Legal information related to PIPEDA
One of the Commissioner’s primary roles is to investigate and try to resolve privacy complaints against organizations. Her findings on a given issue may differ depending on the facts of each case and the position of the parties. Over time, findings on certain key issues have begun to crystallize into general principles that can serve as helpful guidance for organizations.
In an effort to summarize the general principles that have emerged from court decisions and the Commissioner’s findings to date, the OPC issues Interpretations of certain key concepts in PIPEDA. These Interpretations are not binding legal interpretations, but rather, are intended as a guide for compliance with PIPEDA. As the Commissioner issues more findings, and the courts render more decisions, these Interpretations may evolve and be further refined over time.
The Meaning of “Commercial Activity”
I. Relevant Statutory Provisions
Section 2(1) of PIPEDA states that “commercial activity” means “any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”
Section 4(1)(a) of PIPEDA provides that PIPEDA applies to every organization in respect of personal information that the organization “collects, uses or discloses in the course of commercial activities” or “is about an employee of the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.”
II. General Interpretations by the Courts
- The collection of evidence on a plaintiff by an individual who is a defendant in a tort action brought by that plaintiff would clearly not constitute a “commercial activity” within the meaning of PIPEDA. “Indeed, the fact that an individual defendant collects evidence himself or herself for the purpose of a defence to a civil tort action is clearly not a commercial activity on the part of that defendant since there is no “commercial character” associated to that activity.” (State Farm Mutual Automobile Insurance Company v. Privacy Commissioner of Canada, 2010 FC 736).
- “…(I)f the primary activity or conduct at hand, in this case the collection of evidence on a plaintiff by an individual defendant in order to mount a defence to a civil tort action, is not a commercial activity contemplated by PIPEDA, then that activity or conduct remains exempt from PIPEDA even if third parties are retained by an individual to carry out that activity or conduct on his or her behalf. The primary characterization of the activity or conduct in issue is thus the dominant factor in assessing the commercial character of that activity or conduct under PIPEDA, not the incidental relationship between the one who seeks to carry out the activity or conduct and third parties.” (State Farm Mutual Automobile Insurance Company v. Privacy Commissioner of Canada, 2010 FC 736).
- A physician is engaged in a commercial activity when he or she conducts an independent medical examination of an individual on behalf of an insurance company, for the purpose of processing a claim for insurance benefits. (Wyndowe v. Rousseau, 2008 FCA 39 (CanLII))
- Not-for-profit organizations are not automatically exempt from PIPEDA. Whether an organization is a non-profit business for purposes of taxation is not determinative of whether its collection, use or disclosure of personal information is carried out in the course of commercial activity (Rodgers v. Calvert, 2004 ON SC (CanLII))
- Although an association’s collection of membership fees in exchange for the services and benefits of membership may constitute an “exchange of consideration” under the laws of contract, this does not in itself lead to the finding of a commercial activity for the purposes of PIPEDA. (Rodgers v. Calvert, 2004 ON SC (CanLII))
III. Application by the OPC in Different Contexts
Whether an organization can be said to collect, use or disclose personal information in the course of a commercial activity will vary depending on the facts of each case. In most cases, determining whether an organization is engaged in a commercial activity is straightforward, while sometimes the issue is more complex and requires closer examination. The following highlights cases in a variety of contexts where the circumstances have called for contemplation of the meaning of “commercial activity”:
- An intermediary who relays financial information into and out of Canada for international transactions involving Canadian banks was found to be engaged in a commercial activity.
- A Trustee in bankruptcy appointed by the Court, who collected personal information for the purposes of administering a bankruptcy, was found to do so in the course of a commercial activity. The OPC determined that the mere fact that an organization may be designated an “officer of the Court” is not sufficient to remove them from the jurisdiction of the Act.
Education and Day Care
- A daycare organization was found to be engaged in commercial activities despite the fact that it was a non-profit organization partially subsidized by a municipal government.
- A non-profit organization that administers university entrance exams was found to be engaged in commercial activity. The OPC determined that the simple fact that the organization is non-profit and membership-based does not mean that it does not engage in transactions of a commercial character which would trigger the application of PIPEDA. In the circumstances, the organization’s core activities were found to serve, primarily, the administrative and organizational needs of its members and not educational or other public purposes and thus constituted an activity with a commercial character.
- A private school was found not to be engaged in a commercial activity when it collected personal information for admissions purposes. The Assistant Commissioner employed this two part test to determine whether the organization was covered by the Act:
- What is the institution’s core activity? Is the institution providing educational services as its core activity? If so, the activities should presumptively be considered not to have a “commercial character.”
- The presumption that the activities of an educational institution do not have a commercial character will be rebutted if the institution has, as one of its objectives, the goal of earning a profit for the owners of the institution.
Applying this test, the Assistant Commissioner concluded that the organization in question was a private school, with education as its core activity. On the second branch of the test, the Assistant Commissioner found no indication that the school’s goal was to earn a profit for its owners, consistent with the organization’s status as a charitable, not-for-profit organization. Therefore, the school was able to uphold the presumption that its core educational activities were of a non-commercial character.
- The OPC found that an organization’s activity of defending itself against a customer’s claim in tort for an incident that occurred on its premises in the ordinary course of the company’s ongoing business activities constituted a commercial activity1.
- The Assistant Commissioner found that a landlord who collects, uses or discloses tenants’ personal information to administer a lease or for insurance purposes is an organization engaged in a commercial activity.
- The owner of a dog breeding business who posted individuals’ personal information on her website, which served as advertisement for her business, did so in the course of a commercial activity.
- A social networking site was found to be engaged in a commercial activity. In so finding, the OPC noted that the collection, use and disclosure of personal information for the purpose of enhancing the experience of users indirectly contributes to the success of the site as a commercial enterprise. In that sense, collection, use and disclosure of personal information in relation to a feature, without an apparent direct commercial link, can still be characterized as a commercial activity.
 This case was distinguishable from the State Farm case (described above) which involved an individual defendant acting in her personal capacity to defend herself against a civil tort claim by an individual plaintiff.