Cherry Picking Among Apples and Oranges : Refocusing Current Debate About the Merits of the Ombuds-Model Under PIPEDA
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
Jennifer StoddartFootnote 1
Privacy Commissioner of Canada
October 2005
Abstract
In 2000, the Parliament of Canada passed a new personal information protection law for the private sector based on the existing public sector model.
As the first federal private-sector privacy legislation, PIPEDA has received much scrutiny. One of the most remarked-upon features of PIPEDA has been the choice of ombuds-model for the Privacy Commissioner.
This paper recalls the conceptual nature and characteristics of the ombuds-model, and comments on the seeming mismatch between the integral aspects of that model and contrasting types of regulatory controls governments are "expected" to wield over "nefarious" private sector activity. In an attempt to facilitate understanding, I will elaborate on four central themes around which much of the confusion appears to revolve in debates about the appropriate administrative model of PIPEDA: flexibility, procedural fairness, transparency and effectiveness.
Introduction
The concept of an ombudsman, at least as we understand it today, has its roots in the justiteombudsman (ombudsman for justice) office created in 1809 in Sweden. Footnote 2 The office of the ombudsman, in this form, may be described as:
…a mechanism that monitors the conduct of public administration to ensure that it is conducted legally and fairly. The ombudsman is usually a single individual, but occasionally the institution may comprise a number of persons. An ombudsman is usually appointed by the legislative branch of government to investigate the administrative activities of the executive… Footnote 3
After its introduction in 1809, the ombuds-model evolved into a variety of forms, though at its root it remains "focused first and foremost on the protection of certain values, values of equity and accountability." Footnote 4 It has continued to serve as a critical mechanism for governments to regulate themselves and be held accountable for their actions. In Canada, several provinces have instituted dedicated ombuds offices to ensure fairness and accountability in the general administration of their public bodies and the provision of services to the people whom they serve. Footnote 5 At the federal level, the ombuds-model has been adopted to monitor specialized areas of government activity. For example, the Offices of the Commissioner of Official Languages, the Access to Information Commissioner and the Privacy Commissioner were specifically designed as ombuds offices to oversee the federal government's compliance with its obligations under the Official Languages Act, Footnote 6 the Access to Information Act Footnote 7 and the Privacy Act, Footnote 8 respectively.
In more recent years, the ombuds model has been adopted by the private sector as a mode of self-regulating the quality and fairness of its own client services. In the financial services sector, for instance, ombuds persons serve as in-house complaints officers for individual companies; complainants not satisfied with the response given by their financial service provider can refer the matter to the Ombudsman for Banking and Financial Services that serves an ombuds-like function for the industry. In a 1999 Discussion paper, the Canadian Ombudsman Association questioned whether these emerging bodies, particularly in private sector organizations, meet the test of independence and impartiality required of an ombudsman. Footnote 9 Nonetheless, what we see as unifying characteristics of the ombuds-model generally, across all of its various applications, has been described by Carolyn Steiber as follows:
Common threads run through the conceptual fabric of every ombudsman's office — all aim to humanize administration, to support fairness, accountability, and equity. All ombudsmen can be approached in confidence. No ombudsman has enforcement or disciplinary powers. All depend on the power of persuasion, as well as the credibility of the office which leads individuals to trust it. Although the process in achieving objectives of fairness and accountability may differ, the product is the same: a chance for ordinary people, those without power, to be heard and to get fair treatment. Footnote 10
When the Personal Information Protection and Electronic Documents Act Footnote 11 (hereinafter, "PIPEDA") came to pass in 2000, the policy choice was made to adopt the same ombuds-model as was used to administer the Privacy Act. Footnote 12 As a result, the Privacy Commissioner is vested with the powers and duties of an ombudsman in overseeing the information management practices of private sector organizations covered by the Act.
