Interpretation Bulletin: Publicly Available Information

March 2014

One of the Commissioner’s primary roles is to investigate and try to resolve privacy complaints against organizations. While findings on a given issue may differ depending on the facts of each case and the position of the parties. Over time, findings on certain key issues have begun to crystallize into general principles that can serve as helpful guidance for organizations.

In an effort to summarize the general principles that have emerged from court decisions and the Commissioner’s findings to date, the OPC issues Interpretations of certain key concepts in PIPEDA. These Interpretations are not binding legal interpretations, but rather, are intended as a guide for compliance with PIPEDA. As the Commissioner issues more findings, and the courts render more decisions, these Interpretations may evolve and be further refined.

I. Relevant Statutory Provisions

Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”)

Principle 4.3 of PIPEDA states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

Section 7(1)(d) of PIPEDA states that for the purpose of clause 4.3 of Schedule 1, an organization may collect personal information without the knowledge or consent of the individual if the personal information is publicly available and is specified by the regulations.

Section 7(2)(c.1) of PIPEDA states that for the purpose of clause 4.3 of Schedule 1, an organization may use personal information without the knowledge or consent of the individual if the personal information is publicly available and is specified by the regulations.

Section 7(3)(h.1) of PIPEDA states that for the purpose of clause 4.3 of Schedule 1, an organization may disclose personal information without the knowledge or consent of the individual if the personal information is publicly available and is specified by the regulations.

Regulations Specifying Publicly Available Information, SOR/2001-7 (13 December, 2000) (“Regulations”)

Section 1 of the Regulations state that the following information and classes of information are specified for the purposes of paragraphs 7(1)(d), (2)(c.1) and (3)(h.1) of the Personal Information Protection and Electronic Documents Act:

1. personal information consisting of the name, address and telephone number of a subscriber that appears in a telephone directory that is available to the public, where the subscriber can refuse to have the personal information appear in the directory;
2. personal information including the name, title, address and telephone number of an individual that appears in a professional or business directory, listing or notice, that is available to the public, where the collection, use and disclosure of the personal information relates directly to the purpose for which the information appears in the directory, listing or notice;
3. personal information that appears in a registry collected under a statutory authority and to which a right of public access is authorized by law, where the collection, use and disclosure of the personal information relates directly to the purpose for which the information appears in the registry;
4. personal information that appears in a record or document of a judicial or quasi-judicial body, that is available to the public, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the record or document; and
5. personal information that appears in a publication, including a magazine, book or newspaper, in printed or electronic form, that is available to the public, where the individual has provided the information.

II. General Interpretations by the Courts

1. “It goes without saying that by appearing in public, an individual does not automatically forfeit his or her interest in retaining control over the personal information which is thereby exposed” (Alberta (Information and Privacy Commissioner) v United Food and Commercial Workers, Local 401, 2013 SCC 62 at para. 27).
2. Personal information must be both publicly available and specified by the Regulation to exempt an organization from the requirement to obtain consent (Turner v. Telus Communications Inc. 2005 FC 1601).
3. Even if voice characteristics or “voiceprints” collected by voice recognition technology could be said to be publicly available, this form of personal information is not specified by the Regulation. Therefore, the Regulation does not exempt an organization from the requirement to obtain consent to collect such information. (Turner v. Telus Communications Inc. 2005 FC 1601).
4. For the Regulation to apply, personal information must be collected from a publicly available source (Citi Cards Canada Inc. V. Pleasance 2010 ONSC 124; See also Citi Cards Canada Inc. v. Pleasance, 2011 ONCA 3).
5. The current balance of a mortgage is not publicly available (City Cards Canada Inc. V. Pleasance 2010 ONSC 124; See also Citi Cards Canada Inc. v. Pleasance, 2011 ONCA 3).
6. The exception to the requirement to obtain consent recognized in section 7 of the Act and paragraph 1(a) of the Regulations does not apply to the very organization that initially collects the information for the purposes of publishing a telephone directory that will, once published, become publicly available (Englander v. TELUS Communications Inc., 2004 FCA 387).
7. The fact that the use of personal information contained in publicly available telephone directories can be so widespread because of these Regulations militates in favour of the Court exercising additional caution when determining issues pertaining to initial listings in telephone directories (Englander v. TELUS Communications Inc., 2004 FCA 387).

III. Application by the OPC in Different Contexts

Whether information can be said to be “publicly available” for the purposes of PIPEDA will vary depending on the facts of each complaint investigation. The following examples illustrate how the provisions setting out each type of publicly available information specified by the Regulations have been interpreted and applied by the OPC.

