A recent decision of the Alberta Privacy Commissioner found parties to a contract of purchase and sale and their law firms contravened privacy legislation when they improperly disclosed personal information about employees on the internet.
The privacy complaint arose out of the actions of two Alberta law firms representing parties in the sale of nine oilfield service companies. The breach involved the posting of employee personal information on SEDAR, a publicly accessible internet site. Canadian securities legislation requires public companies to disclose all material contracts on SEDAR. The employee personal information (including social insurance numbers and home addresses) was disclosed as a schedule to the contract of purchase and sale.
The Privacy Commissioner held the parties and the law firms accountable for breach of privacy and contravention of Alberta’s Personal Information Protection Act (“PIPA”). While the Commissioner noted that the parties to the purchase and sale had “exercised some care in attempting to discharge their duties under PIPA by retaining legal counsel to ensure the transaction complied with all aspects of the law,” the Commissioner found that the law firms did not exercise adequate diligence in their review and subsequent disclosure of the schedule.
Link to Report of an Investigation into the Disclosure of Personal Information During the Course of a Business Transaction, July 12, 2005, Investigation Report P2005-IR-005