For instance, under section 11 of PIPEDA, the Commissioner is mandated to launch investigations on receipt of complaints; she is also granted the power to initiate her own complaint where there are reasonable grounds to do so. Under section 12, the Commissioner is granted extensive powers to investigate complaints, including the authority to attempt to resolve complaints by means of dispute resolution mechanisms. Under section 13, she is mandated to prepare and deliver a report outlining her findings, recommendations, any settlement reached by the parties, or otherwise, and further recourse available to the complainant. Finally, under section 25, the Commissioner must report to the government and legislature on the activities of the Office.
Indeed, these powers and functions constitute the hallmark characteristics of the ombudsman role. As Reif explains:
An ombudsman has the power to launch investigations on receipt of a complaint or on her own motion, conduct an impartial investigation into the administrative conduct in question, make recommendations to eliminate the illegality or unfairness if faulty administration is found, and report to the government and legislature on the activities of the office. Footnote 13
Though typically characteristic of an ombudsman office, the Privacy Commissioner's powers and duties under PIPEDA are quite unique in their application. Whereas the ombudsman model has traditionally been employed by governments to regulate public administration, PIPEDA represents a novel application of the ombuds-model by government as a means of regulating private sector activity. And, unlike the use made of the ombuds-model by private sector organizations to regulate themselves individually or collectively by industry, the ombudsman role envisaged by PIPEDA extends to all private commercial activity, across a wide variety of sectors and industries.
Given the novelty of this approach, it is perhaps unsurprising that the adoption of the ombuds-model to oversee PIPEDA has given rise to misunderstanding. This misunderstanding seems to be rooted in a fundamental mismatch between the conceptual nature and characteristics of the ombudsman role and the regulatory-type controls governments are expected to wield over "nefarious" private sector activity.
As Howard Gadlin has remarked, "[a]lthough the study and practice of negotiation and dispute resolution have grown enormously over the past thirty years, the ombudsman is arguably the least well understood part of this field." Footnote 14 Throughout the remainder of this paper, I will elaborate on four central themes around which much of the confusion appears to revolve in current debates about the use of the ombudsman model in administering PIPEDA. These themes are: flexibility, procedural fairness, transparency and effectiveness.
I. FLEXIBILITY
a. Structure of the Act
In PIPEDA's early days, criticism of the Act focused on the structure itself and critiqued what was seen as an overly general focus. Teresa Scassa, for instance, noted two issues of generality that she saw as inherently problematic for PIPEDA: "first, it is not a model in which more detailed or sector-specific, formalized elaboration of the law is provided for, either through regulation-making or through the mechanism of formal approval of sectoral codes. Second, the incorporation of the Canadian Standards Association ( CSA ) Code in its entirety introduced into the law a further level of generality." Footnote 15
More recently, John Lawford has raised similar concerns, arguing that "standards may work as the basis for regulation under an act, but their non-prescriptive nature makes them a poor fit for the prescriptive requirements of an act." Footnote 16
Calls for greater specificity of language and more prescriptive requirements seem to be at complete odds with a scheme based on the ombuds approach to resolving disputes. Flexibility is key to the proper functioning of an ombudsman. Indeed, flexibility is an essential feature of the Privacy Commissioner's role and an integral theme throughout PIPEDA itself.
The very purpose of PIPEDA is to establish in light of modern information technology:
rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the needs of organizations to collect, use and disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances. Footnote 17
This has been colloquially referred to as a "balancing" clause, but the term is not an entirely apt one. Unlike an adjudicative mode of enforcement, where the appropriate balance would be determined by a judge through an adversarial process based on the application of prescriptive standards and a determination of who's right and who's wrong, the ombuds-model envisaged in PIPEDA enables the Privacy Commissioner to assist individuals and organizations in arriving at an appropriate balance so that the needs of all are met and respected through consensus.
