PIPEDA governs how data is collected and used

For the London Free Press - August 9, 2010 Read this on Canoe

Case involves actions undertaken by insurer State Farm on behalf of a client

The Federal Court of Canada recently released an important decision on the parameters of "commercial activity" under the Personal Information Protection and Electronic Documents Act (PIPEDA): State Farm v Privacy Commissioner.

The act is a Canadian law relating to data privacy. It governs how private-sector organizations collect, use and disclose personal information in the course of commercial business.

The act defines commercial activity as "any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists."

In State Farm v Privacy Commissioner, the State Farm Mutual Automobile Insurance Co. questioned the privacy commissioner's jurisdiction to investigate a refusal to provide access to personal information and her power to compel the production of documents during the course of an investigation.

Specifically, it dealt with a situation where State Farm retained a private investigator on behalf of an insured person who had been sued by a motor-vehicle accident plaintiff. The private investigator conducted video surveillance on the plaintiff. The plaintiff sought access to the surveillance footage under the act.

The court concluded it would not be commercial activity for a defendant, herself, to collect evidence for the defence of a tort claim. There is no "commercial character" associated with that particular activity. The court then concluded that, because the primary characterization of the activity is not commercial, using a third party (such as an insurer, a law firm or a private investigator) to carry it out does not render it commercial.

"I conclude that, on a proper construction of PIPEDA, if the primary activity or conduct at hand - in this case the collection of evidence on a plaintiff by an individual defendant in order to mount a defence to a civil tort action -- is not a commercial activity contemplated by PIPEDA, then that activity or conduct remains exempt from PIPEDA even if third parties are retained by an individual to carry out that activity or conduct on his or her behalf. The primary characterization of the activity or conduct in issue is the dominant factor in assessing the commercial character of that activity or conduct under PIPEDA, not the incidental relationship between the one who seeks to carry out the activity or conduct and third parties."

In this case, the insurer-insured and attorney-client relationships are simply incidental to the primary non-commercial activity or conduct at issue, namely the collection of evidence by the defendant . . . in order to defend herself in the civil tort action brought against her.

In other words, the decision essentially says that if the act does not apply to something that X does, the fact that X hires someone else to do it (which is a commercial activity) does not turn that something into commercial activity for X, and thus does not make it subject to the Personal Information Protection and Electronic Documents Act.