On May 31, 2024, the Commission d’accès à l’information (CAI) rejected three applications for the examination of a disagreement, grouped in Bérubé v. Fédération des caisses Desjardins, 2024 QCCAI 130 (available only in French). This decision serves as a reminder regarding a few important principles for organizations to keep in mind when responding to access to personal information requests, in accordance with the Act Respecting the Protection of Personal Information in the Private Sector (ARPPIPS).
A brief overview of the context: Repeated access requests
In this case, the plaintiff disputed responsibility for a credit card balance that the company had assigned to her jointly with her ex-spouse.
In order to obtain more details about this credit card, which she claimed she had never applied for nor signed, the plaintiff made repeated access requests. The documents in dispute included the initial contract for the joint credit card as well as the notes in the plaintiff’s file.
Takeaways
The scope of the organization’s search obligation
The CAI reiterated that an organization that receives an access to personal information request is required to carry out a complete and serious search. This is not an obligation of result, but rather an obligation of means.
In this case, the company presented conclusive evidence that it had fulfilled this obligation, even though it had been unable to obtain the original credit card contract. In the face of this evidence, it was up to the plaintiff to provide contrary evidence and go beyond mere allegations, demonstrating that the company had not carried out sufficient research; the plaintiff was unable to reveal any flaw in the company’s research.
Solicitor-client privilege
The CAI concluded that certain notes in the file, which reproduced almost verbatim exchanges between the company’s employees and its in-house lawyers, were inaccessible to the plaintiff because they were protected by solicitor-client privilege.
In its analysis, the CAI applied the three criteria developed in Solosky v. The Queen, [1980] 1 S.C.R. 821, to determine whether information is protected by solicitor-client privilege:
- it must be a communication between a lawyer and its clients;
- connected to seeking or giving legal advice;
- which the parties consider to be confidential.
Since disclosure of the notes on file would have revealed the nature of the advice and opinions given by the lawyers within the scope of the mandate entrusted to them, they are protected by the solicitor-client privilege enacted by section 9 of Québec’s Charter of Human Rights and Freedoms (the Charter).
The restriction of the right of access for litigation-related information
The CAI also upheld the refusal to disclose certain notes in the file pursuant to section 39(2) of the ARPPIPS, on the grounds that their disclosure could have an impact on ongoing judicial proceedings.
To reach this conclusion, the CAI examined the four conditions for the application of section 39(2) of the ARPPIPS, as defined by the Superior Court in La Personnelle Vie, Corporation d’assurance v. Cour du Québec, [1997] R.J.Q. 2296 (available only in French):
- The requested document must contain personal information about the person who wishes to have access to it.
- The refusal must be related to an ongoing judicial proceeding (in this case, a liability action had already been instituted before the Court of Québec).
- Disclosure of the information must be likely to have an effect on the judicial proceedings.
- The risk of judicial proceedings and the effect of disclosure must be assessed at the time of refusing access to the requested information.
Section 39(2) of the ARPPIPS allows an organization to refuse to disclose personal information that is not necessarily protected by solicitor-client privilege within the meaning of section 9 of the Charter. Neither is it necessary for the effect on the judicial proceedings to be decisive, either favourably or unfavourably, on the outcome of the proceedings. Any effect is sufficient, since the purpose of section 39(2) of the ARPPIPS is to prevent premature disclosure of evidence that would have the effect of advantaging the author of an access request to the detriment of the organization subject to that request.
In this case, the notes on file contained information relating to the processing of the plaintiff’s file and access requests. It was therefore obvious, in the CAI’s opinion, that their disclosure could have an effect on the liability action instituted before the Court of Québec, since these notes could constitute evidence used by the company to support its defence and justify its actions and behaviour.
Contact us
BLG’s Cybersecurity, Privacy & Data Protection Group follows legal developments in order to help organizations navigate the requirements of Canadian data protection laws. Make sure to reach out to our team if your organization is seeking assistance with processing access to personal information requests.
