Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

A REVIEW OF THE LIQUOR CONTROL BOARD OF ONTARIO’S PERSONAL INFORMATION COLLECTION PRACTICES RECONSIDERATION ORDER PO-3356-R

BACKGROUND

This Reconsideration Order relates to the personal information collection practices of the Liquor Control Board of Ontario (LCBO) relating to purchases made by spirit, beer and wine clubs (clubs) on behalf of their members pursuant to the LCBO’s Business Process and Program Guidelines – Spirit, Beer or Wine Clubs (Club Guidelines).

On July 5, 2012, the Office of the Information and Privacy Commissioner of Ontario (IPC) received a privacy complaint from Warren Porter, the manager and director of Vin de Garde Wine Club, who was also a member of the club. The complainant objected to the collection of personal information about members when the wine club places orders through the LCBO on its members’ behalf. The complainant alleged that the LCBO’s practices were in violation of the Freedom of Information and Protection of Privacy Act (the Act).

Section 38(2) of the Act prohibits government institutions from collecting personal information except where the collection is: (i) expressly authorized by statute; (ii) used for the purposes of law enforcement; or (iii) necessary to the proper administration of a lawfully authorized activity.

Following an investigation into the LCBO’s personal information collection practices, I issued Order PO-3171. In that order, I found that, with one exception, the collection of personal information of spirit, beer and wine club members, when orders were submitted through clubs on behalf of their members, contravened section 38(2) of the Act. The only exception was in relation to orders placed by clubs where an individual member intends to pick up the products directly from an LCBO retail location.

Relying on the remedial powers set out in section 59(b) of the Act, I ordered the LCBO to:

• • Cease collecting the personal information of spirit, beer and wine club members when processing purchase orders submitted by clubs on their behalf, except in those circumstances where an individual member intends to pick up the products.
• • Destroy all personal information that has already been collected from spirit, beer and wine club members to fill orders except in the limited circumstances described above.

The LCBO subsequently applied for a judicial review of Order PO-3171. Following a hearing, the Ontario Divisional Court issued its decision allowing the judicial review application and remitting the matter back to the IPC for reconsideration.¹ In its decision, the Divisional Court found that the process followed in the investigation breached the IPC’s duty of fairness. The court stated:

We find that the IPC should have given the LCBO notice that the Commissioner was considering an Order under s. 59(b) as a potential remedy. This finding is supported by case law on what constitutes adequate notice in an adjudicative administrative proceeding, by the wording of s. 59(b) which requires a head to be heard before an Order is issued, and by the fact that an Order is an almost unprecedented remedy in the context of IPC privacy complaint proceedings. Applying the analysis in Baker, we conclude that, in light of the nature of the decision of the IPC and the process followed in making it, the nature of the statutory scheme and the framework within which the body operates, the importance of the decision to the affected parties, and the choices of the procedure made, there has been a breach of the duty of fairness.

A subsequent application brought by the IPC for leave to appeal the Divisional Court’s decision to the Ontario Court of Appeal was denied. Consequently, the Divisional Court’s decision stands. This Reconsideration Order is being issued following a process that was conducted in accordance with the Court’s decision to remit the matter back to my office.

Liquor Control Board of Ontario

As noted in Order PO-3171, the LCBO is a Crown agency that reports to the Minister of Finance. It operates more than 630 retail liquor stores across Ontario. In addition to offering products for sale in its retail locations, the LCBO has a Private Ordering Department through which customers may purchase products that are not otherwise available in its stores. According to the LCBO, it is common for orders that are submitted through its Private Ordering Department to be made by an intermediary, such as a manufacturer’s representative or clubs.

Legislative Context

Together, the Liquor Control Act (LCA) and the Liquor Licence Act (LLA) require that all sales of liquor in Ontario be made through the LCBO or through government stores, at premises where a license holder is authorized to sell and serve liquor or by a manufacturer licensed to sell liquor at an on-site or off-site retail store.

There are some exceptions to this rule. Licenses are granted to manufacturers’ representatives, liquor delivery services, and organizations that run fermentation operations for individuals who want to make their own wine or beer for personal consumption.

The LCBO’s powers and purposes are set out in the LCA. Under the LCA, the LCBO is responsible for the importation, distribution, and sale of liquor for off premises consumption in Ontario. Section 3(1) of the LCA states, in part:

The purposes of the Board are, and it has power,

(a) to buy, import and have in its possession for sale, and to sell, liquor and other products containing alcohol and non-alcoholic beverages;

(b) to control the sale, transportation and delivery of liquor;

(n) to do all things necessary for the management and operation of the Board in the conduct of its business;

Under the LLA, the Alcohol and Gaming Commission of Ontario (AGCO) is responsible for the regulation and enforcement of the sale of liquor for on-premise consumption through a system of licenses and permits. Also under the LLA, individuals and organizations are prohibited by section 5 from purchasing liquor for resale. That section states, in part:

1. (1) No person shall keep for sale, offer for sale or sell liquor except under the authority of a licence or permit to sell liquor or under the authority of a manufacturer’s licence.
2. (2) No person shall canvass for, receive or solicit orders for the sale of liquor unless the person is the holder of a licence or permit to sell liquor or unless the person is the holder of a licence to represent a manufacturer.

Section 4.1(1) of the LCA gives the Chair of the LCBO the authority to designate an inspector to determine whether there is compliance with both the LCA and the LLA. Section 4.1(1) states:

The Chair of the Board may designate any person as an inspector to carry out inspections for the purpose of determining whether there is compliance with this Act, the Liquor Licence Act, the Wine Content Act and the regulations under those Acts.

The powers of an inspector are set out in section 4.2(2) of the LCA and include the power to enter the premises of (i) a location at which liquor is sold, served, manufactured, kept or stored; or (ii) a location at which books or records relating to the sale, service, manufacture, or storage of liquor are kept or are required to be kept. Upon entry of the premises described above, and as set out in 4.2(3) of the LCA, an inspector has the power to:

1. (a) inquire into negotiations, transactions, loans or borrowings of a licensee or permit holder under the Liquor Licence Act, a manufacturer, a person who imports liquor, a person authorized to operate a government store or any other person who is granted an authorization or is the subject of an appointment referred to in subsection 3 (2);
2. (b) inquire into assets owned, held in trust, acquired or disposed of by a licensee or permit holder under the Liquor Licence Act, a manufacturer, a person who imports liquor, a person authorized to operate a government store or any other person who is granted an authorization or is the subject of an appointment referred to in subsection 3 (2);
3. (c) request the production for inspection or audit of books, records, documents or other things that are relevant to the inspection;
4. (d) remove documents or things relevant to the inspection for the purpose of making copies or extracts;
5. (e) remove things relevant to the inspection that cannot be copied and may be evidence of the commission of an offence;
6. (f) remove materials or substances for examination or test purposes if the licensee, permit holder, manufacturer, importer or other occupant of the premises is given notice of the removal; and
7. (g) conduct such tests as are reasonably necessary for the inspection.

These broad powers of inspection are relevant to the discussion that follows regarding the need for the LCBO to collect the personal information at issue in this reconsideration.

Manufacturers’ Representatives

Unlike wine clubs, manufacturers’ representatives are regulated by the province through Ontario’s liquor licence laws. Specifically, the LLA authorizes manufacturers’ representatives to operate under licence by the AGCO. The LLA and its regulations impose restrictions on manufacturers’ representatives, both directly and by imposing conditions on their licences. For instance, manufacturers’ representatives are not permitted to deliver liquor directly to a customer – the customer must pick up the product from an LCBO retail location and the relevant purchase order, including the personal information of the customer, must be affixed to the product. Under the LLA, section 2.1(3) of Regulation 718, states that a purchase from a manufacturers’ representative must contain at least the following information:

• • The name and address of the holder of the licence to represent a manufacturer;
• • The name and address of the manufacturer represented by the holder;
• • The purchaser’s name and address and, if the purchaser is the holder of a sale licence, the number of the sale licence;
• • The type and quantity of liquor ordered;
• • The date and time of the order;
• • The name and address of the person to whom delivery of the liquor is to be made;
• • The terms of payment.

It is critical to note that, whereas purchases made by manufacturers’ representatives have been consciously considered by the legislature, the LLA and the LCA and the regulations under those acts do not address purchases made by members through their clubs. Club members purchase products pursuant to the Club Guidelines which is a policy created by the LCBO – the policy does not have the force of law.

