québec Access to Information Commissioner) has issued an interesting decision. An ‎interprovincial trucking company received an access request from a former employee for various employment-related records, including her personnel ‎file. The company took the position that its activities fall under federal jurisdiction and, thus, it is subject to the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) (not to ‎the Québec private sector privacy legislation, namely the Act respecting the protection of personal information in the private sector). The Commission found that notwithstanding that PIPEDA addresses the collection, use ‎and disclosure of personal information by federally-regulated businesses, the Québec private sector privacy legislation nonetheless ‎applied as well, and the Commission had jurisdiction to decide the matter.‎

Section 26(2)(b) of PIPEDA provides that if satisfied that legislation of a province that is substantially similar to PIPEDA applies to an ‎organization, the Governor in Council may exempt the organization from the application of PIPEDA in respect of the collection, use or ‎disclosure of personal information that occurs within that province.‎

The Québec private sector privacy legislation has been deemed substantially similar to PIPEDA, Québec organizations that are provincially regulated are thus exempt from PIPEDA to the extent that the federal legislation applies within ‎the province. However, by its own terms, PIPEDA will still apply to federally-regulated businesses, such as an interprovincial trucking ‎company. The usual approach taken by privacy commissioners in Canada is that if PIPEDA applies to an organization, provincial ‎commissioners will step back and the Privacy Commissioner of Canada will deal with complaints relating to that organization, under ‎PIPEDA. The Commission d’accès à l’information du Québec clearly has decided not to take that approach.

The British Columbia Personal Information Protection Act ("PIPA") expressly states (see s. 3(2)(c)) that it does not apply to the collection, use or disclosure of personal information, if the federal Act (i.e. PIPEDA) applies to the collection, use or disclosure of the personal information.

Alberta PIPA does not go this far, but states that if Alberta PIPA is found to be “in conflict” with another enactment, the provision of Alberta PIPA will prevail, unless the other enactment expressly provides that the other Act or a regulation, or a provision of it, prevails notwithstanding Alberta PIPA. Since PIPEDA provides that it applies to every organization in respect of personal information that the organization collects, uses or discloses in the course of commercial activities, and also provides (through an Order of the Governor in Council and section 26(2)(b) of PIPEDA) that Alberta PIPA applies “within the Province of Alberta”, and given the doctrine of federal paramountcy and the fact that a province does not have constitutional authority to exclusively pass legislation which governs a federally-regulated business, it would seem to follow that PIPEDA, by its terms, applies to federally-regulated businesses, such as an interprovincial trucking company, even when the company is operating within and without the Province of Alberta, rather than Alberta PIPA.

Accordingly, federally-regulated businesses will need to ensure that their collection, use or disclosure of personal information is ‎compliant with both PIPEDA and the Québec private sector privacy legislation, unless such businesses are prepared to challenge the ‎authority of the Commission d’accès à l’information du Québec to take jurisdiction over them. This is a salient point, given that the ‎Québec private sector privacy legislation does not expressly recognize the concept of prior notice to data subjects taking the place of ‎express consent, and requires that consent be "manifest, free and enlightened".‎

See: D’Allaire c. Transport Robert (Québec) 1973 ltée, 2020 QCCAI 152‎