Submission to the OPC’s Consultation on Consent under PIPEDA (CREA)

Canadian Real Estate Association

October 2016

Note: This submission was contributed by the author to the Office of the Privacy Commissioner of Canada’s Consultation on Consent under PIPEDA.

Disclaimer: The opinions expressed in this document are those of the author(s) and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada.

---

Summary

CREA strongly supports the current approach to the protection of personal information as it applies to the private sector in Canada, which is based on individual consent. The current principle-based approach has been successful in balancing the privacy interests of individuals with the legitimate needs of business.

Full submission:

Note: As this submission was provided by an entity not subject to the Official Languages Act, the full document is only available in the language provided.

To Whom It May Concern,

The Canadian Real Estate Association (CREA) is pleased to make the following submission in response to the Office of the Privacy Commissioner of Canada (“OPC”) discussion paper on consent and privacy (the “Discussion Paper”). CREA has read and understands the consultation procedures described on the OPC website. The comments contained herein are relevant to the OPC as well as the government.

About CREA

CREA is one of Canada's largest single industry trade associations, representing more than 114,000 REALTOR® members working through various real estate Boards and provincial/territorial Associations. Among other things, CREA represents the interests of its members to the federal Government and its agencies on existing or proposed legislation and consultations that will affect those members, and/or impact homeownership. In particular, CREA has consulted with the Government on new and proposed privacy legislation and guidance going back to the creation and adoption of the Personal Information Protection and Electronic Documents Act (PIPEDA) in 2001.

CREA and its REALTOR® members are keenly aware of the importance Canadians place on their privacy. Respect for the protection of clients’ personal information is essential to the success of the real estate profession.

CREA’s involvement in privacy issues includes its intervention in the case brought by the Commissioner of Competition against the Toronto Real Estate Board (TREB) in respect of TREB’s rules and policies applicable to Virtual Office Websites.^{Footnote 1} This case raised squarely the need to find an appropriate balance between the importance of reasonable and informed consent in order to protect privacy, and the desire to foster innovation and technological developments.

In the case before the Tribunal, CREA raised concerns about existing broad and non-specific consents not being sufficient for the publication over the Internet of current and historical sale prices of residential properties across Canada. The Tribunal did not share those concerns and found in favour of the Commissioner of Competition. The case is now under appeal and CREA has sought intervention status before the Federal Court of Appeal.

The Continued and Importance and Relevance of Consent

Consent is possibly the most important concept in the Personal Information Protection and Electronic Documents Act (PIPEDA) and the substantially similar provincial laws in Alberta, British Columbia and Quebec. CREA believes that consent is central to ensuring that individual Canadians have control over how their personal information is collected, used and disclosed.

The Discussion Paper highlights some legitimate challenges in how consent is operationalized in a world that is increasingly shaped and dominated by new technologies and information flows. However, these developments in no way diminish the importance of consent. PIPEDA was created at the onset of the Internet-based economy, and the drafters of PIPEDA had the foresight to anticipate the changes that would come. The principle-based approach is technologically-neutral, flexible, and proven just as relevant today as it was when it was originally drafted.

The OPC’s Policy Position on Online Behavioural Advertising is one example of a fair and balanced approach to consent applied to a technologically sophisticated environment.

Discussion Paper Questions

Please find below responses to a select number of questions posed in the Discussion Paper.

1. Of the solutions identified in this paper, which one(s) has/have the most merit and why?

As explained above, CREA strongly supports the current approach to consent in PIPEDA. There is no need, for example, to rewrite the rules or assume that individuals are incapable of understanding the consequences of their privacy-related choices. In particular, PIPEDA should not be revised to replace consent with vague and broader concepts such as “fairness” or “ethics”. While the motivation behind such concepts is laudable, such concepts are unworkable in reality.

1.1 Alternatives to Consent

CREA urges the OPC to exercise caution in pursuing proposals to replace consent with rigid rules defining what is and is not permissible under PIPEDA. Despite the challenges to making consent informed and meaningful, individuals Canadians remain in the best position to determine how their personal information should be collected, used and disclosed.

CREA does not believe that consent is or should be required for the collection, use or disclosure of de-identified information. Personal information that has been de-identified with no reasonable risk of re-identification is no longer personal information, and therefore not subject to PIPEDA. In this regard, collecting, using and disclosing de-identified data is not really an alternative to consent, but a reflection of the fact that PIPEDA only applies to personal information.

With respect to the concept of “no-go zones”, as made clear in the Discussion Paper, the OPC has ample authority under subsection 5(3) to set appropriate limits on a case-by-case basis (by way of a Commissioner’s finding or guidance) where consent is not appropriately obtained. PIPEDA should not be revised to establish specific no-go zones, which are vulnerable to becoming quickly outdated as new technologies are developed.

1.2 Governance – Codes of Practice

Industry-specific guidance and codes of practice are valuable tools that help ensure that businesses subject to PIPEDA obtain proper consent.

For example, CREA has developed a National Privacy Code for REALTORS® which educates REALTORS® on their privacy obligations.^{Footnote 2} CREA has also published FAQs for its members on its intranet, REALTOR Link®, on common privacy issues and publishes blog posts on new and emerging privacy matters as they arise.

The OPC also plays a crucial role in the development of industry guidance.^{Footnote 3} However, more can be done. In particular, the OPC should make itself available to assist industry associations, such as CREA, in providing effective guidance to its members through opinions and advance rulings on specific use cases, where necessary. If the OPC is of the view that it lacks the authority to do so, then it should seek an amendment to PIPEDA to obtain such authority.

1.3 Governance – Privacy Trust Marks

The notion of a “privacy trust mark” has merit, particularly if it can provide a cost-efficient and convenient way of improving regulatory compliance and business certainty.

However, such an approach should be voluntary, as is the case with the TRUSTe program in the United States. There are many ways for businesses to satisfy their privacy obligations and imposing one solution places unnecessary costs on businesses that choose an alternative method of doing so. Similarly, there should be opportunity for multiple trust marks to operate in the marketplace.

I would be happy to discuss any of our comments noted herein with you in further detail.

Sincerely,

Gary Simonsen
Chief Executive Officer