The authorities of licensed manufactures’ representatives are relevant to the discussion that follows since the LCBO argues that the activities of these groups are analogous to those of clubs. However, manufacturers’ representatives are different from clubs in a number of important aspects. They are licensed and have broader authority under the LLA. For example, under the LLA, once licensed, they have the authority to canvass for, receive and submit orders on behalf of licensees. They can participate in the consignment program under which the LCBO imports products at their request and they are able to solicit orders from customers for those products. Although I will discuss the operation of clubs in detail below, it is sufficient to note here that they do not have the authority to undertake the same activities as manufacturers’ representatives.

Spirit, Beer and Wine Clubs

Spirit, beer, and wine clubs (clubs) are generally organizations that have been created by a group of individuals for a variety of purposes, which may include providing access to spirits, beers, and wines that are not normally available at LCBO retail stores; sharing knowledge of different liquor products; taking advantage of volume discounts offered by suppliers; and creating a social setting for the members of these clubs to learn about and discuss new products.

The terms spirit, beer, or wine clubs do not appear in either the LCA or the LLA and as a result, these clubs have no separate legal status, entitlements or recognition under these acts. The LCBO has developed a policy to facilitate the placement of orders through its Private Ordering Department by clubs on behalf of their members. The club program has been in place since 1977.

The procedures for club ordering are not based on requirements established by the LLA or LCA. The procedures are set out in the Club Guidelines. The Club Guidelines require that all orders placed by clubs on behalf of its members must be submitted through the LCBO’s Private Ordering Department.

LCBO policy requires groups of individuals who wish to form clubs to register and apply for approval to purchase their liquor through the Private Ordering Department. Once registered, these clubs can place orders on behalf of their individual members. A group wishing to register as a club may do so by letter to the LCBO. Once the application for registration is received, reviewed and approved, the LCBO will send a letter confirming registration and setting out the Club Guidelines, which apply to the purchases made through the club.

The Private Ordering Department allows private individuals, registered and approved clubs, and manufacturers’ representatives to order liquor products not usually available through the LCBO retail stores. The process for placing an order with the Private Ordering Department by clubs on behalf of their members is set out in the LCBO’s Club Guidelines.

Under the Club Guidelines, the LCBO will accept orders from a club on behalf of its members for imported liquor, and will sell such products to club members through the club. Section 2 of the Club Guidelines states:

All beverage alcohol products ordered by the club must be purchased from the LCBO through the club by its individual members. The club may not maintain an inventory of such products for general availability to members, and club members purchasing such products through the club must do so for their own consumption and may not resell the products to third parties. The club may not order products on behalf of persons holding licences to sell liquor issued by the Alcohol and Gaming Commission of Ontario.

The Club Guidelines also state that the LCBO requires clubs to submit a purchase list for their orders, and that this list must contain the names, addresses and phone numbers of the members placing orders, and the precise details of what product and quantity is being ordered by each member. The LCBO retains such customer information for seven years. This is the collection practice at issue in this reconsideration.

Depending on the practices of a particular club it may (i) take delivery of the orders on behalf of its members; or (ii) have its members pick up their orders directly from the LCBO. In the latter situation, the only way for the LCBO to confirm that the individual seeking to pick up the product is the one who ordered it, and to confirm that the customer is receiving the correct product and quantity of product ordered, is for the LCBO to ask for identification and proof of purchase.

The complainant did not have any concerns with the collection of personal information in circumstances where the member is picking up his or her order directly from the LCBO.

In Order PO-3171, I accepted that in these limited circumstances, the collection of personal information may be necessary to the administration of the LCBO’s business of selling liquor through the Private Ordering Department to clubs on behalf of their members; without proof of purchase, including identifying personal information, it would not be possible to process this type of sale. Therefore, this reconsideration will not discuss the situation described above where club members attend in person to pick up their orders from the LCBO.

At issue in this reconsideration is the collection of club members’ information where orders are placed by the club on behalf of its members, and then picked up and distributed by the club to its members.

The Complaint

The complainant, who operates a wine club in Ontario, submits that the collection of personal information by the LCBO is inconsistent with the Act and amounts to a collection of information about the members’ consumption habits. This complaint was filed after the LCBO refused to process an order placed by his club on behalf of its members after the complainant refused to provide the LCBO with the requested personal information.

The complainant’s club is registered with the LCBO and has received approval from the LCBO to purchase products through the Private Ordering Department. The registration process was completed in 2004 and confirmed by a letter dated October 15, 2004. The letter indicated that the complete details on placing an order by the club, on behalf of its members, could be obtained through the LCBO Private Ordering Department.

The LCBO has stated that the requirement to collect the personal information of customers placing orders through clubs has been in place since the complainant’s wine club was registered with the LCBO. The LCBO acknowledged, however, that for reasons including administrative oversight, it has processed orders from the complainant’s club without requiring the personal information of individual members who purchased the product to be provided. The LCBO submitted that regardless of past practice, the complainant’s club has been, and continues to be, required to submit the personal information of its club members when it places orders on their behalf. In this order, I will not discuss the possible reasons for the LCBO processing the complainant’s orders from 2004 until the fall of 2012 without requiring member’s information to be provided.

The complainant submitted that club members are not afforded the same level of privacy as is provided to regular LCBO customers who purchase products at a retail store. The complainant stated that many of the members order through the club in order to maintain their anonymity when making a special purchase. This is impossible if members’ purchases are specifically noted on club orders.

The complainant further submitted that there was no justifiable reason why the LCBO must collect the personal information of every member who is placing an order through the club, whenever an order is placed.

In response, the LCBO stated that its practices regarding the collection of personal information do differ from when a customer makes a purchase at an LCBO retail store. The LCBO submitted that it has processes in place to handle situations where staff have concerns that a retail store purchase may, in fact, be for the purposes of illegal resale. However, it did not provide this office with any information describing those practices.

Order PO-3171

In Order PO-3171, I found that the information being collected qualified as personal information under section 2(1) of the Act and that this collection contravened section 38(2) – I was not satisfied that the LCBO had established that the collection of the personal information of wine club members was necessary to the proper administration of a lawfully authorized activity, that being to fulfill a transaction, facilitate the recall of products, enable audits, or deter fraud. I therefore ordered the LCBO to cease collecting the personal information of wine club members, except in those circumstances where an individual member intends to pick up the product from the LCBO; and to destroy all of the personal information that it has collected (other than in situations where the customer has picked up the products ordered).

Since the issuance of Order PO-3171, the LCBO has temporarily modified its processes relating to the sale of liquor through clubs. Currently, club members must pick up orders themselves at one of the LCBO’s retail locations. Orders placed through clubs for pick up by members at LCBO retail locations were not the subject of Order PO-3171. I accepted that club members’ names and details of the product being ordered could be collected to process these orders as this information would be required by LCBO staff at the time of pick up to verify that the individual picking up the product is entitled to do so and to confirm that the product and quantity are accurate.

I have also recently learned, according to the May 27, 2014 affidavit of the Director of Traffic, Customs, Toronto & Ottawa Logistics Operator for the LCBO that the LCBO has made a policy decision to wind down the wine club program, which is expected to take effect in early to mid-2015. The LCBO stated that it has already notified the complainant’s lawyer of this pending change. Once this change is in place, all clubs will be required to register as manufacturers’ representatives under the LLA and to obtain a license from the AGCO to place orders on behalf of their members through the Private Ordering Department.

The Reconsideration Process

To initiate this reconsideration process, I invited the LCBO to submit representations on the issues under reconsideration and notified the LCBO that I may make an order under section 59(b)(i) and/or (ii) if I find, after hearing from the head, that the LCBO collected the personal information at issue contrary to section 38(2) of the Act. In response, I received representations from the LCBO.

In its representations, the LCBO submitted that collecting the personal information of wine club members is necessary to the proper administration of a lawfully authorized activity, namely, filling club orders on behalf of members, and also that this information is used by the LCBO for law enforcement.

According to the submissions of the LCBO, [t]he approach adopted (by the IPC) in Order PO-3171 would prevent the LCBO from collecting such basic order information from customers who are ordering products through clubs, effectively treating the club rather than the club members as the LCBO’s customer.

The LCBO also submitted that the interpretation of s. 38(2) of (the Act) that is implicit in Order PO-3171 is inconsistent with the Ontario Court of Appeal’s decision in Cash Converters Canada Inc. v. Oshawa (City)2 (Cash Converters) and with the IPC’s previous jurisprudence concerning the necessity test.

