Legal

November 9, 2021 Published by Toronto and Area Chapter - By Peter Murphy

PIPEDA Law and Ontario's Condominium Corporations

From the Fall 2021 issue of CCI Toronto Condovoice Magazine, Volume 26, Issue Number 1

Personal Information Protection and Electronic Documents

Compliance with privacy law is an important part of doing business in Ontario. As part of their legal compliance efforts, Ontario's condominium corporations often ask if they must comply with Canada's private sector privacy law, namely the Personal Information Protection and Electronic Documents Act (PIPEDA). To date there is no definitive answer to this question.

PIPEDA applies to every organization in Ontario in respect of personal information the organization collects, uses or discloses in the course of commercial activity. The key question, therefore, is whether the organization conducts "commercial activity".

In PIPEDA, "commercial activity" is defined as any transaction, act or conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists. In other words, "commercial activity" is any activity that is commercial.

This definition is extremely unhelpful, and makes PIPEDA's application to nonprofit organizations, such as condominium corporations, uncertain.

According to the Office of the Privacy Commissioner of Canada (PCC), whether an organization will be considered to collect, use or disclose personal information in the course of a commercial activity will vary depending on the facts of each case. However, a review of the PCC's published case decisions does not reveal a consistent rationale for determining if an organization conducts "commercial activity" and is therefore subject to PIPEDA.

In PIPEDA Case Summary #2005-309, the PCC decided that a not-for-profit, private daycare was subject to PIPEDA, because it charged a fee for its services.

Subsequently in PIPEDA Case Summary #2006-345, the PCC decided that a notfor- profit private school was not subject to PIPEDA, even though it charged tuition. The PCC based its decision on the fact that the school's main activity was education and, as a not-for-profit organization, the school's objectives did not include earning a profit for its owners.

In PIPEDA Case Summary #2008-389, the PCC considered whether PIPEDA applies to the non-profit Law School Admission Council, which offers law school admissions tests for a fee. The PCC indicated that an organization's core activities will be the primary factor for determining if the organization is subject to PIPEDA. The PCC decided that PIPEDA applies to the Law School Admission Council because its core activities primarily serve the administrative and organizational needs of its law school members, and not educational or other public purposes.

Based on these PCC decisions, it seems the PCC will consider not-for-profit organizations that collect fee payments to be subject to PIPEDA unless their primary purpose is to benefit the public and not their members.

Ontario's courts have also considered when PIPEDA will apply to not-forprofit organizations. In the Rodgers v. Calvert case, members of an Ontario notfor- profit gun club asked a court to order the club to disclose its members list. The club opposed the order, arguing that PIPEDA prohibited it from disclosing its members' information. To determine if PIPEDA applied to the club, the Ontario Superior Court of Justice considered whether the club collected, used or disclosed its members list in the course of commercial activities.

The Court observed that the members list was compiled during the club's membership on-boarding, while membership dues were being collected. The Court considered the payment of membership dues alone to not constitute sufficient "commercial activity" for PIPEDA to apply. Observing that the gun club acts for the benefit of its members, the Court found nothing to indicate the activities of the club at large, or the production of the membership list in particular, would be considered a commercial activity for purposes of PIPEDA.

Subsequently in the State Farm case, the Federal Court of Canada held that the determination of whether activity will be considered "commercial" for purposes of PIPEDA should be based on the primary characterization of the activity or conduct in issue. This case dealt with video surveillance of the plaintiff that was carried out by the defendant's insurance company, State Farm. The Court held that the video surveillance was conducted for purposes of defending the plaintiff 's lawsuit, and not in the course of commercial activity. The fact that State Farm paid a private investigator to collect the video evidence did not render the activity "commercial". The primary characterization of the collection of video evidence was non-commercial, in this case the defence of a lawsuit, and therefore PIPEDA did not apply.

Based on the case law and PCC case summaries, it appears the primary characterization of a condominium corporation's activity will determine if it is subject to PIPEDA. Yet it is not clear if a condominium corporation's activity will be characterized as primarily "commercial" and therefore subject to PIPEDA.

If the reasoning in PIPEDA Case Summary #2008-389 regarding the Law School Admission Council is followed, PIPEDA would appear to apply to Ontario's condominium corporations because they do not serve a broad, public purpose such as education.

If the reasoning in the Rodgers v. Calvert and State Farm cases is followed, however, PIPEDA might be considered to not apply to Ontario's condominium corporations because they exist primarily to serve the benefit of the condominium owners, but not to generate a profit for them.

As long as this uncertainty remains, Ontario's condominium corporations would be prudent to assume that PIPEDA applies to them. If they do not, they face the risk of being subject to complaints made to the PCC and ultimately to Court actions and resulting damage awards.

To add to these concerns, it appears that PIPEDA might be replaced in the near future with stricter legal requirements. The Government of Canada introduced Bill C-11 late in 2020 to make changes to Canada's privacy law. If passed, Bill C-11 will replace PIPEDA with a new private-sector privacy law, the Consumer Privacy Protection Act (CPPA).

The proposed CPPA will expand on PIPEDA's requirements and make significant new penalties available for noncompliance. If the CPPA becomes law as currently written, breaching it could result in fines of up to $25,000,000.

As currently drafted, CPPA will define "commercial activity" as any particular transaction, act or conduct, or any regular course of conduct, that is of a commercial character taking into account the organization's objectives for carrying out the activity, its context, the persons involved and its outcome. While this wording is an improvement compared to PIPEDA, it does not provide a clear indication that condominium corporations will, or will not, be subject to CPPA.

It seems the confusion about whether privacy law applies to Ontario's condominium corporations will continue. even if the CPPA is passed. Given the uncertainty and the growing risk of non-compliance, Ontario's condominium corporations should ensure they are compliant with PIPEDA and, if the CPPA becomes law, with CPPA.