BCSC puts limits in on the powers of the Privacy Commissioner

Economical Mutual Insurance Company v. British Columbia (Information and Privacy Commissioner)2013 BCSC 903

As a general rule, when the Office of the Information and Privacy Commissioner makes an order, the order will usually include a requirement for the respondent (i.e. the person who breached the Personal Information Protection Act (the “PIPA”) to implement proper privacy policies. In other words, the Commissioner may make orders that apply to people who have not made complaints. Respondents, eager to save money and move on, will generally accept the order without question. But what if the order has a wide-ranging impact on the respondent’s business operations?

This case concerned the Privacy Commissioner’s order on a complaint by a homeowner seeking to renew an insurance policy. Insurance companies apparently use an insured’s Canadian Property Loss Score (“CPLS”) to assess a person’s risk. The CPLS includes information from the applicant’s credit report.

When the complainant found out that the insurer had used information from his credit report, he complained to the Privacy Commissioner that he had not consented to the use of that information. The Privacy Commissioner found that the insurer’s collection and use of the CPLS were for a reasonable purpose, but held that the insurer failed to obtain proper consent. The Privacy Commissioner ordered the insurer to review all of its client files to determine whether consents had been given by all policyholders. The insurer, concerned about the cost of that undertaking, applied to have that part of the order set aside.

The Court held that the Privacy Commissioner had breached the duty of procedural fairness by imposing orders that applied to other policyholders and by failing to give the insurer an opportunity to make submissions on those remedies. The Court found the order to be outside the scope of the issues before the Commissioner. Although the complaint raised issues applicable to all policyholders, the consent of other policyholders was not an issue and there was no evidence before the commissioner about the consent of other policyholders.

As we discussed in our last Strata Alert, privacy complaints against strata corporations and property managers are increasingly common. Although judicial review of privacy orders is rare (mainly because of the cost) Councils responding to privacy complaints should give careful thought to the issues raised by the complaint, and evidence they wish to put forward.

WHAT WE DO: Lesperance Mendes Lawyers advises strata corporations, owners and property managers on a wide range of bylaw enforcement matters including privacy complaints. To find out more about our legal services, contact: Paul G. Mendes by email at pgm@lmlaw.ca or by phone at 604-685-4894.

Lesperance Mendes Lawyers
900 Howe St #550, Vancouver, BC V6Z 2M4
(604) 685-3567