As part of its submissions, the LCBO provided affidavit evidence from (i) the Director of Traffic, Customs, Toronto & Ottawa Logistics Operator for the LCBO (the Director); (ii) the former General Counsel for the AGCO from 2004-2014 and Director of Legal Services from 2005-2013 (former General Counsel); and (iii) the Assistant Deputy Minister for the Revenue Agencies Oversight Division for the Minister of Finance (Assistant Deputy Minister).

After reviewing the representations of the LCBO, I decided that it was not necessary to invite the complainant to submit representations.

In this Order, I affirm the earlier decision made in Order PO-3171 and find that the personal information collection practices of the LCBO in relation to sales made through clubs on behalf of their members is contrary to section 38(2) of the Act, except in those limited circumstances where the club submits purchase orders on behalf of its members, who intend to personally pick up the goods ordered at the LCBO themselves.

There appears to be no issue about the nature of the information collected by the LCBO when processing purchase orders by clubs. The parties agree that this information qualifies as the personal information of the club members. The only issues here are whether the collection of that information is in accordance with section 38(2) of the Act and, if not, what the appropriate remedy is.

DISCUSSION

Issue 1: Is the LCBO’s collection of personal information in accordance with section 38(2) of the Act?

Section 38(2) of the Act prohibits the collection of personal information, subject to three limited exceptions. It states:

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

In order for a particular collection practice to be consistent with the Act, an institution must show that the collection of personal information is either, (1) expressly authorized by statute; (2) used for the purposes of law enforcement; or (3) necessary to the proper administration of a lawfully authorized activity. Unless an institution can meet one of the exceptions, it is unlawful to collect the information.

The LCBO relies on two of the three exceptions in section 38(2) in this reconsideration. It claims that the collection of personal information relating to club orders is in compliance with the Act because it is used for the purposes of law enforcement and it is necessary for the purpose of administering the spirit, beer and wine club program.

In the discussion that follows, I will deal first with the claim that the collection of the personal information of club members is used for the purposes of law enforcement.

Used for the purposes of law enforcement

As noted above, section 38 of the Act prohibits the collection of personal information unless one or more of the three exceptions are met. The LCBO claims that its collection of personal information is permitted because the information is used for the purposes of law enforcement. The term law enforcement is defined in section 2(1) of the Act as follows:

law enforcement means,

(a) policing,

(b) investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, or

(c) the conduct of proceedings referred to in clause (b).

The LCBO submits that this information is used for the purposes of law enforcement pursuant to section 38(2) because it is used to enforce the provisions of the LLA and LCA.

I do not dispute the LCBO’s submission that both the Alcohol and Gaming Commission of Ontario and the LCBO have the function of enforcing and regulating compliance with the LLA and LCA, and that both acts provide for penalties and sanctions to be imposed in the event of non-compliance. In this regard, the LCBO states that it collects this information to ensure compliance with and enforce the provisions of the LLA since it is used to ensure that clubs do not illegally stockpile and resell liquor. It adds that enforcement is one of the primary objectives of the collection.

The LCBO’s submissions overlook the fact that for this exception to apply, the LCBO must identify the inspection or investigation in which the information is being collected. It is not sufficient to claim that the information collected may be relevant in some future investigation or inspection by an institution. While an enforcement proceeding need not necessarily be underway, an identifiable specific investigation or inspection must be. To find otherwise would undermine the purpose of section 38(2) which prohibits the collection of personal information except in specific and limited circumstances. It would also be inconsistent with one of the purposes of the Act, as set out in section 1, which is to protect the privacy of individuals.

The LCBO has not provided any information or evidence to support a finding that this information is used for the purposes of a specific investigation or inspection. It is simply not enough for the LCBO to require the personal information of all individuals placing orders through wine clubs be collected for a possible, speculative future investigation or inspection. For these reasons, I find that the LCBO has not satisfied the criteria for the application of this exception and I find that the collection of personal information is not used for the purposes of law enforcement.

Necessary to the proper administration of a lawfully authorized activity

What is the proper interpretation of this exception?

The leading authority on the proper interpretation of this provision is the Ontario Court of Appeal’s decision in Cash Converters. In that case, the Court of Appeal was asked to consider the validity of a city bylaw that required second-hand goods shops to maintain and transmit daily to the police electronic records of transactions containing detailed personal information. The Court of Appeal adopted the analysis developed by this office and stated:

Again, the jurisprudence developed by the Privacy Commissioner interpreting this provision is both helpful and persuasive of the proper approach to be taken by the courts as well. In cases decided by the Commissioner’s office, it has required that in order to meet the necessity condition, the institution must show that each item or class of personal information that is to be collected is necessary to properly administer the lawfully authorized activity. Consequently, where the personal information would merely be helpful to the activity, it is not necessary within the meaning of the Act. Similarly, where the purpose can be accomplished another way, the institution is obliged to choose the other route.

In Cash Converters, after finding that the purpose of the collection was for consumer protection, the Court of Appeal found that there was no evidence of a growing problem that needed to be addressed and there was no evidence that unscrupulous individuals would be deterred by the collection of the personal information of innocent individuals. In conclusion, the Court held that the collection was not necessary for an effective consumer protection regime and thus did not satisfy the necessity ground.

Before I turn to consider the LCBO’s arguments regarding the application of the necessity exception, I will consider its arguments as to the proper interpretation of the necessity exception.

In representations filed at the reconsideration stage, the LCBO argued that in Order PO-3171 my approach to this exception was to construe necessity to mean absolutely necessary or indispensable. The LCBO claimed that in applying this interpretation, I departed from previous jurisprudence and the decision of the Court of Appeal in Cash Converters. It also claimed that this approach produced an absurd result because it had the effect of permitting some club members to order liquor anonymously through clubs while requiring other club members (those who picked up their own orders) to provide their personal information.

Second, the LCBO stated that the proper interpretation of necessary is reasonably necessary or reasonably useful and proper. In this regard, the LCBO acknowledged that the proper approach is the one set out by the Court of Appeal in Cash Converters but states that the focus of the test is on whether the personal information collected is necessary to the proper and effective administration of the lawfully authorized activity, not merely whether it would be possible to perform the activity without collecting the personal information.

In support, the LCBO referred to the Society of Composers, Authors and Music Publishers of Canada v. Canadian Assn. of Internet Providers3, a decision of the Supreme Court of Canada where a finding was made that the meaning of necessary depends entirely on the legislative context. In that case, the Court referred to the definition found in Black’s Law Dictionary which states that necessary:

…may mean something which in the accomplishment of a given object cannot be dispensed with, or it may mean something reasonably useful and proper, and of greater or lesser benefit or convenience, and its force and meaning must be determined with relation to the particular object sought.

I agree with the LCBO’s submissions that the approach to follow to the application of this exception is the one previously followed by my office and endorsed by the Court of Appeal in Cash Converters. Following that approach, the question is whether the information is necessary to the proper administer of the lawfully authorized activity. To meet that test, the institution must show that the collection is more than merely helpful, and where the purpose can be accomplished another way, the institution is obliged to choose the other route. As noted above, in Cash Converters, the Court of Appeal held that under the necessity test:

…the institution must show that each item or class of personal information that is to be collected is necessary to properly administer the lawfully authorized activity. Consequently, where the personal information would merely be helpful to the activity, it is not necessary within the meaning of the Act. Similarly, where the purpose can be accomplished another way, the institution is obliged to choose the other route. [Emphasis added]

Contrary to the LCBO’s suggestion, the test set out above was the test I had applied in Order PO-3171, where I found that the LCBO and the Ministry of Finance had not established that the collection of personal information of club members was necessary to the proper administration of the club program.

The LCBO also claimed that the word necessary should be construed to mean reasonably necessary or reasonably useful and proper. It stated that the plain meaning of section 38(2) uses the word proper in conjunction with the word necessary and that effect must be given to each of the words in the section. The LCBO argued that giving effect to the word proper involves considering whether collecting the personal information is necessary for the proper or effective administration of the club program, the proper processing of special orders and the proper, lawful sale of liquor by the LCBO to those members.

The LCBO’s position is that its interpretation of necessary is supported by a review of decisions of this office and the British Columbia’s Information and Privacy Commissioner (BCIPC). The LCBO cited the BCIPC’s Order P05-01, K.E. Gostlin Enterprises Ltd., in which former Commissioner Loukidelis stated, in reference to section 7(2) of British Columbia’s Personal Information Protection Act:

The Legislature did not, in my view, intend the word necessary in s. 7(2) to mean indispensable. PIPA’s legislative purposes, the overall statutory context in which the word necessary appears, and the language of s. 7(2) lead me to conclude that the Legislature did not intend to create a strict standard of indispensability by using the word necessary.