As Stephen Owen notes, one of the benefits of the consensual resolution model is that "because various interests will value aspects of a public issue differently, resolution packages can be crafted to satisfy each party's major concerns while trading off less vital ones." Footnote 18
Yet, even before the Privacy Commissioner becomes involved in the resolution-making process, the inherent flexibility of the CSA Code in PIPEDA enables individuals and private sector organizations to resolve potential conflicts themselves through the application of general fair information principles to specific fact situations. Through its principles, PIPEDA offers the necessary tools and guidance of a self-correcting scheme. Private sector organizations are called upon to have in place the accountability structures, policies and practices for responding to and dealing with privacy complaints from individuals. For their part, individuals are empowered to challenge compliance by organizations and to seek corrective measures in accordance with the spirit and intent of the CSA principles. As Colin Bennett has recognized,
The innovation of including a certifiable standard within the body of the statute was deliberately intended to provide a built-in mechanism for self-regulation. A standard is more than a code of practice, because it also embraces a common conformity assessment methodology, by which compliance can be independently and regularly tested. Footnote 19
The very structure of PIPEDA, especially the inclusion of the CSA Code and validation of its principled methodology based on flexibility, would seem to be wholly appropriate and consistent with the ombuds-model.
b. Commissioner's Findings
Part of the Privacy Commissioner's role as an ombudsman, as we have seen, is to investigate the subject matter of disputes and report on her findings and recommendations, all with a view to assisting parties at arriving at consensual resolution. Critics have argued that the Privacy Commissioner's practice of releasing only anonymized and abbreviated summaries of cases makes it impossible to develop a coherent body of emerging norms for interpreting and applying PIPEDA. For instance, Berzins suggests that:
The reliance on complaint summaries prevents parties from obtaining a detailed understanding of the approach taken by the Commissioner in individual cases, and the problem is exacerbated by the refusal to link investigation findings to other cases involving similar issues, including investigations involving the very same respondents. Footnote 20
But once again, this criticism must be considered in light of the very nature and purpose of the ombuds-model, as opposed to what one expects to find in an adjudicative model typically governing private sector activity. The call for the development of precedents is rooted in a traditional, rule-bound analysis. Yet, it must be realized that the ombuds-model is not one which results in normative precedents that will necessarily be binding on all future parties in similar circumstances. Such a form of stare decisis would obviate some of the essential underpinnings of an effective ombuds-model. In order for this latter model to work, parties must come to the process secure in the knowledge that their individual circumstances will be addressed and confident that they can participate in, and help drive the outcome towards their own negotiated resolution. As Owen has pointed out:
[I]t is essential that all significant interests voluntarily involve themselves in the process through the participation of an authorized representative. Each party must believe that its particular interest will be better served by a negotiated settlement than by an imposed one. If any one party believes it can win a dispute outright, judicially or politically, the process will fail. The process requires each party to define its objective in positive terms. By thinking in terms of what it wants to achieve, each group becomes better disposed to accommodating apparently competing interests by concentrating on creative ways of reconciling them. Footnote 21
It must be underscored that the ombuds-role is not simply remedial, but transformative in nature. The aim is the resolution of individual complaints, but it is also the development of a lasting culture of privacy sensitivity among the parties through their willing and active involvement in the process itself. In order to achieve these twin goals, the process must necessarily be flexible, participative and individuated in its approach. To pre-determine the solution based on precedents of what other parties have negotiated as appropriate and workable for them in different -- and even similar -- circumstances, would be at odds with this approach, completely circumventing its aims. Owen has crystallized it best in the following excerpt from his seminal article describing the major characteristics of the ombuds-model:
Fundamentally, consensual resolution is a reasoning process rather than a coercive one; as such, it is immensely more powerful. A reasoning process stimulates a voluntary change in the way of thinking which endures to the benefit of all parties in the future. By building understanding and respect among the parties, it generates productive energy. Footnote 22
II. PROCEDURAL FAIRNESS Footnote 23
As a non-adjudicative body, the Privacy Commissioner is not subject to formal rules of natural justice. Some have leaped to the conclusion that this means there is no assurance of fair and due process. For instance, Lawford has suggested that,
[a]s a result of the ombudsman model, the absence of traditional administrative tribunal structures and the lack of clear enforcement powers, the federal OPCC has developed more unorthodox procedures for dealing with complaints. Footnote 24
Yet, as is any other administrative body, the Office of the Privacy Commissioner is bound by the duty of procedural fairness. The Canadian Ombudsman Association has also emphasized the importance of independence and impartiality to the effectiveness of a "true" ombuds-office. Footnote 25 Far from being a model which eschews procedural fairness then, procedural fairness is in fact central to the effective performance of the ombuds-role.
