ITBusiness.ca, which is consistently one of the best sources of privacy news in Canada, is reporting on a discussion of the fallout of the Englander decision. (For more info on the case, check out PIPEDA and Canadian Privacy Law: FCA hands privacy victory to the "little guy".)

Michael Geist expressed fears that the Englander decision, in which the Federal Court of Appeal reversed a finding of the federal Privacy Commissioner, may have exposed the Commissioner as toothless. She has no order-making powers and individuals have to pursue a remedy in the courts. Michael's comments are also informed by his recent experience as a success complainant in a ground-breaking spam decision, in which the Assistant Commissioner concluded that his work e-mail address is "personal information", notwithstanding the definition of personal information in the Act. Many of the comments he has received suggest that many think the finding is of little value unless it is taken to the Federal Court for enforcement. (Others, I might add, want it to go to the Court to be reversed.)

Telus case calls role of Privacy Commissioner into question:

"1/11/2005 5:00:00 PM - After an appeals court supports Matthew Englander's right to keep his name out of the phone book, experts are left wondering what power the federal office really has. Also: where PIPEDA fits in

A recent federal court decision to overturn one of the Privacy Commissioner of Canada's first findings under the country's privacy act has raised questions about how well the Commissioner can enforce the law."

From a consumer's point of view, one of the harshest lessons to be learned from Mathew Englander's experience is that going to the Court is not to be taken lightly. He disagreed with the Commissioner's finding, so he took it to the Federal Court. The Court upheld the Commissioner's finding and hit Mathew with $18,000 in costs. He was ultimately vindicated by the Court of Appeal, but the message sent by the Court is loud and clear: only advocacy groups or well-funded consumers should take the risk of going to court. The Commissioner's office can go to court on behalf of a complainant, but they are under huge budgetary constraints and I don't think they'll go to have their own finding reversed.

Labels: information breaches, privacy