In its most recent Annual Report to Parliament, the Office of the Privacy Commissioner (OPC) highlights [three recent consent-related investigations](https://www.priv.gc.ca/en/opc-actions-and-decisions/ar_index/202324/ar_202324/) under the Personal Information Protection and Electronic Documents Act (PIPEDA). This reflects the role of consent that is [“the cornerstone of PIPEDA.”](https://www.priv.gc.ca/media/1806/consent_201605_e.pdf) However, there are exceptions to PIPEDA’s consent requirements, two of which are the focus of this post: the [consent exceptions for prospective and completed business transactions](https://laws-lois.justice.gc.ca/eng/acts/p-8.6/page-2.html#docCont). 

## Business Transaction Exceptions
These exceptions, at sub-sections 7.2(1) and section 7.2(2) of PIPEDA respectively, allow organizations to “use and disclose personal information without the knowledge or consent of the individual.” This use and disclosure is limited to what is necessary for the transaction or the relevant business activities and the organizations must enter into an agreement regarding the use and security of the information. For completed transactions, the organizations must inform the individual about the disclosure of their information, and the acquiring organization must agree to give effect to any withdrawal of consent applications made under Schedule 1, 4.3.8 of PIPEDA. According to the definition of business transactions in 2(1), these provisions apply to acquisitions, divestitures, mergers, licensing, and certain financial arrangements. Both of the exceptions outlined above also remain unchanged at [section 22 of Bill C-27](https://www.parl.ca/DocumentViewer/en/44-1/bill/C-27/first-reading), PIPEDA’s proposed replacement. 

These provisions shield mergers and acquisitions that involve personal information from the need to secure consent from the individuals whose information is being transferred. While individuals must be notified and can withdraw consent, the transfer still takes place without consent and these exceptions are therefore a departure from the important role of consent in PIPEDA. While other exceptions to consent exist for situations such as legal proceedings, investigations, journalism, and cases where collection is clearly in the interest of the individual, those exceptions generally serve individuals or the public interest where the business transaction exceptions enable private transactions. 

Although it does not appear to have received attention to date, prioritizing mergers and acquisitions over the principle of consent in PIPEDA merits scrutiny. Consumers or other individuals might choose to share their information with a given company based on its track record on privacy and security or its interpretation and implementation of PIPEDA requirements. They might also consider broader values such as the company's ethics or whether a company is local to their area. Making these choices is one of the few ways that consumers can influence companies, especially with regard to their privacy and security policies. PIPEDA’s business transaction exemptions undermine this source of consumer agency and market discipline by circumventing the principle of consent.  

## Lack of Attention from the Office of the Privacy Commissioner (OPC)
PIPEDA does limit the above exceptions through sub-section 7.2(4), which stipulates that they do not apply to transactions whose “primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information.” However, the OPC unfortunately does not appear to have ever applied 7.2(4) to scrutinize a business transaction. Its scope therefore remains unclear and this issue does not seem to be a priority for the OPC. Instead, the primary example of the OPC assessing a business transaction comes from their [investigation into Marriott International Inc](https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-005/), regarding a security breach affecting a database the company had acquired through its purchase of Starwood Hotels. The OPC is therefore alive to the transfer of personal information between business entities but has not yet focused on the consent implications of these transactions. 

## Possible Attention Through the Competition Act
Given that this consent issue arises mostly in the context of mergers and acquisitions, the [merger review process](https://competition-bureau.canada.ca/mergers-and-acquisitions/overview-merger-review-process) of the Competition Act is relevant. Two recent examples illustrate this intersection well:  

- the [Rogers-Shaw merger](https://about.rogers.com/news-ideas/rogers-closes-transformative-merger-with-shaw/) that [one committee submission](https://www.ourcommons.ca/Content/Committee/432/INDU/Brief/BR11324705/br-external/Jointly1-e.pdf) identified as a “’big data’ deal” that would “put the personal data of 18.2 million Canadians…at stake,” and  

- [RBC’s recent acquisition of HSBC Bank Canada](https://www.theglobeandmail.com/business/article-rbcs-purchase-of-hsbc-bank-canada-accompanied-by-a-complex/), that resulted in the data of over 780,000 customers being transferred 

These examples demonstrate the growing [role that data is expected to play in competition policy](https://globalprivacyassembly.org/wp-content/uploads/2021/10/Privacy-and-data-protection-as-factors-in-competition-regulation.pdf), which is in turn reflected in the addition of [consumer privacy as a factor](https://competition-bureau.canada.ca/how-we-foster-competition/education-and-outreach/publications/guide-2022-amendments-competition-act#sec05) for the Competition Bureau and Tribunal to consider assessing the competitive impact of a merger. The OPC itself actually [recognized and drew attention](https://www.priv.gc.ca/en/opc-actions-and-decisions/submissions-to-consultations/sub_sen-ont_211221/) to exactly this privacy issue in its submission to the [2021 consultation on the Competition Act](https://www.colindeacon.ca/projects/competition-consultation) which led to the 2022 amendments. However, while scrutinizing the competitive effects of data transfers is important, this process is not oriented towards the individuals whose information is being transferred without their consent.   

