Submission to the OPC’s Consultation on Consent under PIPEDA (Stewart)

Blair Stewart (Assistant Privacy Commissioner, New Zealand Office of the Privacy Commissioner)

October 2016

Note: This submission was contributed by the author to the Office of the Privacy Commissioner of Canada’s Consultation on Consent under PIPEDA.

Disclaimer: The opinions expressed in this document are those of the author(s) and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada.

---

This short comment is offered in my role as an Assistant Privacy Commissioner to assist your researches with a perspective from another jurisdiction but to the extent that I offer any opinions, rather than merely share information on New Zealand law, those are purely my own personal opinions and do not purport to represent my Commissioner or the Office.

Normally I am reticent to engage in a consultation process concerning the domestic concerns of another country. However, your office was quite explicit in a last week’s meeting of privacy authorities from across the Asia Pacific that you welcome outsiders’ input. Nonetheless, I remain reluctant to say much beyond a short reflection on a difference between NZ law and Canadian on the matter you are reviewing.

My simple observation concerns terminology. The New Zealand Privacy Act does not refer to “consent” at all. Rather it refers to collection, use or disclosure of information that the individual concerned “authorises”.

Does the choice of words make a difference?

The view I’ve usually taken is that “to authorise” is an active formulation whereas “to consent” is a passive one. I tend to favour having the active formulation in a law intended to protect individuals.

For example, one can imagine an individual formulating his or her own authorisation—shaping its terms—and then pushing it out to the world. It is harder to conceive of consent in quite the same way – that seems to anticipate someone else proposing something and the individual agreeing or rejecting the proposition.  

Similarly, the idea of “implied” consent is quite common – usually to be inferred from the individual doing nothing at all, which is not very consumer-protective. By contrast the notion of “implied authorisation” seems a misuse of the English language to my ear – the word seems to call for some positive act, however small.  

I should add that I am approaching this only from a perspective of usual use of language – I am not seeking to assert a position from case law. If the point was considered important someone else would need to do the necessary legal research on how judges have interpreted the word in the cases brought before them.

In closing may I offer my congratulations on the production of a useful discussion paper that raises universal questions of interest beyond Canada’s borders. Even though I have ignored it in offering these comments I can see that the paper is a valuable addition to the literature on a concept that is fundamental to so much privacy discourse. Your office’s contribution to universal understanding will be further enriched when you report on the outcomes of your consultation process. I am sure that colleagues from beyond your shores will await the insights with almost as much interest as your Canadian stakeholders.

Regards, Blair Stewart