Legal Issues: Privacy legislation and customer personal information 
by Michael A. Coady and Koml Kandola


Private sector employers and organizations in BC are governed by the Personal Information Protection Act (PIPA). PIPA describes how businesses must handle the personal information of employees, customers, and other individuals. An issue of potential concern to organizations in service industries such as the hotel business, is whether they are obligated to disclose customer information - such as information regarding past stays and visits - to law enforcement agencies. 
PIPA came into effect January 1, 2004. To date, very few decisions interpreting or applying its provisions to practical situations have been made.

What is “personal information”? 
PIPA applies to “personal information”, which is defined in the Act as “information about an identifiable individual and includes employee personal information, but does not include contact information, or work product information.”
“Contact information”, in turn, is defined as “information to enable an individual at a place of business to be contacted and includes the name, position name or title, business telephone number, business address, business e-mail or business fax number of the individual.”
“Work product information” means “information prepared or collected by an individual or group of individuals as part of the individual’s or group’s responsibilities or activities related to the individual’s or group’s employment or business, but does not include personal information about an individual who did not prepare or collect the personal information.”

The general requirement for consent, and exceptions to the rule 
Under PIPA, the general rule is that an organization cannot collect, use or disclose personal information about an individual without that person’s consent. However, PIPA provides for several exceptions to this rule. For example, PIPA could permit the disclosure of personal information about an individual, without that person’s consent, to the police or other law enforcement agencies in the following circumstances: 
1. Where it is reasonable to expect that disclosure with consent would compromise an investigation or proceeding, and the disclosure is reasonable for that purpose. PIPA defines a “proceeding” as “a civil, a criminal or an administrative proceeding that is related to the allegation of (a) a breach of an agreement; (b) a contravention of an enactment of Canada or a province; or (c) a wrong or a breach of a duty for which a remedy is claimed under an enactment, under the common law or in equity.” “Investigation” relates to the contravention of such agreements or enactments and other wrongdoing. 
Simply put, depending on the particular facts, this exception could allow a hotel to disclose personal information about a customer or former customer to the police where the information relates to a criminal investigation or proceeding regarding the customer (for robbery, fraud, or another criminal offence). 
2. Where the disclosure is to comply with a subpoena, warrant, or order issued by a court, person, or body with jurisdiction to compel the production of personal information. For example, if the police had a proper warrant to search a hotel’s guest registry database, disclosing such information without the guest’s consent would be permissible. 
3. The disclosure is to a public body or a law enforcement agency in Canada, concerning an offence under the laws of Canada or a province. A hotel could disclose personal information about customers without consent in these circumstances to assist the agency in an investigation, or deciding to undertake an investigation in regards to whether an offence has taken place, or to prepare for laying a charge. 
4. The disclosure is required or authorized by law. Some statutes may contain provisions which expressly authorize the disclosure of personal information under certain circumstances. 
Where privacy interests are involved, it is important to remember that each case will depend on its own facts. Businesses are well advised to obtain legal advice in advance of responding to such requests in order to determine how best to proceed. In addition, it is a sound practice to meet requests for personal information from law enforcement agencies by asking the agency representative to provide the authority for his or her request. By understanding these provisions, obligations, businesses subject to PIPA can go a long way towards complying with their obligations under the Act. 

Michael Coady and Koml Kandola are labour, employment, and human rights lawyers at Harris & Company. Michael’s direct line is 604-891-2213. Koml’s direct line is 604-891-2228.