LCBO Loses Privacy Dispute over Wine Club Member Information
The Liquor Control Board of Ontario has lost a protracted dispute with the Information and Privacy Commissioner (IPC) over its right to collect the personal information of wine club members in the recent case of Liquor Control Board of Ontario v. Vin De Garde Wine Club, 2015 ONSC 2537.
The Liquor Control Board of Ontario has lost a protracted dispute with the Information and Privacy Commissioner ("IPC") over its right to collect the personal information of wine club members in the recent case of Liquor Control Board of Ontario v. Vin De Garde Wine Club, 2015 ONSC 2537.
The LCBO has agreements with wine clubs to allow them to make special orders for products not available in LCBO retail stores. Individual members register with a wine club and make specific orders through the club.
The wine club Vin de Garde lodged a complaint with the Privacy Commissioner concerning the LCBO's recent practice of requiring the names and addresses of each wine club member, and the associated wines ordered, be provided with each order submitted by the wine club. Vin de Garde complained that the LCBO was wrongfully collecting "personal information", as defined by the Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c.F.31 ("FIPPA").
In February 2012, the Privacy Commissioner held that the LCBO did not have the right to collect individual members' private information, and issued a Cease Collection Order to the LCBOThe Divisional Court struck that Order on the grounds that it lacked procedural fairness, and sent the matter back to the Commissioner.
The Privacy Commissioner reaffirmed its initial decision in its Reconsideration Order of January 2014. It noted that under FIPPA, a government agency like the LCBO is only entitled to collect personal information if it is expressly authorized by statute, used for the purposes of law enforcement, or "necessary to the proper administration of a lawfully authorized activity". Further, the LCBO's collection of personal information of wine club members was not necessary to prevent fraud or to ensure compliance with the regulatory scheme.
The LCBO once again sought judicial review of the Reconsideration Order, this time challenging the IPC on the substance of the decision. In May, the Divisional Court dismissed the LCBO's application. It held that the standard of review was reasonableness, since the IPC was applying its home statute, FIPPA, to the liquor licensing regime for the limited purpose of determining whether the collection of personal information was necessary.
The LCBO argued that the IPC applied too high a standard on the necessity of the collection of information, suggesting that the word "necessary" in s.38(2) of FIPPA means reasonably necessary rather than absolutely necessary. The Divisional Court agreed with the IPC that a "reasonably necessary" approach would be inconsistent with the privacy legislation and the leading case law, and would create too low a standard for the protection of personal information.
The Divisional Court's decision is further evidence of a trend toward the strict application of privacy legislation to protect the public's private information. The court's decision also displayed significant deference to the Privacy Commissioner's nuanced analysis of the privacy regime. Although the LCBO correctly collects personal information of its customers for other purposes, each collection policy must be reviewed for necessity on its own merits.