## Bringing in Consent
As data becomes increasingly [important to businesses](https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-data-driven-enterprise-of-2025) and as consumer information is treated as an asset that changes hands in business acquisitions, the privacy implications of mergers should receive more attention. Whereas the exceptions detailed above enable the tradability of personal information, if the principle of consent at the heart of PIPEDA’s privacy protections is to be preserved, this should be reconsidered. Legislative reform could reassess whether private transactions should trump the principle of consent, but in the meantime the OPC could make greater use of the tool available to it through subsection 7.2(4). 

Commentary

medium_Untitled design (2).png

small_Untitled design (2).png

thumbnail_Untitled design (2).png

Untitled design (2).png

Personal Information in Mergers – Where is Consent? 

Virtual reality headsets may be the next frontier in immersive entertainment, but the cutting-edge technology could also be the next frontier of privacy issues with a new way to secretly record people.  

Some commentators are celebrating the new Apple Vision Pro headset for offering an immersive experience that’s the best in the market so far and a [“startling glimpse of the future.”](https://www.theguardian.com/commentisfree/2024/feb/15/i-tried-out-an-apple-vision-pro-it-frightened-me) The device is built with a litany of sensors and cameras that track the users’ eyes and gestures, but also the world around them with front-facing cameras. 

These cameras can record video, just like a smartphone. But unlike a smartphone, Apple and Meta (the makers of the Meta Quest 3) built a constant visual cue into the device to tell the people around the wearer they are being recorded. With the Vision Pro, the headset’s front screen flashes white continuously while recording. In contrast, when the user is in an immersive app, the front of the device turns blue. With the Meta Quest 3, one of the lights on the front of the device [blinks when the front-facing cameras are recording.](https://www.meta.com/help/quest/articles/getting-started/getting-started-with-quest-3/led-indicators-quest-3/)

The relatively niche gadgets are becoming more mainstream, but the public might not fully know how the devices’ built-in privacy measures work. Apple and Meta’s efforts at transparency and safety are laudable - it’s a visual clue to bystanders that they are being recorded - but there may still be issues with using the technology in some places.

A person can be charged with the [crime of voyeurism in Canada](https://laws-lois.justice.gc.ca/eng/acts/c-46/section-162.HTML) if they secretly observe or record another person who has a reasonable expectation of privacy when,
A.	The other person is in a “safe place,”
B.	The other person is nude or having sex, or 
C.	If the person doing the recording is recording for a sexual purpose.  

In the 2023 case [_R v Downes_](https://decisions.scc-csc.ca/scc-csc/scc-csc/en/item/19734/index.do), the Supreme Court of Canada found that Canada’s Criminal Code defines some places as “safe places,” where people should be free from privacy intrusions. “Safe places” include places like bedrooms, bathrooms and change rooms. It doesn’t matter if the person is nude or could be expected to be nude, someone should never secretly record them there. 

This could be a problem for people using the Apple Vision Pro, or any other VR headset, in a “safe place” — like a shared bedroom. Nefarious users could take advantage of new VR headsets’ capabilities to commit voyeurism.

Both Apple and Meta’s headsets tell bystanders when VR devices around them are recording, but the issue is that this isn’t a well-known feature. In 2024 it’s relatively common knowledge that when a smartphone is pointed at you it could be recording. But a headset? Likely not — even with the built-in safety features. A person who wants to record using their headset secretly might be able to take advantage of the lack of public VR knowledge. For the general public, it’s yet another digital device to be mindful of. 

The technology is not nearly as common as a smartphone due to, among other reasons, its high price. The Apple Vision Pro costs approximately $4,800 in Canada and the Meta Quest 3 retails for $650. The technology is so new and niche that many people might not realize they are being recorded on headsets.  

There is also the issue that bystanders may believe the person wearing the headset can’t see them. Headsets are most often used to explicitly shut out the outside world and ensure you can’t see it. For example, early VR headsets such as Google Cardboard or the Samsung Gear VR were completely opaque to the outside world. This isn’t always the case with more modern devices. 

The Apple Vision Pro’s Eyesight feature allows the person wearing the headset to see into the real world in front of them through a video feed on the inside of the device. To the person wearing the headset, it looks like the app windows are floating in front of them as they are superimposed on top of the video feed. It lets the wearer use the augmented reality capabilities of the headset while still being aware of what’s happening around them.

