Access to Information and
Recent Developments in
Privacy Law
Wendy Wagner
Maureen L. Murphy
Martin Lapner
Disclaimer
This presentation is intended for educational
purposes only and is not intended to be used as
legal advice.
Life Sciences Group – Seminar Series
3Wendy Wagner
Partner 613-786-0213 wendy.wagner@gowlings.comMaureen Murphy
Partner 613-783-8818 mailto:maureen.murphy@gowlings.comMartin Lapner
Partner 613-786-0289 mailto:martin.lapner@gowlings.comAccess to Information
•
Access to information regimes create a presumptive right of
access to information held by government institutions, subject
to limited and specific exemptions
•
Federal:
Access to Information Act
R.S.C. 1985 c. A-1
•
Provincial: various acts, e.g. Ontario:
Freedom of Information
and Protection of Privacy Act
, R.S. O. 1990, c. F. 31
5
Exemptions to Disclosure (ATI Act)
• s. 13: information obtained in confidence from a foreign state
• s. 14: conduct of Federal/Provincial affairs
• s. 15: conduct of International affairs/defence of Canada
• s. 16: injury to law enforcement, conduct of investigations
• s. 17: threat to individual safety
• s. 18: trade secrets or valuable financial, commercial, scientific or technical information
of Canada
• s. 19: personal information
• s. 20: third party information
• s. 20.1 to 20.4: special exemptions for specific departments
• s. 21: advice or recommendations to government/account of consultations or
deliberations/government negotiation plans/government personnel or organizational
plans
• s. 22: testing procedures, test and audits
• s. 23: solicitor-client privilege
•
See
H.J. Heinz Co. of Canada Ltd. v. Canada (Attorney General),
2006 SCC 13: in
addition to the third party exemption, a third party may raise s.19 and possibly
other “mandatory exemptions”
Third Party Exemption
•
20(1) Third party information – subject to this section, the head of a
government institution shall refuse to disclose any record requested
under this Act that contains:
(a) trade secrets of a third party;
(b) financial, commercial, scientific or technical information that is
confidential information supplied to a government institution by a third
party and is treated consistently in a confidential manner by the third
party;
(c) information the disclosure of which could reasonably be expected to
result in material financial loss or gain to, or could reasonably be
expected to prejudice the competitive position of a third party; or
(d) information the disclosure of which could reasonably be expected to
interfere with contractual or other negotiations of a third party.
7
Third Party Exemption
• s. 27(1): Notice to third parties must be given if a government institution intends to disclose records/information which the institution “has reason to believe might contain” information described in s.20(1)(a) - (d)
• Minister of Health v. Merck Frosst, 2009 FCA 166: decision of the SCC (argued November 2010, decision pending):
Citing Air Atonabee: “the Act does not require notice to a third party before disclosure of information relating to that party except in the circumstances set out in section 28(1). Where the head of the institution considering all the relevant evidence before her or him concludes that the information requested is not of a character referred to in that section, notice to the third party is not required, will not be ordered by the Court and no right to apply for review under section 44(1) accrues” (para. 38).
Other central issues include:
- what is confidential/trade secret information? e.g. compilations of publicly available information
- what burden of proof must be met by the third party under s.20(1)(c)?
