BC court confirms application of provincial privacy law to federal political parties
In a decision handed down May 14, the BC Supreme Court ruled that the findings of the provincial Information and Privacy Commissioner’s delegated adjudicator, former Commissioner David Loukidelis, confirming application of the province’s Personal Information Protection Act (PIPA) to federal political parties (FPPs), were correct. Those findings determined that PIPA applies in full measure to the FPPs, without exception.
The background to the Court’s decision as well as certain additional constitutional/jurisdictional issues argued before the adjudicator but not addressed on the judicial review application[1] are set out in my April 2022 Compliance Bulletin – see link.
Implications of the ruling
The ruling has significance beyond the confines of the province. PIPA’s privacy compliance framework is equivalent to that of the federal law, the Personal Information Protection and Electronic Documents Act (PIPEDA), which, to date has not been extended expressly to the FPPs. The FPPs that brought the judicial review application[2] had sought to quash the former Commissioner’s findings, in part by arguing that the privacy regime applicable to them under the Canada Elections Act (CEA) was not only sufficient but that in exercise of the federal power to regulate elections, it conflicted with and therefore pre-empted any application of PIPA to the FPPs. Alternatively, they argued that the PIPA regime was unconstitutional.
The Court’s decision, if not reversed in an appeal,[3] means that, while the FPPs will be subject to PIPEDA-like rules within BC, the practical effect will be that they will adopt PIPEDA-compliant procedures in all provinces and territories, except to the extent that any local jurisdiction’s law applies and differs from PIPEDA. The FPPs will follow this course because they will not want to be perceived as providing privacy rights in one part of the country that are more extensive than elsewhere.
The issues before the Court
The arguments before the Court focussed on the constitutional grounds for challenge – that the federal law, the CEA, was paramount or, alternatively, that by the doctrine of “interjurisdictional immunity” PIPA impairs the “core” power of the federal government to regulate national elections and therefore its application should be ousted.
However, the FPPs also argued, and the Court ruled on, a number of ancillary considerations, any one of which if successful could have resulted in the adjudicator’s rulings being reversed or at least sent back to the OIPC for reconsideration. These ancillary issues included: (i) whether 2023 amendments to the CEA,[4] which essentially require the FPPs to have privacy policies stipulating how they can collect and use voters’ information, should be considered even though coming into law subsequent to the adjudicator’s decision; (ii) that the adjudicator’s hearing and determinations failed the requirement of procedural fairness on a number of grounds; (iii) that the FPPs were not “organizations” under PIPA and it therefore did not apply; and (iv) that further recent, proposed, amendments to the CEA which sought to address deficiencies in the 2023 amendments including providing enhanced enforcement authority for the Chief Electoral Officer under the CEA,[5] should be considered by the Court in making its ruling.
The Court declined to consider the 2023 amendments or the 2024 proposed amendments and determined that the adjudicator did not breach his duty of procedural fairness.
The Court concurred with the constitutional analysis set forth by the adjudicator in his determinations.
Are FPPs “organizations” subject to PIPA?
The FPPs’ argument that they are not “organizations” within the defined application of PIPA was in essence one of constitutional application.
FPPs are unincorporated associations (meaning that they are not per se legal entities) included within the defined term “organization” to which PIPA expressly applies. However the FPPs argued that the term is capable of different interpretations – one of which would exclude extension to the FPPs since only Parliament can legislate oversight of federal elections. While not addressed as such, this argument essentially comes down to the question of the constitutional validity of PIPA’s application to federal political parties. The Court however analyzed this issue in the context of established case law which holds that a provision in a provincial statute that is determined to be ambiguous should be read in a manner consistent with a federal constitutional power – in this case the power to regulate elections. The Court agreed with the adjudicator that the term “organization” as defined is not ambiguous and therefore any such narrower reading that would exclude federal parties is not appropriate.
Is PIPA inoperative based on federal paramountcy?
The doctrine of federal paramountcy states that a provincial law is inoperative to the extent that it is incompatible with federal legislation. Incompatibility can result from either an “operational conflict” – meaning that compliance with the federal law would be impossible if the provincial law were complied with – or frustration of the purpose of the federal law by the provincial law. However the principle of “cooperative federalism” makes clear that when a federal law can be interpreted so as not to interfere with a provincial law, the interpretation that avoids conflict should be adopted.
Applying these principles, the Court determined that there is no operational conflict between the provisions of the CEA relating to privacy – the limited requirements for the FPPs to have a privacy policy, and to comply with it, and providing a limited oversight role for the Chief Electoral Officer – and the comprehensive privacy regime set forth in PIPA.
The Court concluded therefore that the adjudicator’s determination that there was no operational conflict that would oust the jurisdiction of the provincial law over the FPPs was correct.
The Court also considered whether the second basis for application of the paramountcy doctrine – frustration of a federal purpose – applied. To establish this basis there must be a clear and valid purpose of the federal statute, and the provincial law must be incompatible with such purpose. In this regard, agreeing with the adjudicator, the Court concluded that there was no evidence of a clear federal purpose to establish a regime to govern the collection and use of personal information by federal political parties. The CEA provisions simply requiring the FPPs to have privacy policies did not suffice.
While acknowledging Parliament’s authority to establish a comprehensive, and exclusive, regime in respect of the collection and use of personal information by FPPs, the Court determined that the relevant CEA provisions cannot be read to support creation of such a regime. Furthermore, it found that the provisions of the CEA addressing the contents of the FPPs’ privacy policies – such as a statement of the types of information collected and how it is used, and providing the contact information of the person to whom any concerns can be addressed – do not conflict with the comprehensive privacy regime set forth in PIPA. Instead, again agreeing with the adjudicator, it found the interplay between the two regimes to be “a perfect illustration of cooperative federalism” – the concurrent application of both federal and provincial legislation.