The LCBO also relied on a recent Privacy Complaint Report⁴ issued by this office involving the Office of the Independent Police Review Director (OIPRD). The LCBO stated that in that Report, the IPC upheld the collection practice of the OIPRD on a standard of reasonable necessity.

I disagree with the LCBO’s view of the findings made in the OIPRD Report. The evidence before Investigator Ratner was that the OIPRD required the date of birth because of the number of cases in which more than one individual had the same first and last name. It stated, among other things, that it would not have been able to process a complaint without being able to satisfy itself that it was dealing with the correct individual, and this could not be done if it only collected the individual’s name.

Relying on this and the other evidence provided, Investigator Ratner stated:

I am satisfied that the collection of the DOB of complainants serves a number of useful purposes, and not having this information might significantly hamper certain investigations, including those where the identity of a complainant may be in question. Because it is not possible to ascertain in advance the circumstances under which a DOB may be required, I am satisfied that it is reasonable and necessary to include DOB as a mandatory field on the OIRPD form. [Emphasis added.]

As reflected in the passage quoted above, Investigator Ratner found that the collection of the personal information was not just necessary, it was reasonable and necessary. In my view, any reference to the practice as a reasonable one should not be interpreted as the establishment of a new test for the application of section 38(2) or a broadening of that test to include a reasonableness standard.

The LCBO also referred to Privacy Investigation Report PC07-100, in which I accepted that the LCBO practice of collecting personal information from customers returning products to the LCBO was in accordance with section 38(2) because it was necessary to the lawfully authorized activity of selling liquor. I will be referring to this report in greater detail below. For the moment it is sufficient to say that the LCBO has stated that in substance, I applied a reasonably necessary test in the analysis of the LCBO’s practices in that case.

I also disagree with this claim. In PC07-100, I found that there was significant evidence that the collection of personal information was a necessary measure – not a reasonably necessary measure – in preventing fraud.

Quoting Professor R. Sullivan in Sullivan on the Construction of Statutes, the LCBO added that the modern rule of statutory interpretation requires that I arrive at an interpretation that is appropriate, having regard to its plausibility, efficacy and acceptability and that included in the concept of appropriate is the idea that the interpretation should not lead to absurd consequences. This is not limited to logical contradictions and internal coherence, but includes violations of justice, reasonableness, common sense and other public standards.

Relying on the passage quoted above, the LCBO submitted that my application of the necessity test produces the illogical result of allowing some club members to order liquor anonymously and prohibiting the others from doing so, based solely on the pickup arrangement. The LCBO referred to a lengthy passage from the Divisional Court decision where the Court stated:

The IPC seems to accept the premise that club members are the customer. The decision is replete with reference to the club processing and submitting purchase orders on behalf of its members. However, the IPC also seems to accept that individuals cannot purchase alcohol from the LCBO anonymously….Consistent with that finding, the actual Order of the IPC contains an exemption. The LCBO is permitted to obtain personal information from club members who intend to pick up ordered product from the LCBO and is not required to destroy the personal information collected in those circumstances.

If club members are purchasing the product from the LCBO in both instances, what logical reason is there to distinguish them on the basis of where they pick up the product?

In Order PO-3171, I found that club members were not entitled to purchase liquor anonymously where the members elected to pick up the products themselves from an LCBO retail store. In those specific cases, it would not be possible for the LCBO to process the order without the information, and on that basis, I found that it had established that the collection of personal information was more than merely helpful. I continue to hold that view and disagree with the suggestion that this finding leads to an absurd result.

A finding that the collection of the personal information is more than merely helpful in one circumstance does not preclude a finding that the LCBO does not meet the necessity test in other, differing circumstances. In my view, in exceptional and limited cases, it is necessary for the LCBO to collect the personal information only because it is necessary for staff to verify that they are providing the correct products to the correct individual who chooses to appear in person for the pickup. This is a matter of basic customer service, at its core, to ensure that the right person gets the right product. And one should note that these individuals have opted-in to this process, having given their positive consent to be named.

In those cases where the club representative picks up products on behalf of its members, the only information required to verify that the correct order is going to the correct person is the identity of the club that placed the order, the product details and the contact details for the individual who will be picking up the products. There is nothing absurd about the different treatment of these two types of transactions – they bear little resemblance.

The LCBO’s approach proposed by the LCBO to the interpretation of necessary is, in my view, inconsistent with the findings of the Court of Appeal in Cash Converters and amounts to a reading into the section of language that is neither required nor justified. The approach followed by the Court of Appeal in Cash Converters addresses the issues raised by the LCBO’s arguments and the issues raised by the circumstances surrounding its collection practices.

For all of these reasons, I find that the approach to the interpretation of the necessity test is the one endorsed by the Court of Appeal in Cash Converters, which in these circumstances, means that the LCBO must establish that the personal information it collects is more than merely helpful. I reject its suggestion that the word necessary in section 38(2) should be interpreted as reasonably useful and proper or reasonably necessary as, in my view, that approach is not consistent with the direction provided by the Court of Appeal.

Has the LCBO provided sufficient evidence to support a finding that the collection of the personal information is necessary to the proper administration of a lawfully authorized activity?

The LCBO raised several arguments in support of its position that the collection of personal information meets the necessity test in section 38(2) of the Act. I have attempted to group and summarize the LCBO’s arguments in the following four general categories:

• • The collection of personal information is necessary for the lawful sale of liquor by the LCBO to [club] members. Absent the personal information, the LCBO places the club in the position of illegally reselling the liquor to its members and the members in the position of illegally purchasing it.
• • The collection is necessary to detect and deter fraud, including the illegal selling and stockpiling of liquor, which will impact LCBO sales and the tax revenues related to these sales. In this regard, the LCBO claimed that it has a responsibility to ensure that purchasers comply with the LLA and the LCA. It also claimed that the detection and deterrence of fraud cannot be effectively accomplished in any other way.
• • The collection is consistent with the industry standards of liquor boards and commissions across Canada to require clubs to provide the personal information of their members when facilitating liquor sales from regulatory bodies to end customers. It is also consistent with retail industry standards relating to special orders.
• • The fact that the Ontario Legislature has passed regulations allowing for the collection of personal information of individuals who make purchases through manufacturers’ representatives demonstrates that the collection of information is necessary in all sales that are made through intermediaries, including clubs.

In the discussion that follows, I will respond to each of these arguments in turn. However, before I proceed, I will address one overarching issue. The LCBO representations and affidavit materials are replete with references to agents, which I understand to be a reference to manufacturers’ representatives. In addition, these materials include propositions that purport to apply to agents or clubs. To be clear, agents and clubs are different entities. At issue in this investigation is the personal information collection practices of the LCBO as they relate to the club program, or clubs and their members, and not agents or manufacturers’ representatives. I will review the differences in these entities in the discussion that follows.

Lawful Sale to Club Members

It is worth repeating here that the lawfully authorized activity under investigation is the sale by the LCBO of liquor pursuant to its Private Ordering program to members through clubs. Club purchases are made pursuant to the Club Guidelines and therefore the transaction or sale of liquor is between the LCBO and the club members with the club acting as an intermediary.

As noted above, the LCBO argued that the collection of personal information is necessary for the lawful sale of liquor by the LCBO to [club] members. It also stated that absent the personal information, the LCBO places the club in the position of illegally reselling the liquor to its members and the members in the position of illegally purchasing it. It added that a finding that the LCBO cannot collect the personal information at issue would have the effect of establishing a process which is contrary to the statutory scheme under the LLA and the LCA.

In my view, the LCBO has not established that, absent the collection of personal information, a purchase facilitated by clubs for members or the process for purchases made by club members is a violation of the LLA or the LCA, or any other law of the province of Ontario. Indeed, it has not pointed to a single section of the acts or the regulations under the acts that make a purchase by members through clubs illegal in those cases where the LCBO does not collect the personal information at issue, or does not document the transaction as a sale to specific members of a club.

I note that in correspondence between the LCBO and the complainant which predate the filing of this complaint, and which was provided to me by the parties, the LCBO did not suggest or imply that the complainant’s members’ orders, which had been placed since 2004 without providing the personal information of its members, amounted to a violation of the law. The LCBO’s position then was that the orders were submitted contrary to the Club Guidelines. If these transactions were illegal, I would have expected the LCBO to have raised those concerns with the complainant at that time.

