Publication
title
Is Your Business E-mail Address Personal or Public Information?
DATE
February 8, 2005
The Office of the Privacy Commissioner of Canada responds to the Geist complaint
Does an individual's business e-mail address constitute "personal information" that is protected by privacy laws?
Until recently, the business world took it for granted that an individual's business e-mail address was unprotected information that could be disclosed publicly and used freely. After all, it is information that appears on almost every business card.
The Personal Information Protection and Electronics Document Act, S.C. 2000, c. 5 (PIPEDA), which has been in force since January 1, 2004, stipulates in s. 2 that the name, title, business address and telephone number of an employee of an organization are not "personal information" within the meaning of PIPEDA and are thus not protected by PIPEDA. Given the legislator's apparent intention in this act to distinguish between private life and professional life, the question arises whether the exception applies to all business addresses, regardless of the medium, especially considering that the second part of PIPEDA establishes the principle of "technological neutrality" for all documents.
It seems, however, that the Office of the Privacy Commissioner of Canada has not adopted a "broad" or "technologically neutral" interpretation. In fact, in its December 2004 response to a complaint of unlawful collection and use of a business e-mail address, the Office of the Privacy Commissioner expressed the opinion that this type of information is protected by law.
Michael Geist, a lawyer and professor at the Faculty of Law of the University of Ottawa, complained that the University's football team had used his business e-mail address on two occasions to sell him season tickets. According to the report, the complainant's e-mail address was posted on the University of Ottawa's internet site and on the internet site of the law firm with which he is associated.
The author of the report, Assistant Privacy Commissioner Heather Black, concluded that the e-mail addresses in question did constitute protected "personal information," pointing out in support of her reasoning that the name, title, business address and telephone number of an employee of an organization are the only exceptions provided for in PIPEDA and that e-mail addresses are not specifically mentioned.
Having reached this conclusion, the report considered whether or not the University could rely on exceptions provided under PIPEDA which allow the collection and use of "personal information" without the knowledge or consent of the individual if the information "is publicly available and is specified by the regulations." The report concluded that these exceptions did not apply because, although the complainant's e-mail address was publicly available on two internet sites, the use of that address by the University did not relate directly to the purpose for which the information had been made public. In other words, Professor Geist's business e-mail address was not posted on two internet sites in order to permit solicitation or marketing by the University's football team.
The report of the Office of the Privacy Commissioner is not legally binding, but PIPEDA provides that the complainant has 45 days to ask the Federal Court to rule on the issues raised in the complaint. Professor Geist, however, having made his point, has told the newspapers that he will not pursue the matter.
It has been observed in the newspapers that, in analysing the complaint, the Office of the Privacy Commissioner confined the meaning of "address" to a physical location (postal address) without entertaining the possibility of extending the concept to an electronic address and this interpretation does not take account of developments in business communications technology. It also raises the question of whether a business fax number constitutes protected "personal information" because it is not covered by the term "telephone number."
Another question is whether such an interpretation truly furthers the objectives of the Act, considering the resulting inconsistencies. For example, pursuant to section 2, the name, title, business address and business telephone number of an "employee" of an organization are not personal information. What about the same information of self-employed workers?
In British Columbia, provincial privacy legislation specifically excludes from the definition of "personal information" the business e-mail address and business fax number, as well as the name, title, business telephone number and business address. In Quebec, the Act respecting the protection of personal information in the private sector (R.S.Q. c. P-39.1) contains a broad definition of "personal information" which does not explicitly refer to an individual's business contact information. The interpretation favoured by the Office of the Privacy Commissioner in the Geist complaint could thus have an impact on the interpretation of Quebec privacy legislation, especially since the federal Privacy Commissioner has the power to consult the provincial authorities and to enter into agreements to standardize privacy practices.
Further thought needs to be given to this response of the Office of the Privacy Commissioner, which is the first to deal with e-mail solicitation since the federal law came into force. As Mark Hayes, a partner in our Toronto office, correctly pointed out in the Toronto Star, the finding of the Office of the Privacy Commissioner could require some fundamental changes to business practices, not just for marketing companies, but for everyday companies that have e-mail addresses for their business associates; hence the importance of asking the courts to clarify PIPEDA. The Geist complaint challenges the popular assumption that a business e-mail address falls under the exceptions provided in PIPEDA. But has the Assistant Commissioner's report sent a strong message to spammers? Given the limited powers of the Office of the Privacy Commissioner and the fact that the report is not legally binding, bulk spammers are unlikely to be worried.
The purpose of this document is to provide information as to developments in the law. It does not contain a full analysis of the law nor does it constitute an opinion of Ogilvy Renault or any member of the Firm on the points of law discussed.
Contacts
Christine A. Carron
Montréal
514.847.4404
ccarron@ogilvyrenault.com
Profile
Lukasz Granosik
Montréal
514.847.4996
lgranosik@ogilvyrenault.com
Profile
Martha A. Healey
Ottawa
613.780.8638
mhealey@ogilvyrenault.com
Profile
Kateri-Anne Grenier
Québec
418.640.5932
kgrenier@ogilvyrenault.com
Profile
Guy J. Houle
Montréal
514.847.4321
ghoule@ogilvyrenault.com
Profile
Anne K. Gallop
Toronto
416.216.4038
agallop@ogilvyrenault.com
Profile
