By Craig E .Jones, Q.C.
What is PIPA?
Originally there was a law called the Freedom of Information and Protection of Privacy Act (FOIPPA). That Act provided for the protection of information collected by government, as well as ‘quasi governmental’ entitles like universities and Crown Corporations. It also provides a process whereby members of the public can make “freedom of information requests” to gain access to government documents.
The more recent Personal Information and Protection of Privacy Act (PIPA) extends privacy protection into the private sector. PIPA governs the collection, use and dissemination of “personal information” by organizations beyond government. It dictates what can be done with personal information by companies as well as unincorporated associations such as unions, sports teams, societies, and clubs. Unlike FOIPPA, where the focus is on access to information as well as protection of privacy, PIPA is mainly directed at regulating the gathering, use, and release of personal information by private groups. A full text of the statute is available online: http://www.bclaws.ca/EPLibraries/bclaws_new/document/ID/freeside/00_03063_01
Why is my Creep Catchers Group Subject to PIPA?
Creep catchers groups are subject to PIPA because they are “unincorporated associations”, which are “organizations” under the Act. So as soon as the group gathers personal information, it must conform with the processes and restrictions of PIPA. This is why the Erb case is important: the Office of the Information and Privacy Commissioner has decided, at least on preliminary review, that Surrey Creep Catcher is an “organization”. They are now going to determine whether the SCC group has been operating in violation of the laws in the way it has gathered, used or disseminated personal information.
What is “Personal Information” under PIPA?
“Personal Information” includes almost any information connected to an individual. So, let’s say in response to a CC ad, someone reveals something about themselves (where they live, their name, age, email address, hobbies and interests, etc), then that group has just “collected” “personal information” as it is understood in the Act.
Prior decisions have also established that pictures and video recordings, even if taken in “public” places, also constitute “personal information” and are protected.
There is a general exemption under PIPA for information that I collected by private individuals for their own personal or domestic purposes. But as soon as an individual collects information for any other purpose, they become an “organization” subject to PIPA.
What are the Relevant Provisions for Creep Catchers?
The basic rule under PIPA is that organizations cannot collect, use or disseminate personal information without consent of the individuals involved. Consent must be free and “informed”. PIPA makes it clear that if information is gathered by deceit then there is no consent. So if a CC group receives responses from online interlocutors who think they are talking to a female ‘lure’ (whether of age of not), they are gathering information without consent. This gathering includes the confrontational videos made by groups.
The PIPA, however places many other obligations on an “organization”. It must, for instance, put in place a process for persons to register complaints or objections about the collection, use or release of the personal information it possesses. It must also provide a mechanism to challenge those kind of decisions, and designate an officer for these purposes. The Act sets out strict timelines for response to requests.
What are the Powers of the Commission?
Under the PIPA, the Commission has broad authority to conduct investigations, hold hearings, compel testimony, and make orders including for fines or the destruction of “personal information” in its possession. Refusing to cooperate or obstructing an investigation can lead to contempt proceedings enforced through the B.C. Supreme Court and other sanctions.
But… How Come Cops can Use “Stings”?
There are specific exemptions under PIPA and at common law to allow for legitimate collection of information in the course of criminal or other investigations.
What are the Penalties for Not Complying?
PIPA provides for fines up to $10,000 for individuals and $100,000 for groups, for every separate breach. It also provides for civil lawsuits if the Act is breached. There is also a stand-alone tort of invasion of privacy under the BC Privacy Act. Under that Act, a claim can be brought even if there is no proof of damage arising from the breach.
So Aren’t I Immune if I have No Money?
You may never have to pay a fine if you never have any money. However, if you are subject to an order that becomes a judgment debt, you may face seizure of your personal assets, including real estate, and garnishing of any bank accounts or wages from your employer. Bankruptcy can relieve you of some debts, including judgment debts, but does not apply to relieve you of the consequences of deliberate or malicious action. So the short answer is, you might be “immune” for the moment, but five or ten years down the road you might find your bank account empty or your home put up for auction.
By not following and understanding the Provincial and Federal Privacy Acts, you run the risk of ending up in a situation similar to that of Ryan LaForge and the Surrey Creep Catcher outfit.
Office of the Information and Privacy Commissioner (BC)
Order P17-03; Surrey Creep Catcher