After the Office of the Privacy Commissioner (the "OPC") held a meeting to discuss its strategic priorities in Montreal on February 23, 2015, Karl Delwaide sent the OPC a number of avenues to explore regarding the application of the Personal Information Protection and Electronic Documents Act ("PIPEDA"), including those aspects relating to consent and transparency. His comments are explained in the submission attached to this email, taking the following principles into consideration:
1. The importance of striking a "balance" between protecting the privacy of individuals and respecting the organizations' need to collect, use or disclose personal information ("PI") on individuals in the context of their legitimate commercial activities.
2. Implementing additional restrictions would only increase the burden of organizations, and would even (barring certain exceptions) prevent them from requesting (or obtaining) consent under some circumstances that are often common in legitimate commercial activities.
3. PIPEDA (and other similar provincial legislation) already contain parameters that would be useful in providing a framework for consent in the age of information technology:
a. Consent is based on an obligation to inform that must be carried out clearly and transparently. Individuals who consent, however, must not be "passive"; they also have the obligation to seek out information. Adopting a "victimization" or "infantilization" approach would be inappropriate here;
b. In light of the underlying Canadian bijuralism principles, civil law notions can be used in this case. Indeed, such principles already do provide a framework for consent. The submission examines not only the obligation to inform incumbent on organizations that want to collect, use or disclose PI, but also the other party's obligation to seek out information;
c. The principles underlying PIPEDA (and other similar provincial legislation) already limit consent: lawmakers' decisions emphasize that obtaining consent (no matter how broad) cannot override the principle that the information collected, used or disclosed must be necessary for the objects/purposes clearly explained to the individuals;
d. Similarly, the test of "necessity" with which lawmakers are familiar is framed by the application of privacy legislation: generally speaking, this test requires that the collection, use and communication of the information be "indispensable" (as opposed to merely "useful");
e. However, whatever framework approach is adopted should combine control, simplicity and transparency, without becoming overly restrictive. The underlying problem with this situation is that it is sometimes difficult to accurately determine what is being consented to. A consent form containing several pages filled with single-spaced text is quite "heavy". It must be simplified so that the circumstances of the consent are clearly and comprehensibly stated. Perhaps the OPC could be given the power to impose a simplified consent form detailing, in no more than one or two pages, (a) the objectives of the collection, use and disclosure of the PI,(b) the consent requested, (c) a statement explaining why it is necessary, and (d) whether or not there are cookies or other such elements. The summary in question should appear at the beginning of the "publication" of the request for consent. The goal is to give the individual a brief portrait of what is explained and requested at length in the other pages of the consent form. This would put into practice the well-known adage that "it is easy to find the words to clearly describe that which is fully understood".
Respectfully submitted.
Karl Delwaide and Antoine Guilmain, Attorneys.
Montreal, August 4, 2016.
Summary of the Submission Presented by Karl Delwaide and Antoine Guilmain in the Context of the Notice of Consultation and Call For Submissions: Discussion Paper on Consent, Updated July 27, 2016
Originally published June 30, 2020.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
