|
Appeal-Judicial Review - Fairness - Tribunal Independence. LifeLabs LP v. Information and Privacy Commr. (Ontario)
In LifeLabs LP v. Information and Privacy Commr. (Ontario) (Div Court, 2024) the Divisional Court dismisses a JR from an Ontario Privacy Commissioner's interlocutory order during an investigation which ruled against the applicant's privilege claims.
The court examines 'tribunal independence', and locates breach of that as an aspect of procedural fairness - here where an Ontario privacy tribunal conducted a joint investigation with a BC tribunal where facts so required:Standard of Review: Independence of the Tribunal and the Issue of Procedural Fairness
[60] LifeLabs submits that the ON IPC lacked independence by collaborating and deliberating with the BC IPC in making the Privilege Decision. Independence is a question of procedural fairness: Bell Canada v. Canadian Telephone Employees Assn., 2003 SCC 36, [2003] 1 S.C.R. 884, at para. 21.
[61] It is well settled law that a tribunal must conduct its proceedings fairly. Procedural fairness is determined with reference to the circumstances of the case, including the factors articulated in Baker v. Canada (Minister of Citizenship and Immigration), 1999 CanLII 699 (SCC), [1999] 2 S.C.R. 817, at paras. 21-28. In Mission Institution v. Khela, 2014, SCC 24, [2014] 1 S.C.R. 502, at para. 79, a unanimous Supreme Court characterized this as a correctness standard. More recent decisions from this court simply apply Baker without otherwise identifying a standard of review: See Mundulai v. Law Society of Ontario, 2024 ONSC 959, at para. 30, and M.I. v. Administrator, Ontario Works Region of Peel, 2024 ONSC 1975, at para. 8.
....
2. Did the ON IPC fail to act independently by jointly determining the issue with another regulator?
[97] LifeLabs submits that in deliberating with the BC IPC, the ON IPC allowed itself to be “influenced” by another regulator, thus failing to grant LifeLabs an independent hearing of the privilege issue by a tribunal that was also seen to be independent: Canadian Pacific Ltd. v. Matsqui Indian Band, 1995 CanLII 145 (SCC), [1995] 1 S.C.R. 3, at para. 80.
[98] Further, LifeLabs relies on the PHIPA, and the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act, 2019 as authority for its position that neither of these pieces of legislation allow for joint deliberation with other privacy commissioners in Canada. LifeLabs draws a distinction between the provisions in PHIPA and in the Personal Information Protection Act, S.B.C. 2003, (“PIPA”) which authorize a coordinated investigation.
[99] The relevant passages in s. 36(1) of the PIPA empower the commissioner to monitor the administration of the Act, and ensure its purposes are achieved, including by being able to:...
(k) exchange information with any person who, under legislation of another province or of Canada, has powers and duties similar to those of the commissioner;
(l) enter into information-sharing agreements for the purposes of paragraph (k) and into other agreements with the persons referred to in that paragraph for the purpose of coordinating their activities and providing for mechanisms for handling complaints. [100] Similarly, s. 66(e) of the PHIPA empowers the Commissioner, to “assist in investigations and similar procedures conducted by a person who performs similar functions to the Commissioner under the laws of Canada, except that in providing assistance, the Commissioner shall not use or disclose information collected by or for the Commissioner under this Act.” Sections 68(3)(a) and (b) of the PHIPA permits information sharing with bodies legally entitled to regulate or review the activities of the custodian.
[101] The record reveals that the joint investigation reflected the fact that the majority of Canadians whose personal health information was involved in the data breach lived in Ontario and British Columbia. LifeLabs was advised that the investigation would address the scope of the attack, the circumstances that led to it and the measures that LifeLabs ought to have taken to prevent and to remediate it in compliance with its obligations under PHIPA and PIPA.
[102] In furtherance of the joint investigation, the Commissioners signed a Memorandum of Understanding, which agreed neither would exercise authority over the other that could affect the Commissioners’ independence. The ON IPC and the BC IPC advised LifeLabs that they would be jointly investigating and would issue a single Investigation Report with “our” findings. During the investigation and prior to the Privilege Decision, the ON IPC and the BC IPC jointly ruled on questions of privilege claims over two discrete documents.
....
[108] The requirement that a decision maker be independent is a component of the rule against bias: see Bell Canada v. Canadian Telephone Employees Association 2003 SCC 36, [2003] 1 S.C.R. 884, at para. 17. Fairness in decision-making by administrative agencies depends on independence, which is measured against the test found in Committee for Justice and Liberty v. National Energy Board, 1976 CanLII 2 (SCC), [1978] 1 S.C.R. 369, at p. 394 – that is, what the informed person would conclude, viewing the matter realistically and practically, having thought the matter through.
[109] I find that there is no merit to the argument that the Privilege Decision raises issues of independence. The Privilege Decision was made jointly within the larger context of a joint investigation for which there was statutory authority. To publicly report on the investigation itself, the ON IPC and the BC IPC were required to make findings on confidentiality and the claims of privilege. This was an inquisitorial process, which means that the investigative and adjudicative functions were required to inform the ultimate report to the public.
[110] I find that an informed person would conclude that there was no apparent bias or lack of independence arising from the jointly issued Privilege Decision. Two independent provincial agencies, with similar mandates undertook a transparently joint investigation that included making orders and decisions such as the Privilege Decision. This was all done in furtherance of preparing a final investigative report to inform the public. Both regulators have the statutory authority to coordinate and share investigations in privacy matters. There is ample precedent for joint investigations undertaken by various Canadian privacy regulators.[5] LifeLabs did not put before the Court any challenge to any prior joint investigation. This practice reflects the reality that data breaches are not confined to provincial boundaries.
|