In 2023, there were estimated to be approximately [171 million VR users worldwide](https://drawandcode.com/learning-zone/how-many-people-use-virtual-reality/#:~:text=As%20of%202023,%20there%20are,171%20million%20VR%20users%20worldwide.), according to VR developer Draw and Code. For comparison, in 1998 an estimated [188 million people used the internet worldwide.](https://ourworldindata.org/internet) VR is at a similar inflection point as the Internet was in the late 1990s. The time is ripe for to protect non-users from harm. 

It’s not an impossible issue to fix. For example, the Apple Vision Pro has a full screen on the outside of the device — why not have the word “recording” display on it while the device is taking a video? Or with the Meta Quest 3, it could have a dedicated light to informing bystanders they are being recorded. These steps could go a long way to improving safety in a way that is obvious and clear to everyone around the person wearing the headset. 

medium_Screen Shot 2024-06-21 at 10.35.01 AM.png

small_Screen Shot 2024-06-21 at 10.35.01 AM.png

thumbnail_Screen Shot 2024-06-21 at 10.35.01 AM.png

Screen Shot 2024-06-21 at 10.35.01 AM.png

Do VR Headsets Give Bystanders Enough of a Heads Up? 

CIPPIC intervened in the [Digital Locks Case](https://www.cippic.ca/articles/federal-court-rules-that-digital-locks-do-not-restrain-fair-dealing-using-a-validly-obtained-password) and appeared on [Michael Geist's Law Bytes podcast](https://www.michaelgeist.ca/podcast/) to discuss the [Federal Court’s decision](https://cms.cippic.ca/uploads/139586_Ontario_Ltd_v_AGC_T_1862_15_342bca9c1e.pdf), affirming the relationship between fair dealing and digital locks. In this episode, CIPPIC’s Director and General Counsel, David Fewer, clarifies the pivotal ruling to dispel misinformation surrounding the decision and underscores the importance of balancing copyright protection with users' rights. 

You can listen to the full episode [here](https://episodes.castos.com/lawbytes/1763492/c1e-149dtjnq12ax4wqz-row7vkn5i73r-vishtt.mp3).



large_Untitled design (1).png

medium_Untitled design (1).png

small_Untitled design (1).png

thumbnail_Untitled design (1).png

Untitled design (1).png

CIPPIC Discusses Digital Locks Case on Michael Geist's Law Bytes Podcast

Insights

Perspectives

Les programmes de stage de CIPPIC offrent aux étudiants la possibilité de travailler avec des avocats expérimentés sur des problèmes juridiques réels et de pointe résultant de l'utilisation de nouvelles technologies

Travail étudiant

Thèmes

CIPPIC has filed an [application in the Federal Court to expunge or rectify a copyright registration](https://cms.cippic.ca/uploads/Notice_of_Application_CIPPIC_v_Sahni_Fed_Ct_No_T_1717_24_e3c1d14b95.PDF) that holds out an artificial intelligence ("AI") program as an author under Canadian copyright law. 

In Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC) v. Sahni, CIPPIC asks the Federal Court of Canada to either rectify the registration to delete any mention of AI authorship, or expunge the registration entirely for lack of copyright. 

At the heart of this dispute is "Suryast," an AI-generated image, that raises fundamental questions about authorship, originality, and AI's place in creative endeavors. Ankit Sahni, an intellectual property lawyer from New Delhi, claims that an image, "Suryast", constructed using the "RAGHAV AI Painting App", enjoys copyright and claims co-authorship along with the AI. The Suryast image is an adaptation of a sunset photograph, taken by Sahni, but distorted by the AI according to the style of Vincent van Gogh's "The Starry Night."

CIPPIC's application raises several issues.

**Originality and Human Authorship:**  CIPPIC contends that "Suryast" doesn't meet the originality criterion for copyright, given its merely mechanical creation process.  Mr Sahni may have copyright in his original photograph, but contributed no skill or judgement to its adaptation by the AI.

**AI as an Author:**  The case challenges whether AI can ever be an author under Canadian law. Recognizing AI as an author could drastically alter established copyright norms.

**CIPO’s Registration Process:** The Canadian Intellectual Prpperty Office's unverified, automated copyright registration process allowed Sahni to register the AI as an author without any review. A copyright registration has substantive effect - even in this case, the registration shifts the burden to CIPPIC to disprove subsistence of copyright and to prove that an author must be a human.

The matter has just been filed. A hearing on the merits remains months in the future.

### Broader Impact

This case could reshape copyright law significantly. A decision in favor of AI authorship with only minimal human involvement would grant rights in works that only marginally resemble the kinds of human activities that justify copyright. The case underscores the need for copyright rules that address AI's role in creativity, and will offer guidance on the kinds of AI-produced creations that may enjoy rights under the Copyright Act.

News

Litigation

large_AI_Robot_writing.webp

medium_AI_Robot_writing.webp

small_AI_Robot_writing.webp

thumbnail_AI_Robot_writing.webp

AI_Robot_writing.webp