The only specific provision of the LLA or the LCA that the LCBO pointed to is section 33.1 of the LLA. The LCBO suggested that a sale to club members, absent the members’ personal information, places the club in breach of section 33.1 of the LLA. Section 33.1 prohibits the possession of liquor in excess of the prescribed quantity unless one of the exceptions in that section applies. The LCBO explained:

[G]iving the liquor to the club [without having first obtained the personal information of the purchasers] places it in breach of section 33.1 of the LLA, which prohibits any person from possessing more than 180 litres of alcohol.

It added that sales to clubs that occur without the collection of personal information from the members who purchase the liquor:

…enable clubs to do an end run around the system of permits and licenses administered by the AGCO and the LCBO, none of which allow the type of anonymous ordering and sale of liquor which was advocated by the Club.

The LCBO has not referred to a single case of a sale to members through clubs that would trigger a possible violation of section 33.1 of the LLA. Even if it had provided this evidence, the collection of the club members’ personal information would have no bearing on whether the club violated the section or not. Moreover, the LCBO’s argument about a potential violation of section 33.1 overlooks the exception in section 33.1(d) which allows for the possession of liquor in quantities in excess of the prescribed quantity, if the possession occurs under the authority of the LCBO.

I reject the suggestion that the collection of personal information is necessary to transform the transaction or process from an illegal one to a legal one. I recognize that it is illegal to resell and stockpile liquor in Ontario – it is not, however, illegal to purchase liquor from the LCBO through a club. It is also not illegal to purchase liquor through a club without providing one’s personal information. This type of event occurs countless times each day in LCBO retail stores.

If a club representative or member engages in activities such as reselling or stockpiling product, I agree that the individual would be engaging in an illegal activity. However, the collection of personal information has no bearing on this question or on the legality of the initial transaction – the purchase by members that is facilitated by the club.

Finally, the LCBO’s position that club members are able to do an end run around the system of permits and licenses ignores the fact that the system of permits and licenses established by the regulatory scheme does not apply to clubs and their members.

The LCBO also raised the spectre of illegal activity by claiming that, absent the collection of personal information, the clubs could engage in illegal activity. That is a different argument, and one that I will address in the following discussion.

Detect and Deter Fraud

The LCBO’s arguments relating to the detection and deterrence of fraud can be summarized as follows:

1. a) The sale of liquor to members through clubs without the collection of personal information relating to each sale creates opportunities for clubs and their members to commit fraud.
2. b) The risk of fraud is significant and there is a potential for significant monetary losses that will ultimately impact the revenue available to the province for public programs.
3. c) The collection of personal information is an effective deterrent to potential fraud by clubs and their members.
4. d) There is an expectation of the LCBO held by the Ministry of Finance and the Alcohol and Gaming Commission of Ontario (AGCO) that it will take prudent measures to detect and deter fraud by clubs and their members.
5. e) The information is necessary to enable the LCBO to effectively enforce the provisions of the LCA and the LLA and ensure compliance with the regulatory regime.
6. f) The collection of the personal information is necessary to ensure compliance with the other aspects of the regulatory regime.

a) Necessary to Detect Fraud

The LCBO submissions and supporting affidavits include background discussion and examples of how fraud could be conducted by clubs. The LCBO has not provided me with one example of a case where fraud was found to have occurred or was even suspected by a club since the club program has been in operation – for a period of over 35 years.

Similar to the evidence provided in the initial hearing of this complaint, the LCBO referred to the

fraudulent conduct of 12 manufacturers’ representatives that occurred between 2002 and 2005. As noted above, these are organizations that are licensed to represent manufacturers of liquor and that are required by regulation to collect personal information of purchasers when placing orders on their behalf. Importantly, at the time that the fraudulent activities occurred, the LCBO was collecting this personal information pursuant to the regulations.

The LCBO submissions were supported by the affidavit evidence of the Director of Traffic, Customs, Toronto and Ottawa Logistics Operations for the LCBO, who stated that there have been repeated difficulties with fraud involving intermediaries operating within the LCBO’s Private Ordering or Consignment programs. The Director provided details of the types of fraudulent activity in these cases and noted that some of the frauds involved thousands of bottles and hundreds of cases of liquor. The Director added that violations by agents came to the attention of the LCBO with some frequency between 2000 and 2005. However, not one of the examples of fraud that the Director referred to was related to clubs.

The Director also stated that other violations have come to the LCBO’s attention as a result of customers contacting the LCBO to confirm delivery but she did not provide any details or indicate whether or not these contacts related to clubs. The Director stated that the LCBO has sometimes been contacted by licensees seeking verification of consignment sales made in their name but I was not provided with a single example of a call made by a club member in similar circumstances.

The Director added that there are various types of fraud that could occur through intermediaries:

Briefly put, some of the frauds involve agents or clubs submitting fictitious customer orders, or aggregate orders, which are not in fact supported by an underlying customer order. The agent or club then picks up the products (purportedly on behalf of members/customers), stockpiles them in a warehouse and then resells the products at a later date (and contrary to liquor laws). Another variation of this type of fraud involves clubs or agents which have relationships with suppliers manipulating the price of products by directing those suppliers to under quote the LCBO (resulting in a lower retail price for the LCBO sale to the fictitious customer), then illegally reselling the product for the higher market value and pocketing the price difference (or splitting it with the supplier).

The Assistant Deputy Minister of Finance stated in his affidavit that the club program could operate as a channel for fraudulent sales where entities whose licenses have been suspended or revoked pursuant to the LLA, or who have been denied a license, may attempt to purchase liquor contrary to the LLA. Given that the club program has been in operation for over 35 years, and in that period of time there have been no incidents of fraudulent activities of this or any other nature by clubs or their members, I am not persuaded that this is an existing or growing concern.

The claim that there is a potential for fraud was addressed by the affidavit evidence of Mr. Bourgeois, former counsel to the AGCO, who stated that clubs who place orders without supplying the required customer order information:

…create the potential for violation of the LLA and the LCA and eliminate the ability to verify properly that member orders exist for all of the products ordered and that each of the ordered products has been received, in a timely manner, by the member who ordered it.

In my opinion, the LCBO’s representations on this issue amount to no more than a claim that there is an opportunity for clubs to commit the types of fraud committed by other intermediaries or agents, such as manufacturers’ representatives.

The evidence submitted by the LCBO in this case stands in stark contrast to the evidence before me in Privacy Complaint Report PC07-100, which also involved the LCBO. In that case, the LCBO argued that the collection of the name, address and telephone number of individuals who returned goods to the LCBO was necessary, in part, to reduce the potential for losses associated with fraudulent returns. The LCBO provided evidence in that investigation to support its claim that the collection of personal information played a critical role in identifying fraud related to returned products, which was estimated to represent 8-10 per cent of returns, and which proved to be extremely valuable in curtailing fraudulent returns.

In its submissions regarding Privacy Complaint Report PC07-100, the LCBO was able to point to the concrete findings made in a report prepared by the Retail Council of Canada (RCC), which had studied losses to retailers from fraudulent returns. The RCC reported that the personal information was essential to helping retailers decide whether fraud was being perpetrated, and that the collection of this information had the positive effect of deterring fraud.

With respect to Order PO-3171, the Divisional Court stated that I failed to address the reasonable inference that the provision of personal information of club members when orders were placed on their behalf by clubs may be a primary reason that fraud has not been a problem with clubs before now. While this could be a reasonable inference in some circumstances, the information provided by the LCBO regarding the fraudulent activities of manufacturers’ representatives leads me to conclude that such circumstances are not present here. The LCBO has stated that despite regulatory provisions that mandated the collection of personal information in relation to purchases made through these agents, the agents were involved in activities that violated the LLA and the LCA. Therefore, the collection of personal information appeared to have no impact in these cases. In addition, in the representations filed in this reconsideration, the LCBO has stated that its decision to conduct spot audits led to a decline in fraud by agents, not any actions relating to the collection of personal information. I will also be addressing the practice of spot audits.

While there are opportunities for fraud in any retail industry, that alone does not entitle an organization to collect personal information every time it engages in business with a customer. Similarly, there are opportunities for fraud when an individual customer makes a purchase at an LCBO retail outlet. That fact alone does not justify the collection of personal information of all retail customers.

b) Necessary because of the Impact of Fraud

The LCBO stated that sales of liquor in the province through the Private Ordering department totalled $100 million last year. As the LCBO has indicated, sales to club members make up a small fraction of Private Ordering sales. In fact, it stated that 95 per cent of the total sales under the Private Ordering program relate to manufacturers’ representatives.⁵ Given that individuals with no club affiliation also make purchases through the same sales channel, sales to club members are a subset of 5 per cent of the total Private Ordering sales i.e. less than $5 million.