• If notice is given:
• s. 27(3)(c): third party has 20 days to make representations as to why the information should not be disclosed, subject to an extension (s. 27(4))
• s. 44: if a decision is made to disclose, the third party may appeal this decision to the Federal Court within 20 days
Health Canada Notices
•
Routine requests for NDS; SNDS; Health Canada correspondence
(internal and external); meeting minutes and reviewer’s notes
•
Adverse Drug Reaction reports
•
Approach to Response:
• request extension if required
• indentify unpublished, confidential information
• indentify inaccurate, misleading information
• clearly indicate information to redact/expurgate – in accordance with
“reasonable severability”
• Provide detailed explanation in writing to support redactions
• ongoing dialogue
9
Health Canada Notices
•
In the context of an NDS/SNDS or an ADR report, Health Canada
is prepared to consider as exempt:
• Name of employees/patient identifiers – 19(1)
• Reported events for which no causal link can be established and for which there is
no warning in the product monograph – 20(1)(c) – see
Astrazeneca
, 2005 FC 646
• formulation of dosage form - 20(1)(a)(b)(c)
• method of manufacture of drug substance or dosage form - 20(1)(a)(b)(c)
• information which reveals batch sizes - 20(1)(a)(b)(c)
• limits, specifications, test parameters, and specific descriptions of test methods
[20(1)(b)(c)], provided they are not compendial or recommended by the Health
Protection Branch
• test results - 20(1)(b)(c)
Con’t
• reviewer’s comments ONLY where they contain specific third party information
which could be severed as above - 20(1)(b)(c). Careful review of the comments
will be necessary to determine which comments contain information which is
confidential. Comments which are not entirely favourable cannot automatically be
exempted – it is necessary to justify the redaction on the ground that it contains
confidential data or possibly inaccurate/misleading
• Inaccurate/outdated expiry periods - 20(1)(b)(c)
• information regarding unmarketed packaging - 20(1)(b)(c) – provided the
information has never been released
• information on Investigational New Drug Submissions [20(1)(b)(c)] except where
they have been used in support of an approved New Drug Submission,
Supplemental New Drug Submission, etc.
• names of suppliers - 20(1)(b)(c)(d)
• names of laboratories, individuals, or companies on contract to the third party
-20(1)(b)(c)(d).
11
Con’t
•
Health Canada normally will not protect the following types of
information:
• names of Health Canada employees • Dates on correspondence
• Draft labels and draft product monographs, unless they contain information not appearing in the final version which is considered confidential
• Study numbers, unless the study number is considered confidential and there is evidence of the harm caused by its disclosure
• “administrative” information – e.g. number of volumes of submissions
• Published studies: but see Janssen-Ortho v. Canada (Minister of Health), 2005 FC 1633, aff’d 2007 FCA 252:
“Although the information in dispute is largely a description of the findings in published studies which would therefore normally be disclosed, the fact that JOI considers the findings to be accurate and trustworthy has not been publicized and would only become known through disclosure. Accordingly, JOI’s reference to published studies will not be disclosed”.
Submissions to Government
• Confidentiality may be difficult to maintain for requests for access to submissions to government departments to influence government policy
H.J. Heinz Company of Canada Ltd. v. Canada (Attorney General), 2006 FCA 378: Submissions to CFIA/AG Canada about the size of baby food containers (competitive issue)
Section 20(1)(b):
[23] “The communications in question here … are all communications by a regulated entity to its regulator dealing with changes to the regulatory regime. Even if Heinz had a
subjective expectation that such communications would not be disclosed, there could be no objective basis for such an expectation. Changes to a regulatory regime are matters of public interest. The public has a legitimate interest in knowing the extent to which
regulated entities have influenced the regulator and for whose benefit.” Section 20(1)(c):
[28] “Heinz also sought to shelter the Records in question under paragraph 20(1)(c) which deals with records whose disclosure could affect a third party’s competitive position. In this case, Heinz says that the disclosure of its position on regulatory change would allow its competitors to challenge the position. With respect, this is the very raison d'être for access to information legislation. It exists to allow others, including competitors, to take issue with special pleadings.”
Response:
• identify propriety data or confidential information within the submission • exceptional, compelling and detailed harm-based arguments
Recent Decisions
Ontario (Public Safety and Security) v. Criminal Lawyer’s Association
[2010] S.C.J.
No. 23
•
A right of access to information is guaranteed by s.2(b) of the
Charter
if the
information is needed to promote “meaningful discussion on matters of public interest”
Brainhunter (Ottawa) Inc. v. Canada (Attorney General),
2009 FC 1172
•
the whole of a bid for IT professional services could not be exempted on the basis of
having perfected a method of structuring bid proposals; specific methodologies were
redacted
Oceans Limited v. Canada Newfoundland & Labrador Offshore Petroleum Board,
2009 FC 974
•
Letters by an unsuccessful bidder about a bid were not financial, commercial,
scientific or technical as they did not refer to technical information or commercial
practices particular to the applicant
Appleton & Associates v. Canada (Privy Council Office),
2007 FC 640
•
Adds to a long list of decisions that “a third party cannot object that the government
institution is prepared to give more than what was asked for”; there is no freestanding
exemption for settlement negotiations but rather disclosure must interfere with
Provincial FIPPA Legislation
Ontario FIPPA, s. 17(1)
17(1) A head shall refuse to disclose a record that reveals a trade secret
or scientific, technical, commercial, financial or labour relations
information, supplied in confidence implicitly or explicitly, where the
disclosure could reasonably be expected to,
(a) prejudice significantly the competitive position or interfere significantly
with the contractual or other negotiations of a person, group of persons,
or organization;
(b) result in similar information no longer being supplied to the institution
where it is in the public interest that similar information continue to be so
supplied;
(c) result in undue loss or gain to any person, group, committee or financial
institution or agency…
15
Provincial FIPPA Legislation
Ontario FIPPA, s. 18(1)
18(1) A head may refuse to disclose a record that contains, ...
