When is it necessary to collect personal information?
What is the notion of necessity under the Quebec Privacy Act?
How should companies determine what personal information is necessary to collect?
In this article, we break down the notion of necessity under the Quebec Privacy Act so you know what it means.
Are you ready?
Let’s get started!
Table of Contents
Collecting personal information for “serious and legitimate reasons”
Under the Quebec Privacy Act, a company or a person can create a file on another only if there is a serious and legitimate reason for doing so.
What does it mean “serious and legitimate reasons”?
So far, the Quebec jurisprudence on privacy law has not defined specifically what “serious and legitimate” means.
However, the Commission d’accès à l’information (CAI) has used the notion of “necessity” to decide when it may be reasonable to establish a file on someone.
Let’s look at how CAI has evaluated the notion of necessity as outlined in Article 5 of the Quebec Privacy Act.
“Necessity” under Article 5 Quebec Privacy Act
The criterion of necessity appears in Article 5 of the Quebec Privacy Act:
“Any person collecting personal information to establish a file on another person or to record personal information in such a file may collect only the information necessary for the object of the file.”
Under this provision, the law states that a person can collect information on another person when the information is “necessary” for the object of the file.
The courts have interpreted the notion of necessity to determine when it is reasonable for a person to collect personal information or not.
When is there a “necessity” to collect personal information?
The interpretation of the notion of necessity under the Quebec Privacy Act remains to be settled.
In certain cases, the Quebec Privacy Commissioner has interpreted the notion of necessity restrictively while in other cases more contextually.
There are currently three interpretation approaches under Quebec law.
Restrictive interpretation
Under the first interpretation approach, the courts interpret the notion of necessity restrictively.
In other words, for a person to collect personal information, the information must absolutely be indispensable (“nécessité inéluctable”) for the purpose of the file.
The reason the notion is interpreted restrictively is to give paramount importance to the goals and objectives of the privacy laws.
To protect personal information, the courts will authorize the collection of the information that is absolutely essential, if not, the collection will be in violation of the Quebec Privacy Act.
For example, an employee can justify his or her absence from work for medical reasons without having to produce a medical note unless the employer reasonably doubts the employee’s statement.
If a person does not “absolutely need” another’s social insurance number, that information must not be collected.
Contextual interpretation
A second interpretation approach is the contextual interpretation of the notion of necessity.
Under the Access To Information Act, the courts have analyzed “necessity” as it relates to public bodies carrying out their duties.
The courts have determined that there is a necessity if there is a purpose for which the information is being collected.
In other words, the information must be more than just useful to achieve the purpose.
If personal information is necessary to reasonably achieve the purpose for which it is collected, contextually the courts will authorize the collection.
This approach is more liberal and allows the collection of personal information in a broader range of circumstances so long as the information is more than useful to achieve the intended purpose.
Balanced approach
There is a third branch of interpretation of the notion of necessity that we can consider more of a balanced approach.
Again, in the context of the interpretation of the notion of necessity under the Access To Information Act, the Court of Quebec has ruled in favour of a more balanced approach in evaluating necessity.
The Quebec Court indicated that we must consider the purpose for which the personal information is collected while at the same time uphold the spirit of the Quebec Privacy Act.
As such, necessity must be evaluated in its context and in light of protecting the privacy of personal information in all instances.
In light of this balanced approach, it may not be possible to get to definitive objective criteria to define necessity.
Under the Quebec laws, the privacy of an individual is protected by the Quebec Charter and the Civil Code.
As a result, the courts must be sensitive to the protection of personal information.
If the legitimate and objective needs of a person to collect personal information override the invasion of someone’s privacy, then the collection of personal information should be authorized.
Is necessity important when a person consents to the collection?
In a nutshell, a person must be able to demonstrate the necessity to collect personal information whether or not the individual had given consent to the collection.
This is what the Quebec Courts have decided in the case Laval (Ville de) vs. X, [2003] IIJCan 44085 (C.Q.).
Concretely, this means that the collection of personal information will always require the demonstration of a “necessity” and a person must also provide his or her consent.
Consent and necessity are cumulative requirements.
Burden of proof
The burden of proof to collect personal information on the basis of necessity lies on the shoulder of the person invoking it.
Practically speaking, the burden of proof will always lie with an organization when collecting personal information.
Takeaways
Under the Quebec Privacy Act, a person can establish a file on another for legitimate and serious reasons and only the information that is necessary for the object of the file can be collected.
What does necessity mean?
The Quebec courts have interpreted necessity as follows:
- Restrictive interpretation: information that is “absolutely required” can be collected
- Contextual interpretation: courts must look at the context and determine if the information was necessary for the purpose
- Balanced approach: courts must look at the context to determine what is necessary to achieve the purpose in light of the spirit of the Quebec Privacy Act requiring the protection of all personal information
The Quebec courts have not defined an objective test to define what is necessary to achieve a purpose.
As a result, every case should be analyzed in its own context.
