Two recent complaints before the Office of the Privacy Commissioner of Canada have raised questions about the process for lawyers to obtain parties'' credit information during the litigation process.
The OPC recently found that two law firms, which weren't identified in the commissioner's finding, had collected individuals' credit information without their knowledge or consent, in breach of privacy legislation.
In the case, two parties were in litigation against one another and the law firms representing the two parties obtained a credit report on the other side. The OPC then received two complaints alleging that the law firms had collected their information without their knowledge or consent.
The assistant privacy commissioner found that both complaints were well-founded and that the law firms were in breach of the Personal Information Protection and Electronic Documents Act (PIPEDA). She recommended that the firms "implement a policy that prohibits conducting credit checks without appropriate consent, unless for a permissible purpose."
At first, in both cases, the firms declined to implement the recommendations. However, both firms later agreed to do so after being contacted by litigation counsel, which avoided the need for the OPC to proceed with an application in the Federal Court.
However, according to Mark Hayes, a partner at Blake Cassels & Graydon LLP and chairman of the privacy section of the Ontario Bar Association, the issue has raised some concerns. As a result of the summary nature of the findings, he adds that "part of our concern right now is we really don't know exactly what the reasoning was behind the decision."
In the two investigations, the Privacy Commissioner found that the "collection occurred during the course of the law firm's commercial activities" and that there was "no general exclusion for the activities of law firms undertaken on behalf of their clients."
The question of collection of information and PIPEDA was previously addressed in the 2004 Ontario Superior Court case Ferenczy v. MCI Medical Clinics, where Justice Fletcher Dawson ruled, "I conclude it is the correct interpretation of the act, is to apply the principles of agency. On this analysis it is the defendant in the civil case who is the person collecting the information for his personal use to defend against the allegations brought by the plaintiff. Those whom he employs, or who are employed on his behalf, are merely his agents."
Unlike those who collect information for commercial purposes, "agents" are not
subject to PIPEDA.
Hayes adds that without knowing the reasons behind the commissioner's decision, it is difficult to say whether the decision goes against that of Ferenczy.
"Part of the problem with Ferenczy is that there were a number of bases that the court in Ferenczy suggested for justifying the admission of the evidence, so a number of those bases were obiter and it may be that the commissioner doesn't feel that they're binding or persuasive.
"Certainly Ferenczy used several different bases but really only one of the bases was the actual ratio of the decision."
According to PIPEDA, an organization may collect personal information without the knowledge or consent of an individual only if "it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigation of a breach of an agreement or a contravention of the laws of Canada or a province."
In this case, the Office of the Privacy Commissioner concluded, however, that the information was not collected for any of the above reasons, "but rather to determine whether it was worthwhile to counterclaim against the complainant in litigation."
Hayes adds that part of the problem with credit reporting is that there are a number of legal regimes that may apply, such as PIPEDA, provincial legislation and contractual relationships between subscribers and credit reporting agencies.
"You've got to really balance at least three different legal regimes - a contractual regime, a provincial statutory regime, and a federal statutory regime - in order to try and determine what a lawyer can or cannot do in respect of credit reports and investigations in Ontario," says Hayes.
"In addition, as many lawyers in Ontario are aware, the practice of getting credit or financial reports on parties to litigation is quite common and has been going on for quite some time. So it is easy to understand why some lawyers might be confused about what their obligations are and what the restrictions are on obtaining this kind of information."
Bernice Karn, a partner with the information, communications and entertainment group at Cassels Brock & Blackwell LLP, says going forward, the findings of the Privacy Commissioner will likely be more of an issue for litigators than for anyone.
"I think you have to try to figure out if there's any other way you can assess whether it's worthwhile to pursue somebody," such as through other publicly available records.
Karn notes that, generally, consent is required for credit inquiries under consumer reporting legislation and "as far as day-to-day practices go, I think probably for most law firms it won't really affect them that much."
The OPC recently found that two law firms, which weren't identified in the commissioner's finding, had collected individuals' credit information without their knowledge or consent, in breach of privacy legislation.In the case, two parties were in litigation against one another and the law firms representing the two parties obtained a credit report on the other side. The OPC then received two complaints alleging that the law firms had collected their information without their knowledge or consent.
The assistant privacy commissioner found that both complaints were well-founded and that the law firms were in breach of the Personal Information Protection and Electronic Documents Act (PIPEDA). She recommended that the firms "implement a policy that prohibits conducting credit checks without appropriate consent, unless for a permissible purpose."
At first, in both cases, the firms declined to implement the recommendations. However, both firms later agreed to do so after being contacted by litigation counsel, which avoided the need for the OPC to proceed with an application in the Federal Court.
However, according to Mark Hayes, a partner at Blake Cassels & Graydon LLP and chairman of the privacy section of the Ontario Bar Association, the issue has raised some concerns. As a result of the summary nature of the findings, he adds that "part of our concern right now is we really don't know exactly what the reasoning was behind the decision."
In the two investigations, the Privacy Commissioner found that the "collection occurred during the course of the law firm's commercial activities" and that there was "no general exclusion for the activities of law firms undertaken on behalf of their clients."
The question of collection of information and PIPEDA was previously addressed in the 2004 Ontario Superior Court case Ferenczy v. MCI Medical Clinics, where Justice Fletcher Dawson ruled, "I conclude it is the correct interpretation of the act, is to apply the principles of agency. On this analysis it is the defendant in the civil case who is the person collecting the information for his personal use to defend against the allegations brought by the plaintiff. Those whom he employs, or who are employed on his behalf, are merely his agents."
Unlike those who collect information for commercial purposes, "agents" are not
subject to PIPEDA.
Hayes adds that without knowing the reasons behind the commissioner's decision, it is difficult to say whether the decision goes against that of Ferenczy.
"Part of the problem with Ferenczy is that there were a number of bases that the court in Ferenczy suggested for justifying the admission of the evidence, so a number of those bases were obiter and it may be that the commissioner doesn't feel that they're binding or persuasive.
"Certainly Ferenczy used several different bases but really only one of the bases was the actual ratio of the decision."
According to PIPEDA, an organization may collect personal information without the knowledge or consent of an individual only if "it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigation of a breach of an agreement or a contravention of the laws of Canada or a province."
In this case, the Office of the Privacy Commissioner concluded, however, that the information was not collected for any of the above reasons, "but rather to determine whether it was worthwhile to counterclaim against the complainant in litigation."
Hayes adds that part of the problem with credit reporting is that there are a number of legal regimes that may apply, such as PIPEDA, provincial legislation and contractual relationships between subscribers and credit reporting agencies.
"You've got to really balance at least three different legal regimes - a contractual regime, a provincial statutory regime, and a federal statutory regime - in order to try and determine what a lawyer can or cannot do in respect of credit reports and investigations in Ontario," says Hayes.
"In addition, as many lawyers in Ontario are aware, the practice of getting credit or financial reports on parties to litigation is quite common and has been going on for quite some time. So it is easy to understand why some lawyers might be confused about what their obligations are and what the restrictions are on obtaining this kind of information."
Bernice Karn, a partner with the information, communications and entertainment group at Cassels Brock & Blackwell LLP, says going forward, the findings of the Privacy Commissioner will likely be more of an issue for litigators than for anyone.
"I think you have to try to figure out if there's any other way you can assess whether it's worthwhile to pursue somebody," such as through other publicly available records.
Karn notes that, generally, consent is required for credit inquiries under consumer reporting legislation and "as far as day-to-day practices go, I think probably for most law firms it won't really affect them that much."