…
(c) information where the disclosure could reasonably be expected to
prejudice the economic interests of an institution or the competitive
position of an institution;
(d) information where the disclosure could reasonably be expected to be
injurious to the financial interests of the Government of Ontario or the
ability of the Government of Ontario to manage the economy of Ontario.
Provincial FIPPA Legislation
• Release of Information in Product Listing Agreements between manufacturers and the Executive Officer of the Ontario Public Drug Program is an ongoing issue
• On January 13, 2010, the Information Commissioner released Orders PO-2863; PO-2864; PO-2865
• Information that could be used to calculate volume discounts and other value for money conditions held to be exempt from disclosure under the Ministry’s exemption:
• “The information about how much a named manufacturer paid the Ministry as a volume discount amount and what other specific financial and value for money conditions a manufacturer agreed to provide to the Ministry could be used by other potential bulk prescription drug purchasers as a discount standard or price goal to be obtained from the drug manufacturers”
• Data that identified individual companies and payments made to the Executive Officer on a quarterly basis were released:
• “As the payments listed in the records are not broken down per drug product, I find that the information at issue would not reveal the specific financial details of the listing or pricing agreements entered into between the Ministry and the drug manufacturers for individual drugs”
• Rx&D and several member companies commenced judicial review actions against the Ontario Ministry of Health and Long-Term Care (Notice issue) and the Information
Commissioner of Ontario (Notice issue and substantive issue regarding release of quarterly payment data)
17
Provincial FIPPA Legislation
•
Order PO-2898 issued June 28, 2010 upheld non-disclosure of Schedules to a
product listing agreement between a drug company and the Executive Officer,
under the Ministry’s harm based exemption: :
• “I find that the disclosure of the information at issue could reasonably be expected
to discourage drug manufacturers in the future from negotiating large volume
discounts and other favourable financial terms with Ontario, out of concern that
this information could be used by their other public and private sector customers
seeking to negotiate similar discounts with the drug manufactures”
•
The requester’s argument that there was a compelling public interest in
disclosure of the schedules which overrides the Ministry’s exemption was
rejected.
***
•
The MOHLTC and manufacturers are addressing ongoing requests for access
to records relating to summaries of current listing agreements and payment
summaries which are the subject of appeals before the Information
Commissioner – see administrative Order PO-2953 and PO-2956.
•
None of the Information Commissioner decisions to date has considered the
application of the third party exemption to the information
The
Broader Public Sector Accountability Act, 2010
•
the
BPSAA
amends the Ontario FIPPA to make hospitals subject to
the Act
•
FIPPA will apply to hospitals as of January 1, 2012 but is
retrospective to January 1, 2007. Records that came into a hospital
custody/control on or after January 1, 2007 are subject to the Act
•
The amendment does not change rues applicable to personal
health information – the
Personal Health Information Protection
Act, 2004
will continue to apply
•
As of January 1, 2012, FIPPA will be amended so that certain types
of hospital records will be excluded from the Act, including
• Records that relate to the operations of a hospital foundation
• The administrative records of a health professional in relation to their
personal practice
19
Tips For Requests
Simple and narrow
• one drug product
• date range
• Name document categories that are known to Health
Canada
Expense
Delay
Wendy Wagner
Partner
Ottawa
Phone:
(613) 786-0213
Fax:
(613) 788-3642
Recent Developments in
Privacy Law
Overview
•
Privacy Framework in Canada
•
Recent Legislative Changes
• Breach Notification
• E-mail Marketing
23
Privacy
It's about the next 20 years. In the '20s and '30s it
was the role of government. '50s and '60s it was
civil rights. The next two decades are going to be
privacy
. I'm talking about the Internet. I'm talking
about cell phones. I'm talking about health
records and who's gay and who's not. And
moreover, in a country born on the will to be
free, what could be more fundamental than this?