Furthermore, the LCBO states that over 90 per cent of club members’ sales involve clubs which do not pick up or deliver orders made on behalf of their members.⁶ For the purposes of this reconsideration, the relevant question here is the amount of sales through clubs that pick up orders on members’ behalf i.e. 10 per cent of $5 million or $500,000. Therefore, even if 10 per cent of that $500,000 were affected by fraud, the lost sales to the LCBO would only total $50,000 per year.

I also note that despite providing me with affidavit evidence from the Assistant Deputy Minister of Finance, the LCBO has not provided any evidence or information about the amount of tax revenue that would be exposed to risk if this personal information were not collected other than the bald assertion that the LCBO generates a significant amount of revenue for Ontario.

In representations filed during the initial investigation, the LCBO stated that 52 per cent of the final selling price of wine ordered through the Private Ordering department is provincial revenue. Based on the estimates noted above, the tax revenues that might be at issue here would be negligible at best.

c) Necessary to Deter Fraud

To respond to the fraudulent conduct of agents, the LCBO developed a system of spot audits which involves confirming orders with customers. The LCBO stated that it applies the same approach to clubs. It stated that the spot audit system is necessary for the effective and proper administration of the program and that the collection of personal information is necessary to carry out spot audits. It added that the spot audit program has had the effect of deterring fraud.

The Director stated that the LCBO’s practice of collecting personal information and conducting spot audits has contributed to curtailing the types of abuses that had previously occurred in the case of agents, since it is well known that the LCBO randomly contacts customers to confirm orders and the receipt of products. He referred to prosecutions by the AGCO of licensed agents, which would include manufacturers’ representatives, and stated:

While neither the AGCO nor the LCBO maintains statistics in respect of this issue, the prosecutions of agents by AGCO for this type of conduct have been significantly reduced in recent years and there have been no recent cases of large volumes of stockpiled products having been discovered on the premises of agents or clubs and returned to the LCBO warehouse.

Similarly, the former general counsel stated that the collection of personal information is an effective deterrent against the fraudulent resale of alcohol. However, he did not provide one relevant example to support his position. Rather, he points to his own experience as former general counsel to the AGCO, the organization responsible for enforcing the LLA with organizations holding licenses – in other words, he has not referred to a single example of fraud relating to the club program.

The fact remains that the only evidence of abuse provided to me relates to manufacturers’ representatives who are licensed bodies required by regulation to provide personal information when they place orders. Therefore, it cannot be said that this collection practice has resulted in a curtailment or deterrence of the fraudulent activities of clubs, given that there have been no reported cases of fraud by clubs.

I also note that despite the evidence provided about the practices of the other provinces in relation to club sales, which I will review later, the LCBO has not submitted any evidence of fraudulent activity in relation to the sale to members through clubs in other jurisdictions. Like the circumstances before the Court of Appeal in Cash Converters, I also find that there is no evidence in this case of a growing problem of fraudulent conduct by clubs.

The LCBO claims that its program of spot audits, which is dependent on the collection of personal information about sales, is an effective deterrent against fraud by clubs. In support of its position, the Director described the LCBO’s system of spot audits on agents and provided detailed examples of the spot audits it has conducted on agents. The evidence of the Director on this point is important. The Director stated, after referring to the specific examples of fraud by agents, and its practice of conducting spot audits on agents, that:

The LCBO also applies this approach to clubs, since the concerns which arise about illegal activity involving club orders are almost identical to those involving agents. The LCBO contacts, on a random basis, customers who purchase through agents or clubs to verify that they have received their products on a timely basis and in accordance with their purchase order. Because such sales are initiated by an intermediary, there is no direct contact/link with the LCBO by the customer when the customer’s purchase order is submitted. Given the high volume of sales processed through the Private Ordering Program, individual verification of each customer before an order is accepted is impractical and impossible. Accordingly, the LCBO confirms those sales through contacting customers on a random basis to ensure that their purchase orders have been properly filled and delivered.

This approach has contributed to curtailing the types of abuses which previously occurred in the case of both agents and clubs, since it is now well known that the LCBO randomly contacts customers to confirm orders and the receipt of products.

Therefore, after providing me with detailed evidence about the LCBO’s experience with fraud by agents, detailed evidence about the spot audit program in relation to those agents, and a copy of correspondence with an agent regarding the audit program, the LCBO merely indicates that it has applied the same approach to clubs.

Given that it is the activities of clubs, not agents, which are at issue in this reconsideration, I am perplexed by the lack of any detailed evidence about fraud on the part of clubs or about the measures taken to deter possible fraud by clubs. If the spot audit program was instrumental in curbing fraud by clubs, and the effective operation of that program is dependent on the collection of personal information about club members, why wasn’t such information provided in this investigation?

The LCBO representations did not include specific information about its audit practices in relation to clubs, including information about the frequency with which these audits are conducted on clubs and the results of such audits. Surely the staff performing the audit must document any audits that are conducted? Where are the reports to management on the number of audits of clubs conducted and the outcome of these audits? Where are the directions from management to staff about the frequency with which the audits on clubs should be conducted and the process to follow in conducting those audits? The absence of this type of documentation and information that one would reasonably expect about this practice is significant. This is particularly so when it is contrasted with the detailed information that was provided about the spot audit program as it relates to agents.

d) Necessary to Comply with Expectations that the LCBO will take Prudent Measures

The LCBO claimed that the Ministry of Finance expects it to take action to deter fraud. This claim was supported by the affidavit submitted by the Assistant Deputy Minister of the Ministry of Finance. In his affidavit, the Assistant Deputy Minister reviewed the statutory mandate of the LCBO under the LCA and stated that the Ministry of Finance expects that the LCBO will take prudent measures to protect tax revenues generated from the sale of liquor that help fund spending on health care, education and other key government priorities. As noted above, the Assistant Deputy Minister did not provide any specific information regarding the potential financial impact of fraud in relation to the LCBO’s club program.

The affidavit of the former general counsel to the AGCO also stated that the LCBO has the authority and responsibility to control the sale of liquor within the province and is accountable for taking precautions to prevent clubs and other intermediaries from operating as unauthorized, illegal, retailers of liquor by purchasing and reselling.

Given that the LCBO has failed to provide any information to support its claims about the existence of fraud or that fraud is a growing problem in relation to the club program, or about a significant risk to tax revenues arising in relation to the club program, I fail to see how the evidence or information referred to above supports a finding that the collection is necessary for the proper administration of the club program.

e) Necessary for Effective Enforcement under the Regulatory Scheme

I have received very detailed representations and affidavit evidence that describe the regulatory system that applies to the sale of liquor in Ontario. The system is described by the former general counsel as a closed system since the sale and service of liquor is limited to those who have statutory authority or a license. This closed system applies whether an individual purchases liquor through manufacturers’ representatives, licensees, retail outlets or by way of a special order under the LCBO’s Private Ordering program.

The former general counsel to the AGCO also stated that the ability to ensure compliance with the closed system depends on a number of things, including the ability to collect and retain information that can be used to conduct inspections and verify compliance. I understand the position to be that the closed system cannot operate successfully or effectively absent the collection of personal information. Elsewhere, the LCBO states that an effective enforcement regime requires both a records reporting scheme and a mechanism by which the regulator may confirm information through spot checks or random monitoring – a program that is in place for licensees and manufacturers’ representatives in the liquor industry.

The affidavit evidence of the AGCO’s former counsel also described the regulatory scheme relating to licensees and manufacturers’ representatives as a trust but verify approach to ensure compliance. He stated that there is a requirement to comply and an assumption that persons will comply. However, it is essential that information, including personal information, be collected and retained so that the regulator can verify the information provided and conduct inspections. He also stated that this information is essential for any legal proceeding that may be taken against a person where there has been a failure to comply.

In the context of clubs, the LCBO stated that the net effect of a finding that the collection of personal information is not permissible is that the LCBO will delegate the recordkeeping responsibilities to clubs – unlicensed bodies – and trust that they follow those obligations. It quotes the following passage from the Divisional Court’s decision:

…the IPC Order effectively requires the LCBO to delegate its responsibility in this regard to the unlicensed wine clubs it does not necessarily trust. Even if the complainant in this case satisfied the IPC that Vin de Garde would not breach any provisions of the LCA or LLA, other clubs certainly might, given the financial incentives for those who might engage in the illicit sale of alcohol.

