Office of the Privacy Commissioner of Canada

1
Office of the Privacy Commissioner of Canada
University of Toronto Health Law Day Friday, May
20, 2005
2
Genetic Information the Law Issues in the
Insurance and Employment Settings Privacy
Issues Patricia Kosseim, General
Counsel pkosseim_at_privcom.gc.ca
3
Genetic Information ?
18
4
Under PIPEDA

• Personal information is information about an
  identifiable individual, but does not include the
  name, title or business address or telephone
  number of an employee of an organization

5
Consent (Principles 4.3.4 4.3.7)

• In determining the form of consent to use,
  organizations shall take into account the
  sensitivity of the information. Although some
  information is almost always considered to be
  sensitive, any information can be sensitive
  depending on the context Organizations should
  generally seek express consent when the
  information is likely to be considered sensitive.
  Implied consent would generally be appropriate
  when the information is less sensitive

6
Safeguards (Principle 4.7.2)

• The nature of the safeguards will vary depending
  on the sensitivity of the information that has
  been collected More sensitive information should
  be safeguarded by a higher level of protection.

7
Under PHIPA

• Personal health informationmeans identifying
  information about an individual in oral or
  recorded form, if the information,
• a) relates to the physical or mental health of
  the individual, including information that
  consists of the health history of the
  individuals family,
• e) relates to the donation by the individual of
  any body part or bodily substance of the
  individual or is derived from the testing or
  examination of any such body part or bodily
  substance

8
Legislative Evolution

• THE PAN-CANADIAN
• HEALTH INFORMATION PRIVACY AND CONFIDENTIALITY
  FRAMEWORK
• does not propose a separate or exceptional
  legislative vehicle to govern genetic information
  but views genetic information as a component of
  personal health information.
• January 27, 2005

9
PIPEDA Scope

• The Act extends to personal information of
  employees in connection with federal works,
  undertakings or businesses
• Note, all other employee information continues to
  be governed by applicable provincial laws, where
  they exist

10
PIPEDA Scope (cont)

• PIPEDA covers all personal information collected,
  used or disclosed in the course of commercial
  activity which occurs
• Across provinces
• Within provinces, except where there is
  substantially similar legislation in place

11
PHIPA Scope

• PHIPA applies to the collection, use and
  disclosure of personal health information by
  health information custodians (HICs)
• It also applies to non-HICs by restricting the
  use and disclosure of any personal health
  information they receive from HICs

12
Where PIPEDA now meets PHIPA
HICs non-HICs in Ontario private sector
Intra-provincial HICs non-HICs in public
sector
Inter-provincial Commercial activity
13
PHIPA Exemption application

• Any HIC to which PHIPA applies would be exempt
  from PIPEDA in respect of collection, use and
  disclosure of personal information that occurs
  within the Province of Ontario

14
Where PIPEDA will meet PHIPA
Non-HICs in Ontario private sector
Inter-provincial commercial activity
Intra-provincial HICs in private public
sectors non-HICs in public sector
15
Concrete Examples

• Collection
• Disclosure
• Access

16
PIPEDA Weber

• Erwin Eastmond and Canadian Pacific Railway and
  Privacy Commissioner of Canada, 2004 F.C. 852

17
PIPEDA Complaints

• OPC receives or initiates complaints conducts
  investigations encourage resolution through
  persuasion, mediation or conciliation issues
  non-binding report of findings to parties
• Investigation is confidential, but Commissioner
  may publicize an organizations information
  practices if considers it in the public interest
  to do so

18
Court Hearing section 14

• Complainant may request court hearing within 45
  days of having received Commissioners report
• Purpose is to review the organizations practice
  not the Commissioners findings

19
Court Hearing section 15

• Role of the Privacy Commissioner
• De novo proceeding
• Judicial deference to Commissioners findings vs.
  due regard to Commissioners expertise

20
Court Remedies section 16

• Order an organization to correct its practices in
  compliance with ss. 5 to 10
• Order the organization to publish a notice of
  action taken, or to be taken, to correct its
  practices
• Award damages to the complainant, including
  damages for humiliation

21
Judicial Review

• Judicial review application as per s. 18.1
• possible grounds for review
• standard of review jurisdictional error

22
New Era of Privacy

• PIPEDA Legislative Review in 2006