US Car Insurer Could Bring down Canada's Privacy Law

Later this month, the Federal Court of Canada will hear a case in Halifax that threatens Canada's privacy law framework. State Farm Mutual Automobile Insurance Co. is contesting the constitutional validity of Canada's private sector privacy legislation (PIPEDA), arguing it oversteps the federal government's jurisdictional power. If successful, PIPEDA would no longer apply to thousands of Canadian businesses and new legislation such as the Electronic Commerce Protection Act (ECPA) would be imperiled.

The case stems from a dispute over an insurance claim arising from a March 2005 automobile accident. Gerald Gaudet, the injured party, asked State Farm to provide copies of all names, addresses, and phone numbers of anyone to whom it disclosed his personal information (State Farm had used a private investigator to conduct surveillance on Gaudet). After State Farm refused to disclose the information, Gaudet filed a complaint with the Privacy Commissioner of Canada.

The Privacy Commissioner proceeded to launch an investigation into the case, asking State Farm to provide it with the requested information. The insurance company again refused, leading to the Federal Court case.

State Farm raises several issues in contesting the disclosure demands, but it is the constitutional arguments where the stakes are the highest. The constitutional question has dogged Canadian privacy law since it was first introduced, with the federal government arguing the Constitution grants it legislative authority to make laws in relation to trade and commerce. The trade and commerce power covers both inter-provincial and international trade as well as general trade and commerce regulation that affect the whole country.

From a privacy law perspective, the government recognized that in a world where a typical consumer transaction may involve a product originating in British Columbia, a retailer in Alberta, a credit card provider in Ontario, a call centre in New Brunswick, and an order fulfillment provider in Quebec, a national standard is needed since personal data traverses provincial boundaries with ease.

By creating PIPEDA but enabling provinces to enact their own "substantially similar" legislation (Quebec, Alberta and British Columbia have all done so), the government navigated a compromise between the interests of the federal and provincial governments.

This is not the first time PIPEDA's constitutionality has been raised. Days before it was scheduled to take effect in 2003, the Quebec government initiated its own constitutional challenge. That case is ongoing but has remained largely dormant.

The Supreme Court of Canada established the test for determining validity of legislation under the trade and commerce clause in a 1989 case involving General Motors. The court outlined five indicia to consider: (i) the legislation is part of a general regulatory scheme; (ii) the legislation is continuously monitored by a regulatory agency; (iii) the legislation is concerned with trade generally rather than with a particular industry; (iv) the legislation is of a nature that the provinces jointly or severally would be incapable of enacting; and (v) the failure to include one or more provinces within the legislative scheme would jeopardize the successful operation of the law elsewhere.

PIPEDA may have been crafted with these five indicia in mind, but there are no guarantees once the law is subjected to Federal Court scrutiny. If State Farm succeeds, PIPEDA would no longer apply within the provinces. Moreover, the government has since relied on the same analysis with other legislative initiatives, notably ECPA, the anti-spam bill that died with prorogation but could be reintroduced this spring.

PIPEDA was viewed as controversial when it was first introduced more than a decade ago. It is now well-entrenched within Canadian law, but the State Farm case presents a tough test that could radically alter privacy protections in Canada.