What may sometimes be overlooked is that the content of this duty, as described by the Supreme Court of Canada, is necessarily "flexible and variable, and depends on an appreciation of the context of the particular statute and the rights affected." Footnote 26 In this case, the extent of the Privacy Commissioner's duty of procedural fairness in conducting investigations must be evaluated in terms of the express statutory restrictions that PIPEDA itself places on the investigation process. For instance, the desire to be publicly open and transparent about her investigation process must necessarily be curtailed by the statutory obligation imposed on the Commissioner and her staff "not to disclose any information that comes to their knowledge as a result of the performance or exercise of any of the Commissioner's duties or powers" in the course of an investigation. Footnote 27
As well, the boundaries of the Commissioner's duty must be assessed in light of the purpose and intent of the ombudsman model, which is not to make binding determinations of the rights and obligations of the parties, but rather to try to assist the parties to reach a mutually acceptable solution. While it may be argued that Commissioner's investigators have the duty to conduct an adequate and thorough investigation, disclose information to both parties, be neutral throughout their enquiry, and avoid inordinate delay that can cause prejudice to the parties, the extent of those duties will necessarily be nuanced. These formal requirements may well be more exacting under the adversarial model, with its litigious fact-finding process, culminating in determinative decisions that affect the rights and obligations of the parties. This is in contrast to the ombuds-model, where such requirements need be moderated by an inherently different process which calls for flexibility, consensus building and non-binding recommendations.
III. TRANSPARENCY
Critics of the OPC have loudly decried the Commissioner's "failure" to name names of organizations against which complaints have been brought. These criticisms range from the suggestion that the Commissioner has the power to name every organization and complainant, to the suggestion that her discretion to name should be exercised more often even while recognizing that it remains relatively exceptional.
On this issue, section 20 of PIPEDA is very explicit in binding the Commissioner and her staff to a statutory obligation of confidentiality in respect of any information that comes to their knowledge in the course of exercising their duties or powers, particularly in the context of complaint investigations. Surely, this is not an accident of legislative drafting. The obligation of confidentiality is integral to an ombuds approach, where it is intended to encourage parties to engage in a conciliatory process aimed at reaching resolution. To enable complainants to be forthcoming, open and vulnerable, on the one hand, and respondent organizations to be self-critical and willing to espouse a change of practice, on the other, they must reach a mutual state of trust. Indeed, as Owen reminds us,
[t]he consensual resolution of public interest disputes requires a recognition by all major private and public interests that the best chance of achieving their individual objectives will occur through the enhancement rather than at the expense of apparently competing interests. This is a building process, not a destructive one… (it) is a negotiated process, not an adversarial one, and the assistance of a trusted and neutral facilitator or mediator is often necessary to ensure free communication, full disclosure, and balanced participation. Footnote 28
The Commissioner's statutory duty of confidentiality owed to the parties has been recognized by the courts as an essential feature of the ombuds-model. The Federal Court of Canada referred precisely to this point in Rubin v. Canada (Clerk of the Privacy Council) Footnote 29 in respect of the Access to Information Commissioner, whose investigative powers, functions and duties are similar to those of the Privacy Commissioner:
While he has no power to order disclosure, a credible and effective Commissioner should have significant persuasive power to encourage voluntary resolution of requests for information under government control. An important aspect of the development of that credibility and effectiveness is, in my view, the maintenance of strict confidentiality of information that is given to the Commissioner. Indeed, the provisions of the Act that require that the Information Commissioner maintain strict confidentiality on a continuing basis over information given to him support this conclusion. Parties must have confidence that the Information Commissioner will not divulge the information given to him.