In concluding that the PIPA provisions are not incompatible with the CEA, the Court stated that:
[t]he provisions of PIPA neither stifle FPPs’ ability to engage people in politics nor frustrate any valid federal purpose in that regard. Any practices authorized under CEA are not impacted by PIPA. The FPPs are free to collect and use personal information as they have been.
In sum, the Court concluded that the limited privacy-related provisions of the CEA do not establish a comprehensive privacy protection regime as would conflict with, and therefore oust, the application of such a regime under PIPA.
Are the PIPA provisions unconstitutional under the doctrine of interjurisdictional immunity?
The doctrine of federal-provincial interjurisdictional immunity protects the “core” of each head of federal and provincial power under the Constitution Act from being impaired by legislation at the other level of government. As stated by the Court, it is premised on the concept that each head of power has a “basic, minimum and unassailable content” that must be protected from impairment in order to make the power effective for the purpose for which it was conferred. The doctrine applies even if there is no conflict between the two laws: the mere fact that a provincial law affects a vital part of an area of exclusive federal jurisdiction is enough to render it inapplicable with respect to a federal undertaking, regardless of whether or not Parliament has enacted any laws or taken any specific action with respect to the jurisdictional area of the undertaking.[6]
The FPPs sought to establish the proposition that a law affecting any political activity in any way related to or associated with a federal election can only be enacted by Parliament – in other words, Parliament has exclusive jurisdiction in regard to legislating with respect to federal elections. Specifically, they argued that the right of citizens to freedom of speech in federal elections is a protected core power that is impaired by PIPA. The Court disagreed, stating that:
[r]equiring FPPs to disclose to citizens, on request, the personal information they have about the citizen, together with information as to how it has been used and to whom it has been disclosed has no impact on the core federal elections power. It does not destroy the right of British Columbians to engage in federal election activity. At most, it may have a minimal impact on the administration of FPPs.[7]
Therefore, the Court concluded that the doctrine of interjurisdictional immunity was not triggered and does not apply to oust the application of PIPA to the FPPs.
Subsequent amendments to the CEA
Subsequent to the OIPC adjudicator’s ruling, the federal government introduced amendments to the CEA which sought to respond to the determination that the CEA does not create a comprehensive privacy regime that would be impaired by the PIPA provisions. Specifically, the amendments (adopted in June 2023) expressly provided that the FPPs may collect, use, disclose, retain and dispose of personal information in accordance with their privacy policies, and that the purpose of the CEA regime was “to provide for a national, uniform, exclusive and complete regime applicable to registered parties and eligible parties respecting their collection, use, disclosure, retention and disposal of personal information”.
In testimony before the parliamentary committee that considered these amendments,[8] both the Chief Electoral Officer and the federal Privacy Commissioner stated that the added provisions were inadequate to establish a comprehensive privacy regime, including by pointing to the lack of minimum standards and substantive rights and the limited oversight/enforcement that would be provided by the Chief Electoral Officer.
The Court declined to consider whether the amendments would alter the adjudicator’s determinations, indicating that they do not have retrospective effect.
Sensing that the 2023 amendments would be inadequate to establish the constitutional exclusivity of the CEA, the government has tried again to tweak the legislation with a further amending bill, introduced in March 2024,[9] that expands the provisions of the 2023 amendments addressing what should be included in a party’s privacy policy[10] and adds a more express oversight power in the Chief Electoral Officer to oversee and scrutinize the parties’ policies. The Court declined to consider whether this further amending bill should have any impact on its determinations, indicating that, having received only first reading, the bill does not have any legal effect.
Conclusions
It is clear from the Court’s decision that the federal government has the constitutional power to regulate all aspects of privacy in connection with federal elections, including as applicable to the federal political parties. Exercise of such power pursuant to a comprehensive privacy law would pre-empt application of a provincial privacy law such as PIPA, to the FPPs. However the provisions of the CEA, as in force at the time of the OPIC adjudicator’s ruling, do not accomplish such a result. Whether the subsequent amendments and proposed amendments to the CEA would accomplish this result was not addressed by the Court.
Such a comprehensive law would include basic privacy rules such as the right of access to information, effective oversight, and an appropriate complaint mechanism.
It is mystifying why the federal parties are fighting so hard to oppose oversight through comprehensive privacy laws such as PIPA and PIPEDA. The FPPs argue that application of a comprehensive privacy regime to them such as would be provided by those laws is not required and not appropriate.[11] However, the practical effect of the Court’s decision, if not reversed in any appeal or subsequent consideration of the amendments and proposed amendments to the CEA, means that the FPPs will be subject to PIPEDA-like rules within BC, and most likely, that they will be compelled to adopt such procedures across Canada.
For more information please contact: David Young 416-968-6286 david@davidyounglaw.ca
Note: The foregoing does not constitute legal advice. © David Young Law 2024
Read the PDF: BC court confirms application of provincial privacy law to federal political parties
[1] Constitutionality of PIPA; whether FPPs are “federal works”.
[2] Liberals, PCs, NDP.
[3] The FPPs have 30 days to appeal the decision to the BC Court of Appeal, following which a further appeal could be sought before the Supreme Court of Canada.
[6] Decision at para. 172 citing the Supreme Court of Canada’s decision in British Columbia (Attorney General) v. Lafarge Canada Inc; (2007 SCC 23).
[7] Decision, para. 182.
[8] Senate Standing Committee on Legal and Constitutional Affairs.
[10] Including an obligation to protect the personal information of individuals with appropriate security safeguards and an obligation to take appropriate steps to respond to a privacy breach, including notifying affected individuals.
[11] Decision, para. 155.