I accept that the LCBO has a wide range of responsibilities under the LCA and LLA. However, as I concluded earlier, that mandate does not include the responsibility or authority to collect the personal information of club members’ purchases. Therefore, it cannot be said to have delegated any of its own responsibilities in that regard to unlicensed clubs. The real issue here is whether the collection of the personal information is necessary in the context of the regulatory regime applicable to clubs for the proper and effective administration of the club program.

From the outset, it is essential to understand the difference between clubs and licensees, including manufacturers’ representatives or agents. While the approval process for licenced entities is more rigorous than for clubs, licensed entities have the authority to undertake activities that, absent a license, would be contrary to the LLA and/or the LCA.

Clubs do not have the same authority. Clubs are authorized to make purchases on behalf of their members – no more than that. As stated by the LCBO, registration of a club pursuant to the Club Guidelines:

…does not confer on a club any particular rights or obligations other than the ability to submit orders on behalf of members using streamlined paperwork and to pick up the product on behalf of members who authorize the club to do so.

In my view, the more appropriate analogy is between clubs and individuals who purchase products through the retail outlets, including for family, friends and colleagues. Therefore, it is not reasonable to infer what is necessary to create an effective enforcement regime for clubs from the enforcement regime that is applicable to licensees, manufacturers’ representatives and agents.

The LCBO has also raised concerns about the feasibility and effectiveness of routine and random inspections as a means of ensuring compliance by clubs. For example, it submitted that one-third of clubs operate out of the homes of club members and that there are no regulatory recordkeeping requirements imposed on clubs. The LCBO added that it does not have the authority to inspect the record keeping or financial records of clubs. The LCBO further submitted that there is no screening process in place for clubs to confirm ability and trustworthiness as there is for manufacturers’ representatives who must apply for a license.

As I stated in Order PO-3171, the LCA gives the LCBO the power to appoint inspectors to conduct inspections under the LCA and the LLA. These powers give the LCBO broad authority to conduct investigations in places where liquor is sold, served, kept or stored or a location where books or records relating to the sale and storage of liquor are kept or required to be kept. As the LCBO acknowledged, the police have the authority to take action in relation to allegations of fraud, and illegal reselling and stockpiling of liquor.

In addition, there are other alternative and effective measures open to the LCBO to investigate potential fraud by clubs and club members. In confidential representations that were provided to me during the initial investigation, I was presented with detailed information about activities that are used by the LCBO to detect fraud that could be employed in relation to clubs.

In addition, it would be open to the LCBO to review club members’ orders to detect any anomalies in ordering patterns. The ordering patterns of clubs of similar size could also be compared, and this information could be used to form the basis of an investigation or inspection under the LCA or the LLA.

As the LCBO indicated, the club program requires the registration of a club and the submission of a detailed list of all members. This list must be updated by the club on an annual basis. It would therefore be open to the LCBO to refuse to approve a club if, in the opinion of the LCBO, the club was operating in violation of the LCA and/or the LLA.

These options represent alternative, less intrusive enforcement mechanisms, that are not dependent on the routine collection of the personal information of all club members and their orders, every time they place an order under the Private Ordering sales channel.

I understand that it may be helpful to have the personal information of club members but there is a difference between what I would construe as a perfect enforcement regime and an effective regime. In the absence of specific examples of fraud relating to clubs and their members, and the absence of any specific evidence of a growing concern about fraud, and in light of the powers to conduct investigations and the alternative options that could be utilized to create an effective enforcement regime, I am not satisfied that the collection of personal information by the LCBO is necessary to the proper administration of the club program.

f) Necessary to Ensure Compliance with Other Regulatory Requirements

The LCBO argued that the collection of personal information is necessary to comply with other basic requirements of the statutory scheme such as confirming that the purchaser is 19 years of age. It also argued that absent the collection of personal information, clubs will be violating section 33.1 of the LLA and that the LCBO will be facilitating a violation of the LLA.

The LCBO did not explain how the collection of the name and contact information of members can address the LCBO’s responsibility regarding underage consumers and section 33.1 of the LLA. It also failed to explain how this information is necessary for other basic requirements of the statutory scheme. In my view, the collection of personal information has no bearing on these issues.

Supporting the LCBO’s position, the Assistant Deputy Minister added that social responsibility is a key component for the legislative regime for the sale of liquor in Ontario and he referred to sections 27 through 30 of the LLA. In summary, these provisions prohibit the sale of alcohol except through an authorized person; prohibit licensees and agents giving liquor to any person except as permitted by regulation; prohibit the sale or supply of liquor to an intoxicated person; and prohibit the sale of liquor to a person who is or appears to be under 19 years of age.

The Assistant Deputy Minister and the LCBO did not explain how the collection of personal information about the purchases of club members could impact, let alone does impact, these prohibitions, nor is the connection apparent. I fail to see how the mere pointing to these prohibitions demonstrates that the collection of the personal information is necessary to the proper administration of the club program.

Industry Standard

The Director stated that with the exception of Nunavut (which has no wine club program) and Alberta (which has a privatized model for the sale of alcohol and therefore does not have a discreet process for wine club purchases), all other provinces and territories offer a form of wine club program. She stated that there are slight variations in practices between them, but that every province with a wine club program requires that name and contact information for purchasers be provided by the wine club along with the individual order of the member. She attached copies of emails received from these jurisdictions to support this statement.

I have carefully reviewed the affidavit and the emails from the liquor boards and commissions in Saskatchewan, British Columbia, New Brunswick, Manitoba, Prince Edward Island and Quebec. Each of those jurisdictions has a club program. However, in each of those provinces, the members of the club pick up the products directly from the board or commission store. In fact, some of these provincial boards and commissions indicated that the only club operating in their province is the Opimian Society, whose members pick up their products from the store of their choice.

In the circumstances of these six provinces, it is necessary for the boards and commissions to collect the names and contact details of the individual picking up the products so that they can be assured that the correct individual is picking up the products ordered. This is the same basis upon which some clubs operate in Ontario. As I found in Order PO-3171, I accept that it may be necessary to collect the personal information of the club members in these circumstances because it is necessary to the administration of the club program.

As the Director noted, the club program in Nova Scotia is regulated by statute. The scheme specifically provides for the issuance of special permits for groups to operate liquor, beer and wine societies and allows the societies to order liquor in such quantities as are set out in regulation. When societies apply for a permit, they must provide information. However, it is also clear that the society or club member specifies which store it prefers for pickup and the order is shipped there. Therefore, like the circumstances in the six provinces referred to above, the Nova Scotia liquor board needs the information for the purposes of ensuring that the individual who picks up the order is the right person.

According to the information provided, the liquor board in Newfoundland appears to be the only agency to indicate that it requires the personal information of club members every time an order is placed, regardless of what arrangements are made for the pickup of products. On that basis, this is the only jurisdiction in Canada that appears to have a practice that is similar to the practice of the LCBO in Ontario.

It is important to note that the practices of the Newfoundland liquor board do not appear to have been the subject of a review or investigation by that province’s Information and Privacy Commissioner. Absent further information and a detailed consideration of the practices and applicable legislation in Newfoundland, I do not think we can assume that these practices would be found to be justified, or even lawful.

In its submissions, the LCBO also stated that its practice of collecting customer information is consistent with normal commercial practice in the retail industry where special orders are placed. I have not been provided with specific information or evidence by the LCBO to support this position. However, assuming that such a common practice exists in the retail sector, this would not account for situations similar to the one at hand where the special order is placed through an intermediary, as is the case of clubs. Regardless, without any evidence to explain or support its position, I am unable to accept the LCBO’s position that its collection practices are consistent with normal practices in the retail industry.

Having carefully considered all of the information provided, I am not satisfied that the LCBO’s collection practices are consistent with industry standards.

Sales to Intermediaries and Legislative Intent

The LCBO stated that the sale to a member through their club is similar to a sale to manufacturers’ representatives in that each involves a sale through an intermediary. Further, it stated that the Legislature determined that it was necessary to collect personal information about the individual purchases made through manufacturers’ representatives by passing a regulation to this effect. Therefore, one should infer that the collection of personal information is necessary in the case of sales that occur through clubs.

In particular, the LCBO added that the very detailed provisions contained in the regulations under the LLA that apply to manufacturers’ representatives reflect the Legislature’s determination of what is needed to enforce the restrictions in the LLA and the LCA relating to the sale, canvassing for, and receipt and solicitation of, orders for the sale of liquor. It submitted that this information is equally necessary in the case of clubs to enforce and ensure compliance with s. 5 of the LLA and the general scheme of Ontario’s liquor laws.