Privacy
•
Why?
• Individual Autonomy
• Technology
25
Privacy Framework
How is Privacy Regulated in Canada?
•
Various laws across Canada
•
Federal:
Personal Information Protection and
Electronic Documents Act
(“
PIPEDA
”)
Privacy Framework
How is Privacy Regulated in Canada?
•
Privacy laws (including
PIPEDA
) establish rules
to govern the collection, use and disclosure of
personal information
•
All Canadian privacy legislation is “consent”
27
Privacy Framework
What is PIPEDA?
Goal is to balance:
Privacy Framework
What is Personal Information?
•
PIPEDA
defines “personal information” broadly
•
Information about an identifiable individual
• Exception – information on a business card
29
Recent Legislative Changes
Privacy Breaches
:
•
Are you prepared for a privacy breach?
• Loss, theft, or misuse of personal information
• Electronic or physical breaches
Recent Legislative Changes
Proposed Changes to
PIPEDA
• Bill C-29
• Introduced May 25, 2010
• Died with the election
31
Recent Legislative Changes
Breach Notification
• Bill C-29 proposed breach notification
requirement
• Report “material breaches” to federal Privacy
Commissioner
• Notify individuals where “real risk of
significant harm”
Recent Legislative Changes
Breach Notification
• Alberta’s Personal Information Protection Act
• Imposes breach notification
• Notification required where personal
information is lost, inappropriately accessed
or disclosed and there exists “a real risk of
significant harm to an individual”
33
E-mail Marketing
•
How are E-mail addresses collected?
• Contests?
• On website?
•
Do customers know how their E-mail addresses
E-mail Marketing
SPAM – unsolicited commercial email
•
Bill C-28 –
Fighting Internet and Wireless
Spam Act
• Introduced May 25, 2010
• Received Royal Assent on December 15, 2010
•
Consent required for electronic messages
(intended for commercial activity)
35
E-mail Marketing
SPAM – unsolicited commercial email
•
Consent
• Implied for existing business relationship
• Express where no pre-existing relationship
Latest Developments
Federal Bill C-28
–
Canada’s anti-spam law
•
Amends PIPEDA to prohibit spyware and “dictionary
attacks”
• Electronic addresses and personal information cannot be
collected by a computer program that generates, searches for,
and collects, electronic addresses, without consent
• Use of an electronic address or personal information collected in
that manner is also prohibited without consent
37
Recent Case Law
Nammo v. Transunion of Canada Inc.
,
2010 FC
1284
•
Applicant, Mr. Nammo, claimed that the
respondent, TransUnion, disclosed inaccurate
personal information to a bank in connection
with a loan application
•
The loan was refused
Recent Case Law
Jones v. Tsige
, 2011 ONSC 1475
•
Plaintiff and defendant were employees of the
Bank of Montreal where Defendant accessed
plaintiff’s banking records repeatedly
•
Plaintiff sued Defendant for invasion of privacy
•
The Court concluded that there is no
freestanding right to privacy at common law, but
noted that PIPEDA applies to the banking sector
39
Recent Case Law
Employee emails
•
City of Ottawa v. Ontario, 2010 ONSC 6835
• An individual requested disclosure of personal emails sent over
an employee’s work email
• The Ontario Divisional Court confirmed the City’s refusal to
disclose the emails
• Disclosure would not facilitate the purposes of freedom of
information legislation, namely scrutiny of government action or
citizen participation in democracy
• Disclosure would also undermine the privacy rights of
individuals - another goal of the legislation
Recent Case Law
Employee emails (continued)
•
R. v. Cole, 2011 ONCA 218
• High school teacher was charged with possession of
child pornography after a school technician discovered
pictures on teacher’s work laptop
• Main issue was whether teacher had a reasonable
expectation of privacy
• Held: teacher had a reasonable expectation of privacy
as the school board gave the teachers possession of
the computers and explicitly allowed their personal use
41
