The Ontario Court of Appeal released its decision in Cash Converters Canada Inc. v. Oshawa (City) on July 4th. In this case, a franchisee of Cash Converters Canada Inc., that operated a second-hand goods store in Oshawa, had applied to the Superior Court of Justice to challenge the validity of a newly-enacted City of Oshawa bylaw that required second-hand goods dealers to collect and transmit customer information over the internet to the Durham Regional Police Service to investigate and recover stolen property. The City had been licensing second-hand goods dealers since 1974, however the original by-law only required a licensed dealer to maintain at the store a register of daily transactions, which were open to police inspection.
The Superior Court of Justice, on a “broad and purposive” approach to the interpretation of municipal powers, was reluctant to interfere with the decision of Oshawa’s council. It therefore dismissed Cash Converters' application to quash the impugned by-law. Cash Converters appealed to the Court of Appeal.
On appeal, Cash Converters argued that the by-law exceeded the City's legislative competence pursuant to section 150(2) of the Municipal Act, 2001. Section 150(2) of the Municipal Act, 2001 provides that a municipality may exercise its licensing purposes for only three reasons: (1) health and safety; (2) nuisance control; and (3) consumer protection. Cash Converters also argued that the by-law violated section 28(2) of the Municipal Freedom of Information and Privacy Protection Act, which provided that "no person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity."
The City argued that the by-law was justified because it served a consumer protection function, i.e. to protect dealers and their customers by collecting information about the vendors of second-hand goods. It argued that the collection of the information deters those who deal in stolen property from trying to sell such goods to licensed dealers. It also argued that the new features of the by-law enhanced the information collection function and therefore the consumer protection purpose of the by-law.
The Court of Appeal confirmed that the proper approach to the interpretation of municipal powers is the broad and purposive approach outlined in cases such as 1149457 Canada Ltee (Spraytech, Societe d'arrosage) v. Hudson (Town), Croplife Canada v. Toronto, Toronto Taxi Alliance v. Toronto (City) and United Taxi Drivers' Fellowship of Southern Alberta v. Calgary (City). It further confirmed that the question of whether a by-law is ultra vires the jurisdiction of the enacting municipality is a question of law to be reviewed on a standard of correctness.
The Court of Appeal was satisfied that on a broad and generous interpretation of "consumer protection," the enactment of the by-law was within the power of the City. However, the Court found that the application judge erred when he found that the collection of personal information was expressly authorized by statute. The Court held:
- The phrase "expressly authorized by statute" means that the specific types of personal information collected are expressly described in a statute or a regulation that has been authorized by a general reference to the activity in a statute. It was not the intention of the Legislature to allow municipalities, by virtue of their by-law enacting power, to determine the types of personal information that can be collected.
- The wholesale transmission to the police of personal information about individuals is of concern, as the transmission occurs before there is any basis to suspect that goods are stolen. And, the transmission is made with no limit as to the use of the information.
- The personal information collected was not "necessary to the proper administration of a lawfully authorized activity," i.e. the administration of the licensing of second-hand goods dealers. Where personal information would merely be helpful to an activity, it is not "necessary." Where the purpose can be accomplished another way, the other route is obligatory.
On this basis, the Court held that the challenged sections of the by-law were of no effect. The Court did not preclude the City from enacting different provisions that allowed the collection and transmission of some personal information, provided there was justification for those provisions pursuant to s. 28(2) of MFIPPA. The Court suggested that the City use section 46(a) of MFIPPA to have the Privacy Commissioner, who has experience and expertise in privacy matters, vet such new provisions for compliance with MFIPPA.
A footnote to the Court's reasons reminds readers that section 150(2) of the Municpal Act, 2001 has been repealed, and accordingly the analysis of a by-law's compliance with s. 28(2) of MFIPPA may change in subsequent cases.