More recently, the Federal Court had occasion to reiterate the importance of this statutory obligation of confidentiality in a case directly involving the Privacy Commissioner. In Blood Tribe Department of Health v. Canada (Privacy Commissioner), Footnote 30 the respondent organization challenged the Commissioner's right to issue an order of production for documents the organization claimed were subject to solicitor-client privilege. The Court ruled that it was necessary for the Commissioner to review the documents to fulfill her investigative duty. Noting subsection 20(1) of the Act which obligates the Commissioner to keep the documents confidential Footnote 31, Mr. Justice Mosley held that "(a)n assurance of confidentiality was offered at the outset of the investigation in respect of all of the information sought from the applicant. That assurance is, in my view, supported by the scheme of the Act." Footnote 32
Despite this obligation of confidentiality, general information about the handling of complaints can be revealed. For example, by anonymizing case summaries, the Commissioner is able to disclose details about cases which raise issues of interest to the public without breaching her confidentiality to the complainants or respondent organizations. This approach has served a vital function in terms of fulfilling the Commissioner's public education mandate. Footnote 33
Alternatively, the Commissioner could, perhaps, simply list the names of organizations against which complaints had been brought. Without breaching her duty of confidentiality, she could not however, on a systematic basis, link those names with the outcomes of the cases or specific details about the organization's information management practices that led to the complaints. One might question, therefore, what purpose a simple list of names, without more information, would helpfully serve. In fact, such a list might misrepresent organizations to the public. Larger, national organizations are more likely than a small or solely regional organization to receive complaints, but this is not necessarily indicative of a less compliant organization.
That being said, the legislation does recognize that there may be exceptional situations where the obligation of confidentiality concerning the personal information management practices of organizations is outweighed by the public interest in being made aware of those practices. Footnote 34 A review of the language of the Act, as well as the practices and jurisprudence from other jurisdictions suggests a number of criteria would apply. Footnote 35
First, a clear record should be developed and retained. As Coughlan v.WMC International Ltd. Footnote 36 underscores, such a record will establish the Commissioner's decision-making process as to why disclosure was in the public interest.
Part of the development and maintenance of such a record will be to demonstrate that the decision to disclose was made on a case-specific basis. The structure of section 20 makes it clear that the decision to disclose is an exceptional one, and as such cannot be part of an overarching policy of universal disclosure but rather must be considered and justified on its individual merits.
Next, to support the decision to exercise her discretion, the Privacy Commissioner should be able to justify how disclosing the information in the "public interest" helps advance the purposes of PIPEDA. As the Supreme Court of Canada set out in Dagg v.Canada (Minister of Finance) Footnote 37 there must be "some reason which is rationally connected to the purpose for which the discretion was granted." Footnote 38
This Commissioner must then balance the general duty of confidentiality under s. 20 against the public interest exception set out in s 20(2) in order to determine whether or not there are overriding factors justifying disclosure of information.
Finally, even when the Commissioner's discretion is exercised in favour of exceptionally disclosing information to meet a public interest need, the extent of the disclosure should be limited to only that information necessary to meet the specified purpose.
IV. EFFECTIVENESS
a. Complaint-Driven Model
Some commentators have criticized the individual complaints-based model which has been incorporated into PIPEDA. For instance, John Lawford, concerned about the quality of individual complaints and unequal power between the parties, has written that "the absence of the usual adversarial approach in an administrative tribunal means the companies respond more formally and legalistically, while the complainants never get this chance and consequently their complaints seem unsophisticated." Footnote 39
However, we must examine this criticism in light of the nature and intent of the ombudsman approach. The Office of the Privacy Commissioner is not an administrative tribunal, and should not be measured against such a model. She is not a passive bystander who hears two ready-made, well-packaged, and well-rehearsed sides of a story, on the basis of which she renders a decision. Rather, she is a neutral third-party mandated to communicate openly with both parties and work actively with them to resolve their dispute, achieve a fair outcome and develop a transformative culture of privacy. As a function of the office she holds, therefore, the Privacy Commissioner is expected to have the requisite experience and expertise to assist and understand the 'unsophisticated' complainant. She ensures that the complaint is fully and appropriately investigated and addressed from both sides, in a fair and impartial manner, with a view to mediating towards a mutually satisfactory solution.
