Federal privacy commissioner issues privacy law guidance bulletin during emergency pandemic

In light of the challenges faced by Canadian organizations and government institutions during the COVID-19 outbreak, on March 20 the Office of the Privacy Commissioner of Canada (OPC) issued the following guidance bulletin “Privacy and the COVID-19 Outbreak” (OPC Bulletin). The OPC Bulletin provides a useful reminder to organizations and government institutions of the foundational principles under Canadian privacy laws that allow for the collection, use and disclosure of personal information and how such principles may potentially be altered during a public health emergency such as the current COVID-19 outbreak.

The following summarizes the OPC’s takeaways in the bulletin:

A public health emergency may expand organizations’ abilities to collect, use and disclose personal information

At this time, all provinces and territories have declared states of emergency regarding the COVID-19 outbreak, but a national emergency under the federal Emergencies Act has not yet been declared. Where a public health crisis or situation constitutes a public emergency, the OPC reiterated that an organization’s or a government’s ability to collect, use and disclose personal information of individuals may possibly be extended, particularly regarding the use and disclosure of personal information without the individual’s consent. Whether an organization has an expanded right to collect, use or disclose personal information depends on an analysis of the specific privacy legislation at issue. We address some of the relevant Canadian privacy legislation below.

Public emergencies and the federal Personal Information Protection and Electronic Documents Act (PIPEDA)

PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of a commercial activity and to information about employees of federal works, undertakings or businesses.

The OPC reiterated in the bulletin that normally under PIPEDA, organizations are permitted to collect, use or disclose personal information for reasonable purposes and where the individual’s knowledge and meaningful consent has been obtained. However, the OPC noted that the present situation caused by the COVID-19 outbreak may mean that certain provisions under PIPEDA that allow organizations to collect, use or disclose personal information without the individual’s knowledge or consent in the following limited circumstances may be applicable if:

• The collection is clearly in the individual’s interests and the individual cannot provide timely consent, such as where an individual is critically ill or in a particularly dangerous situation;
• The collection is for the purpose of making a disclosure required by law (i.e., in the event a public health authority requires the disclosure of certain information);
• Disclosure is made to a governmental institution where there are reasonable grounds to believe the information relates to the contravention of federal or provincial laws (such as a suspected contravention of a quarantine order); or,
• The use or disclosure is for the purpose of acting in an emergency that threatens the life, health or security of  individuals, such as if individuals require urgent medical attention, they are unable to communicate directly with medical professionals.

Provincial private sector organizations must continue to follow provincial privacy laws

The OPC Bulletin also refers to similar COVID-19 privacy bulletins issued by the respective privacy commissioners of British Columbia, Alberta, Saskatchewan, Quebec, Newfoundland, Yukon and the Northwest Territories and indicated that such provincial and territorial privacy legislation may similarly allow for expanded use or disclosure of personal information by organizations during emergency situations.

For BC, Alberta and Quebec, provincial privacy legislation applicable to private-sector organizations potentially allows for expanded means to use and disclose personal information in emergency situations including:

• In BC, the Personal Information Protection Act permits private organizations to use individual information without consent where it is necessary to respond to an emergency that threatens an individual’s life, health or security, and to collect, use and/or disclose personal information if required or authorized by law.
• Under Alberta’s Personal Information Protection Act, private organizations may disclose or use individual information without consent if necessary to respond to a public emergency and the disclosure or use is reasonable. The Alberta Office of the Information and Privacy Commissioner has advised that orders issued under public health legislation could require the collection, use and disclosure of certain personal information relating to employees and customers.
• In Quebec, private organizations must not disclose personal information without consent except in an emergency, although, as covered in our recent February update, new legislation may be introduced in Quebec to significantly increase companies’ burdens to obtain consent.

The OPC Bulletin serves as a useful reminder that while the public health emergency created by the COVID-19 outbreak could allow organizations to collect, use and disclose certain personal information without an individual’s consent under existing privacy legislation, such organizations are nonetheless advised to independently consider each situation to ensure the exemptions discussed above are indeed applicable.