1(a) Telephone directories

• Even if it is published in a telephone directory that is available to the public, an individual’s telephone number is still personal information. Subsection 5(3) of the Act, which requires appropriate purposes for the collection, use or disclosure of personal information, continues to apply.
  • PIPEDA Case Summary #2002-99 Personal information improperly disclosed to collection agency
• Paragraph 1(a) of the Regulation does not apply to a name-like term used to signify a subscriber’s spouse that is stored as a “code word” within a telecommunication company’s customer records.
  • PIPEDA Case Summary #2002-54 Couple alleges improper disclosure of telephone records to a third party
• Combining publicly available telephone directory information with non-personal geo-demographic information does not create new personal information to which consent requirements apply.
  • PIPEDA Case Summary #2009-004 No Consent required for Using Publicly Available Personal Information Matched with Geographically Specific Demographic Statistics
• The commercial manipulation and sale of publicly available telephone directory information does not contravene the reasonable person test described in subsection 5(3) of the Act.
  • PIPEDA Case Summary #2009-004 No Consent required for Using Publicly Available Personal Information Matched with Geographically Specific Demographic Statistics
• Personal “white pages” telephone directory information, re-published in a new (online) format that merely reflects the same personal information that was initially published, is considered publicly available information exempt from the consent requirements of the Act.
  • PIPEDA Case Summary #2001-8 Use and disclosure of personal information in telephone directories
• A division of a telecommunications company could collect its parent company’s customers’ names, addresses and telephone numbers from the parent company’s white-pages directory to use for its own business purposes.
  • PIPEDA Case Summary #2002-38 Telecommunications company accused of inappropriately using customer information

1(b) Professional and business directories

• A third party’s collection and use of email addresses to market the sale of sports tickets was not related to the purpose for which the employer made its employees’ contact information publicly available. Therefore, the regulations did not authorize the collection and use of this information by the third party without consent.
  • PIPEDA Case Summary #2005-297 Unsolicited e-mail for marketing purposes
• Information about an individual’s business collected from publicly available sources such as the yellow pages, telepages, superpages and other marketing sources may be disclosed without consent.
  • PIPEDA Case Summary #2003-141 Credit agency accused of disclosing personal information without knowledge and consent

1(c) Public registries

• It is not enough for personal information to be simply available from a public source. The information must also have been collected from the publicly available source for the Regulation to apply.
  • PIPEDA Case Summary #2009-002 Realtor advertises purchase price of condominium in trade publication without buyer’s consent
• Examining the particular purposes for a collection, use or disclosure is a key consideration in assessing whether the exception to the consent requirement set out in the Regulations applies.
  • PIPEDA Case Summary #2010-004 Manager’s remark reveals employee’s salary — consent was necessary despite existing public disclosure requirement
• Personal information appearing in a publicly accessible registry may only be collected, used and disclosed without consent when the purpose for the collection, use or disclosure relate directly to the purpose for which the information appears in the registry.
  • PIPEDA Case Summary #2009-020 Publicly available information about individual’s bankruptcy cannot be disclosed for debt-collection purposes without her consent
  • PIPEDA Case Summary #2010-004 Manager’s remark reveals employee’s salary — consent was necessary despite existing public disclosure requirement
• The public availability of information about a bankruptcy does not authorize the use of this information to collect a debt by means other than those provided for under federal bankruptcy legislation, which is the purpose for which the information is made publicly available.
  • PIPEDA Case Summary #2009-020 Publicly available information about individual’s bankruptcy cannot be disclosed for debt-collection purposes without her consent
• The public availability of audited financial statements for accountability and transparency purposes does not authorize the disclosure of an individual’s salary for other, unrelated purposes.
  • PIPEDA Case Summary #2010-004 Manager’s remark reveals employee’s salary — consent was necessary despite existing public disclosure requirement

1(d) Court and tribunal records

• Where the disclosure of court records containing an individual’s personal information relates directly to the purpose of advancing a claim in a court of law, that individual’s consent will not be required. However, the regulation did not apply in this case because disclosing personal information in court documents to a stranger to the litigation process was not directly related to purpose for which the information appeared in the documents (namely, the pursuit of legal action).
  • PIPEDA Case Summary #2009-015 Individual’s creditor leaves legal debt-recovery document at his workplace
• The ‘open courts’ principle can allow a member of the public to access court documents but it does not give an organization to whichPIPEDA applies the unfettered right to distribute the contents of a court file or pleadings to third parties outside the litigation.
  • PIPEDA Case Summary #2009-015 Individual’s creditor leaves legal debt-recovery document at his workplace
• Personal information that appears in a court record for the purpose of providing evidence in an ongoing legal proceeding cannot be collected and used without consent by a mortgage broker for the unrelated purpose of proposing financing arrangements.
  • PIPEDA Case Summary #2012-11 Mortgage administrator/broker should have confirmed consent prior to issuing letter of interest for mortgage financing in couple’s name

1(e) Books, magazines, newspapers

• Regulation 1(e) does not require that the collection or use of the information relate directly to the purpose for which the information appears in the publication.
  • PIPEDA Case Summary #2009-13 Publisher collected and used e-mail addresses for marketing without consent
• Consent to use a business e-mail address for marketing purposes is not required when that business e-mail address has been published on a website by the individual to whom it relates.
  • PIPEDA Case Summary #2009-13 Publisher collected and used e-mail addresses for marketing without consent