Another commentator, Christopher Berzins, has identified what he perceives to be a number of problems with an "overly complaint-driven model", namely: the difficulty of an individual knowing that they have been affected and the lessened likelihood therefore of receiving complaints; the difficulty in identifying which organization a complaint should be targeted against; the discouraging impact of the personal time and effort necessary to file a complaint; the prevalence of trivial and/or frivolous complaints; and a fear that a paucity of "quality" complaints will prevent the Privacy Commissioner from being able to address systemic problems with personal information management practices. Footnote 40
Once again, reference to the aims of the ombuds-model makes clear the intent of the complaint process. The desired cultural change is not something which can be imposed, but rather must be the result of education and sensitization of the affected communities. As Owen comments, "the interdependence of interests empowers even relatively minor stakeholders to be valued partners in the resolution rather than bothersome but defeatable opponents." Footnote 41 The complaint-driven system allows for individuals to become empowered with respect to their own personal information and organizations to become reflexively conscious of their personal information management practices. Moreover, the individual complaint serves as an important trigger for uncovering broader issues that might otherwise never come to light. As Nathalie des Rosiers has noted, "the ombudsman's role in preventing interventions is well known: an individual complainant is the catalyst for an analysis of systemic difficulties." Footnote 42
As important as it is, the individual complaint is certainly not the only tool PIPEDA offers to address privacy issues. Section 11(2) of PIPEDA allows the Privacy Commissioner to initiate a complaint of her own accord if she is satisfied that there are reasonable grounds to do so. The "reasonable grounds" threshold could arguably be met where the Commissioner believes in good faith and on the basis of some credible evidence that there is a serious possibility that an investigation could reveal a contravention or intended contravention of the Act. Footnote 43 As such, the Commissioner is not restricted to complaints received from individuals, but rather, is free to instigate an investigation where she considers the requisite criteria have been met.
Furthermore, as Berzins himself remarks, PIPEDA offers a much broader suite of innovative, privacy-enhancing tools than just individual complaints. Unlike its public sector companion, the Privacy Act Footnote 44 which remains based solely on the individual complaint mechanism, PIPEDA's larger tool-kit has opened up a whole new chapter of privacy protection in Canada and has paved the way towards a far more pro-active, multi-faceted approach to managing Canadians' personal information. Public education, research and audit are among those complementary mechanisms in PIPEDA that respond to concerns about an overly complaints-driven model. Even the Information Commissioner of Canada has recently called for similar powers in his proposed amendments to the Access to Information Act, recognizing the vital importance of these additional functions. Footnote 45 It is perhaps trite to add, though far from trivial, that to be able to fulfill these functions in any meaningful and coherent way, while still continuing to accomplish the critical function of providing timely response to individual complaints, requires adequate resources.
b. Lack of Order-Making Power
Perhaps the most commonly heard critique of PIPEDA has been the suggestion that the Commissioner is "ineffective" because she lacks the power to make orders and thus force organizations into complying with her findings.
However, an isolated critique of the lack of order-making power neglects to take into account a number of factors.
The Commissioner's extraordinary investigatory powers (including her power to receive any evidence she sees fit whether or not it would be admissible in a court of law Footnote 46) are, at least in part, the correlative of her lack of order-making powers. This is wholly consistent with the ombuds-model. Indeed, the Privacy Commissioner's role is that of a trusted "truth-finder" striving to elicit, through her enquiry, all the necessary facts and considerations in order to reach lasting solutions. Such solutions are beneficial both for resolving an immediate complaint, and more importantly, for furthering systemic transformation towards an enduring and sustainable culture of privacy. As Owen has written:
Because solutions are voluntarily entered into, they will be self-regulating and enduring. Because they have been designed through a process based on openness and respect, the positive relationship between the parties will allow for the flexible adjustment of terms to meet changing circumstances. Footnote 47
In contrast, the adversarial, litigious and less flexible approach, which is a necessary adjunct to the order-making model with more exacting procedural fairness requirements Footnote 48, may not have the same effect in resolving privacy disputes. Owen goes to quite some length to describe why litigation is almost always the least appropriate way to resolve public interest disputes.