I agree that manufacturers’ representatives are intermediaries who make purchases on behalf of others and to that extent there are similarities with clubs who make purchases on behalf of their members.

However, in the case of the sale by the LCBO through the manufacturers’ representatives, the Legislature has mandated that the LCBO should collect certain specified information of the individuals or organizations on whose behalf the manufacturers’ representatives make the purchases. The right to collect the information is set out in section 2.1(3) of Regulation 718 of the LLA. Therefore, the collection of any personal information by the LCBO about the purchasers of liquor through manufacturers’ representatives is expressly authorized by statute, and therefore, is permissible pursuant to the first exception that appears in section 38(2) of the Act. There is no similar express authority to collect the personal information in the context of a sale to members through clubs.

Clubs are also different from manufacturers’ representatives in other respects. Clubs are not licensed bodies that are regulated under the LLA and they are not overseen by the AGCO in any other way. In addition, as noted above, manufacturers’ representatives have greater authority to carry out activities in relation to the sale and purchase of liquor than clubs, including the authority to place orders on behalf of licensees and to purchase products through the Consignment program. These are material differences since absent the appropriate authority, these activities would be a violation of the LLA and/or the LCA.

I therefore do not agree that the existence of detailed statutory provisions relating to the collection of information about the individuals who purchase through manufacturers’ representatives are evidence of what is needed for the proper administration of the club program. The LCBO argues that this regime underscores the importance of enforcement powers within the liquor industry. I do not agree with this analysis either. If the Legislature had thought it was necessary to have an equivalent enforcement regime in relation to clubs, it would have enacted one.

The LCBO stated that the absence of an equivalent statutory authority for clubs cannot be viewed as a legislated policy choice. I disagree. The Legislature had the opportunity to pass regulations in relation to the club program over the last 35 years. In these circumstances, I am not persuaded that the existence of regulations for other bodies is evidence of what is necessary for an effective program in relation to clubs.

Other Matters

The LCBO argued that the expectation of privacy is reduced in a voluntary regulatory environment. In support of that proposition it relies on a line of cases that considers the privacy rights of individuals who are subject to search and seizure powers of other regulatory agencies. As it rightfully acknowledged, each of the cases cited deals with the lawfulness of the regulator’s search and seizure powers under section 8  of the Canadian Charter of Rights and Freedoms  (the Charter ).7 The LCBO stated that the focus of these cases was the balancing of the privacy interests of the individual as against the agency’s need for effective enforcement mechanisms.

The issue before me in this case is not the lawfulness of the LCBO’s enforcement provisions under section 8  of the Charter . The only question before me is whether the collection of personal information complies with the Act. The analogy drawn between reasonable expectations of privacy under the Charter  and the question of whether the collection of personal information complies with section 38(2) is not helpful or instructive.

Before I conclude, I note that the LCBO has also argued that one of the reasons that it collects club members’ personal information is to facilitate product recalls. This was also raised in the original investigation. However, beyond that bald assertion, I was not provided with any information or evidence to support this claim.

Conclusion

The LCBO’s representations and the affidavit evidence lack sufficient detail to support the arguments made regarding the application of the necessity test in section 38(2).

I find, in relation to the LCBO club program, that the LCBO has not satisfied me of the following:

1. 1. there is an existing or growing concern with fraud among clubs or their members;
2. 2. there is sufficient evidence of monetary loss or potential for significant monetary loss due to fraud;
3. 3. its practice of collecting personal information is consistent with industry standards;
4. 4. the collection of the personal information is necessary to comply with the LLA or the LCA, or to ensure consistency with the statutory scheme;
5. 5. the collection of personal information is necessary or effective to deter potential fraud, or investigate actual or alleged fraud; or
6. 6. the legislative scheme that applies to manufacturers’ representatives is evidence of what is necessary for the effective and proper administration of the club program.

Having carefully reviewed all of the information provided, I find that the collection of personal information by the LCBO in relation to orders placed through clubs is not necessary for the effective and proper administration of the club program.

Issue 2: If the collection of personal information is not in accordance with section 38(2) of the Act, should a cease collection and/or a destroy collections of personal information Order be issued pursuant to section 59(b) of the Act?

I have found that the collection of personal information by the LCBO about club members who purchase products through the club is contrary to section 38(2) of the Act. I must now determine the appropriate remedy.

As noted above, in my correspondence to the LCBO inviting it to submit representation on the issues in this reconsideration, I also notified the LCBO that I may issue an Order under section 59(b) of the Act. Section 59(b) states:

The Commissioner may,

(b) after hearing the head, order an institution to,

(i) cease collection practices, and

(ii) destroy collections of personal information,

that contravene this Act;

The LCBO has stated that even if I find that it has not complied with section 38(2) of the Act, no Order should be issued under section 59(b) for the following reasons:

1. (i) section 59(b) is permissive so I have the discretion as to whether or not an Order should issue;
2. (ii) cease collection Orders are unusual and extraordinary, and should not be issued as a matter of course;
3. (iii) an Order is not appropriate given the current status of the program, in that it is operating under interim measures so that all club orders are processed for customer pickup and therefore the program is compliant with Order PO-3171 and the Act;
4. (iv) the club program is being transitioned so that clubs will be required to get a license, and for this reason, there would be little utility in requiring club members’ ordering procedures to be revamped and then issue directives which require clubs to return to previous practices; and
5. (v) all club members governed their affairs on the basis that the information collected would be retained. If destroyed, the records will not be available to club members who wish to seek access to them.

I am satisfied that a cease collection and destruction Order should be issued in the circumstances of this investigation, given that I have found the LCBO’s collection practices do not comply with the Act.

My decision as to whether to issue a cease collection and a destruction Order is based on the nature of the information collected and retained by the LCBO, the circumstances surrounding the collection and retention, and whether these practices are in compliance with the Act. In my view, both these Orders are necessary to address the inappropriate, unnecessary, and routine collection of personal information of LCBO customers about their participation in lawful behaviour. The LCBO’s decision to adopt interim measures in response to Order PO-3171 and its plan to take steps to otherwise alter the club program, do not obviate the need for the issuance of these Orders.

As for the club members’ right of access to records relating to their purchases, I note that the LCBO states that it has not collected the personal information of club members about their purchases since the issuance of Order PO-3171 in February 2013 – well over a year ago. In addition, the LCBO has not suggested that it has actually used these records or that any individual has actually sought access to these records.

In view of all of the circumstances, I believe it is important to issue these Orders and, in so doing, ensure that the privacy rights of the LCBO’s customers are protected in the same way that the privacy rights of all individuals who interact with other government institutions are generally protected.

Having regard to all of the information and evidence before me, I find that an Order compelling the LCBO to cease its collection practices and destroy the personal information collected in violation of this Act should be issued.

SUMMARY OF FINDINGS

I have made the following findings in this investigation:

1. 1. The information being collected by the LCBO qualifies as personal information under section 2(1) of the Act.
2. 2. The LCBO’s collection of the personal information of spirit, beer, and wine club members when processing purchase orders submitted by these clubs on their behalf, except in those circumstances where an individual member intends to personally pick up the products ordered, contravenes section 38(2) of the Act.

ORDER

I order as follows:

Cease Collection

1. I order the LCBO to cease collecting the personal information of spirit, beer, and wine club members when processing purchase orders submitted by these clubs on their behalf, except in those circumstances where an individual member intends to personally pick up the products ordered.

Destruction

2. I order the LCBO to destroy all personal information that has been collected from spirit, beer and wine club members when processing purchase orders submitted by these clubs on their behalf, except in those circumstances where an individual member made arrangements to personally pick up the products ordered.

3. In order to verify compliance with this Order, I require the LCBO to provide this office with proof of compliance by September 25, 2014.

Original signed by: Cathy Hamilton Adjudicator

June 25, 2014

---

¹ Liquor Control Board of Ontario v. Vin de Garde Wine Club, 2013 ONSC 5854.

² 2007 ONCA 502 (C.A.)

³ [2004] 2 S.C.R. 427

⁴Office of the Independent Police Review Director (Re), 2011 CanLII 53348 (ON IPC)

⁵ See LCBO submissions dated January 7, 2013 at page 7.

⁶ See sworn affidavit of Nikitas Nanos, May 27, 2014, at page 12 (footnote 3).

⁷ Section 8  of the Charter  states that everyone has the right to be secure against unreasonable search or seizure.