The Supreme Court released its reasons Friday in an important appeal in which the Court had to decide whether citizens can demand disclosure of records located in the offices of the Prime Minister, Ministers of the Crown, the RCMP and PCO under the Access to Information Act. In Canada (Information Commissioner) v. Canada (Minister of National Defence), 2011 SCC 25, the Supreme Court ruled that none of the requested documents had to be disclosed. The ruling, however, by-passed an important opportunity to clarify the meaning of the term “personal information” in Canadian privacy legislation.
The documents in the possession of the PMO and offices of Ministers were held not to be in the control of a government institution and were therefore not subject to the Act. The Court held that the agenda of former Prime Minister Jean Chrétien in the possession of the RCMP and the PCO were under the control of a “government institution”. However, they were not subject to disclosure because 19(1) of the Access to Information Act prohibits the head of a government institution from releasing any record that contains personal information as defined in s. 3 of the Privacy Act. Section 3(j) of the Privacy Act creates an exception by allowing for the disclosure of personal information where such information pertains to an individual who is or was an officer or employee of a government institution and where the information relates to the position or function of the individual. The Supreme Court agreed with the Federal Court of Appeal that this exception did not apply as the Prime Minister could not be viewed as an officer of a government institution.
In rendering its decision the Supreme Court did not express any opinion as to whether the Prime Minister’s agenda, or parts thereof, were “personal information” as defined in s. 3 of the Privacy Act. It didn’t deal with the issue as the parties agree that the Prime Minister’s agenda fell within the general definition of personal information in the Privacy Act. That Act defines the term as meaning “information about an identifiable individual that is recorded in any form” and goes on to include a non-exclusive list of examples.
It is too bad that the issue of whether the Prime Minister’s agenda, or portions thereof, were personal information was conceded and not argued before the Court. The issue of what is personal information is one in which lower appellant courts have recently been focusing on.
For example, the Ontario Court of Appeal in Citi Cards Canada Inc. v. Pleasance, 2011 ONCA 3 recently held that financial information pertaining to a debtor, collected and used by a financial institution in the course of a mortgage transaction was personal information under PIPEDA. In its reasons for decision the Court stressed that the term was to be given “a very elastic definition”. According to the Court:
I also agree with the application judge that the information Citi Cards seeks from the Banks is “personal information” of the debtor. “Personal information” is defined in s. 2(1) of the Act. It “means information about an identifiable individual.”
This is a very elastic definition, and should be interpreted in that fashion to give effect to the purpose of the Act. There can be no doubt that financial information pertaining to a debtor, collected and used by a financial institution in the course of a mortgage transaction – including the particulars of, and the balance owing on the debtor’s mortgage – is “information about an identifiable individual.” Current mortgage balances are not information that is publicly available.
This information is collected and used by the Banks for purposes of administering the mortgage; it is not collected or used for purposes of facilitating another judgment creditor’s execution on its judgment. As the purpose of the Act – expressed in s. 3 cited above – indicates, what is balanced is the individual’s right to privacy in his or her personal information, on the one hand, and the organization’s need to collect or use the information, on the other hand. The Act does not contemplate a balancing between the privacy rights of the individual and the interests of a third-party organization that may by happenstance have commercial dealings with the individual that make the targeted information attractive to it.
The Alberta Court of Appeal recently also canvassed the scope of the term personal information in Leon’s Furniture Limited v. Alberta (Information and Privacy Commissioner), 2011 ABCA 94. Under the Alberta Personal Information Protection Act “personal information” is defined to mean “information about an identifiable individual”. In interpreting this definition the Court ruled that driver’s licence numbers were personal information but that vehicle licence numbers were not. The Court reached this conclusion reasoning that to fall within the definition information must directly identify the individual and have a precise connection to the individual and must relate to the individual and not to some object or property.
The “identifiable individual” term has two components. Firstly, the individual must be “identifiable”. Generic and statistical information is thereby excluded, and the personal information (here the relevant number) must have some precise connection to one individual. Secondly, the information must relate to an individual. Information that relates to objects or property is, on the face of the definition, not included. The key to the definition is the word “identifiable”. The Act is designed to regulate and protect information that is uniquely connected to one person. An important (although not the only) purpose of the Act is to control the use of information that would enable “identity theft”, that is, information that is used to distinguish one individual from another in financial and commercial transactions. This can be seen by reviewing the type of information that is dealt within the more specific provisions and exceptions in the Act. The definition is not primarily aimed at information about that individual’s opinions, choices and status in life.
Further, to be “personal” in any reasonable sense the information must be directly related to the individual; the definition does not cover indirect or collateral information. Information that relates to an object or property does not become information “about” an individual, just because some individual may own or use that property. Since virtually every object or property is connected in some way with an individual, that approach would make all identifiers “personal” identifiers. In the context of the statute, and given the purposes of the statute set out in s. 3, it is not reasonable to expand the meaning of “about an individual” to include references to objects that might indirectly be affiliated or associated with individuals. Some identification numbers on objects may effectively identify individuals. Many, however, are not “about the individual” who owns or uses the object, they are “about the object”.
The adjudicator’s conclusion that the driver’s licence number is “personal information” is reasonable, because it (like a social insurance number or a passport number) is uniquely related to an individual. With access to the proper database, the unique driver’s licence number can be used to identify a particular person: Gordon v. Canada (Minister of Health), 2008 FC 258 (CanLII), 2008 FC 258, 324 F.T.R. 94, 79 Admin. L.R. (4th) 258 at paras. 32-4. But a vehicle licence is a different thing. It is linked to a vehicle, not a person. The fact that the vehicle is owned by somebody does not make the licence plate number information about that individual. It is “about” the vehicle. The same reasoning would apply to vehicle information (serial or VIN) numbers of vehicles. Likewise a street address identifies a property, not a person, even though someone may well live in the property. The licence plate number may well be connected to a database that contains other personal information, but that is not determinative. The appellant had no access to that database, and did not insist that the customer provide access to it.
It is also contrary to common sense to hold that a vehicle licence number is in any respect private. All vehicles operated on highways in Alberta must be registered, and must display their licence plates in a visible location: Traffic Safety Act, R.S.A. 2000, c. T-6, ss. 52(1)(a) and 53(1)(a). The requirement that a licence plate be displayed is obviously so that anyone who is interested in the operation of that vehicle can record the licence plate. The fact that the licence plate number might be connected back to personal information about the registered owner is obvious, but the Traffic Safety Act nevertheless requires display of the licence plate. Control of that information is provided by controlling access to the database. It makes no sense to effectively order, as did the adjudicator, that everyone in the world can write down the customer’s licence plate number, except the appellant.
In summary, the adjudicator’s conclusion that a driver’s licence number is “personal information” is reasonable. The conclusion that a licence plate number is also “personal information” is not reasonable, and the adjudicator’s ruling must be set aside insofar as it dealt with licence plate numbers.
Had the Supreme Court addressed the personal information status of the various elements of the Prime Minister’s agenda, it might have used the occasion to expound upon the meaning of that term. But, given the procedural posture of the case, the Court was not required to do so.