…(C)ourts do not provide solutions that are flexible, self-regulating, enduring and mutually productive. Social harmony, political consensus, and economic competitiveness are essential objectives in public interest disputes. All are poorly served by an adversarial process that imposes settlements, drains resources, and creates winners and losers." Footnote 49
At the time PIPEDA was adopted, it was likely the view that litigation would fare no better in resolving privacy disputes in the private sector either, particularly at a time of learning and cultural change in respect of personal information management practices generally. Such was the policy choice made when considering the most appropriate mode of regulating this type of activity, in this particular sector, at that particular time. As Colin Bennett notes:
For the most part, the regulation of privacy is not marked by highly public conflicts with resistant and non-compliant organizations…Any resistance to the implementation of privacy tends to focus on these more subtle issues of interpretation, which then lead to some quite complicated and technical debates about the balancing of risks within certain organizational and technical practices. Footnote 50
Hence, it was perhaps thought that such debates about interpretation are best had in a context which promotes open dialogue, education and sector-specific application through adapted policies and practices, rather than one which restricts the contours of such debates through narrow and protracted litigation. This policy choice will likely be re-explored in the context of the five-year review of PIPEDA mandated by Parliament at section 29(1).
c. Unfair Burden on Complainants
Under s. 14 of PIPEDA, the complainant Footnote 51 may, after receiving the Commissioner's report, apply to Federal Court for a hearing. Some critics have raised concerns that having to proceed to Federal Court for a de novo hearing is unfair to complainants, burdensome and time consuming. Lawford, for instance, speaks of "the high hurdles faced by any average citizen in attempting to effectively re-litigate a process that was meant to be transparent, accessible and low-cost under PIPEDA." Footnote 52
Such critiques fail to recognize the Commissioner's powers, under s. 15, to proceed to Federal Court. By virtue of this section she may (with the consent of the complainant) apply to court herself for a hearing of the issue, appear before the court on behalf of any complainant who has applied for a hearing under s. 14 or, with leave of the court, simply appear as a party to any hearing of an application under s. 14. Critics who suggest that a complainant taking the matter to Federal Court is the only way to proceed there have missed this important clause of PIPEDA and failed to consider its implications. Footnote 53
Even where the Privacy Commissioner opts not to become directly involved as a party to a court application, the ombuds-model has positive implications for the complainant. As Colin Bennett points out, "because the Commissioner does not make binding decisions, [s]he has a great deal of latitude to assist and advise a complainant who wishes judicial review." Footnote 54
At another level, critiques that focus on Federal Court at all necessitate again a return to the notion of what an ombuds-model strives to achieve. The choice of the ombuds-model for PIPEDA signals an intent to alleviate, wherever possible, the need to proceed to Federal Court and instead to make redress possible via a relatively informal and inexpensive way. To presume that all (or even most) complainants must bear the burden of proceeding to Federal Court is to discount the role of the Privacy Commissioner in brokering effective, mutually-agreed upon solutions in order to avoid the need to go to Court at all. In her Annual Report to Parliament accounting for activities related to PIPEDA in 2004, the Privacy Commissioner reported that 47% of complaints under PIPEDA were settled or resolved through mediation and early resolution. Footnote 55
Colin Bennett has commented that both the Privacy Act and PIPEDA "rely on an assumption that an ounce of prevention is better than a time-consuming and costly process of reactive investigation and enforcement." Footnote 56 This pro-active and prophylactic approach is consistent with what he describes as "the received wisdom from the analysis of the experience of many privacy and data protection agencies, in Canada and overseas…that the most important powers are those that are general rather than specific, and proactive rather than reactive." Footnote 57 The choice of an ombuds-model for the Office of the Privacy Commissioner of Canada was a deliberate choice, intended to position the Office in the requisite proactive way. Far from adding to the burden for complainants, the Commissioner's role is intended to alleviate it.
Some critics are troubled by their assessment of the role of the Privacy Commissioner vis à vis the Federal Court. As Berzins writes:
Implicit in this is that the Commissioner's office will be the repository of significant privacy expertise. However, when it comes to defining the meaning of the Act's core provisions, the Commissioner is relegated essentially to the sidelines. Although a complainant must first go to the Commissioner, enforcement, like interpretation of the legislation, is ultimately with the Federal Court. In fact, an application to the court involves a full review on the merits with no special significance being attached to the Commissioner's investigation findings. Footnote 58
To date, this is an issue which has not been fully resolved by the Courts. However, in a recent Federal Court decision Footnote 59 Mr. Justice Simon Noël recognized that
While exercising its discretion de novo the Court will give less deference to the decision of the Privacy Commissioner than it would otherwise, some due regard is warranted toward the factors taken into consideration by the Privacy Commissioner in balancing the privacy interests of the complainant and the employer's legitimate interest in protecting its employees and property. Footnote 60
In these early days of judicial interpretation of PIPEDA, this is a very positive step, indicating recognition that the expertise of the Privacy Commissioner must not be disregarded at the Federal Court level as some critics have feared could happen. Instead, the Privacy Commissioner is being accorded a status analogous to that of an expert witness in Court — while not accorded complete deference, the Commissioner's position is given particular weight in light of her recognized expertise.
Conclusion
The ombuds-model was selected as the appropriate model to deal with public sector privacy issues back in 1983 when the Privacy Act was enacted. The model was again selected in 2000 as the appropriate model for overseeing PIPEDA at an initial stage when individuals were setting out to learn more about their privacy rights, and organizations were becoming increasingly sensitized to their correlative responsibilities.
Throughout this article, I have attempted to respond to criticisms that have been made about the effectiveness of the current model for overseeing the personal information management practices of private organizations subject to PIPEDA. I have done so by trying to enlighten the discussion with a fuller understanding of the model itself. I have not attempted to argue for or against the merits of the model. This is something that should more appropriately be the subject of much broader, public debate in the coming year in the course of the five-year review of PIPEDA mandated by Parliament at section 29(1). This debate will also be of great interest for the purpose of reviewing the Privacy Act, which I have argued elsewhere is long overdue for major reform and modernization. In the context of each of these major legislative reviews, the fundamental question must be: what is the most appropriate mode of regulating public or private sector activity that will best serve the interests of Canadians? It may be that the ombudsman continues to be the most effective approach. Or, perhaps an alternative approach would now be deemed to be more optimal as we enter a more mature phase of implementation and as we face complex challenges of modern information technology and national security concerns that could not even have been imagined five years ago. Indeed, we are arriving at a critical juncture when many of Parliament's starting assumptions will need to be revisited and enlightened by inclusive public dialogue to either confirm or improve the current model.
In the meantime, however, what I have tried to do is separate out oranges from apples. Throughout this paper, I have attempted to re-direct current criticisms so that they focus more directly on the merits of the approach itself, rather than denature the model in an effort to turn it into something that it is not. The ombudsman model has its own set of attributes and benefits inherent in its underlying philosophy. We should be examining whether that model in its integrity continues to meet Canadians' needs for privacy protection. If not, we should be thinking outside the box towards other more innovative and appropriate approaches - not cherry picking among the essential features that made the ombuds-model attractive in the first place, choosing to completely ignore some of them while imposing other aspired attributes that would be wholly inconsistent with its fundamental purpose. Let the arguments be focused on the right vision for privacy protection in Canada, and the appropriate model should then be allowed to follow in a consistent and coherent form to give meaningful effect to that vision.
- Date modified: