ORDER NUMBER

G-20-19

 

IN THE MATTER OF

the Utilities Commission Act, RSBC 1996, Chapter 473

 

and

 

FortisBC Energy Inc.

Application for Reconsideration to Exclude Employee Information from 2015 Data Order G-161-15

 

BEFORE:

D. J. Enns, Panel Chair/Commissioner

R. I. Mason, Commissioner

 

on January 30, 2019

 

ORDER

WHEREAS:

 

A.      On May 23, 2018, FortisBC Energy Inc. (FEI) submitted an application with the British Columbia Utilities Commission (BCUC) seeking the following:

•         an order pursuant to section 99 of the Utilities Commission Act (UCA) that Order G-161-15 be varied so as to exclude “Employee Information” as defined in that order; or alternatively,

•         an order pursuant to section 88(2), exempting from Order G-161-15 all “Employee Information” or, at minimum, particular employee data (Pension Data) held by FEI’s pension actuaries, Willis Towers Watson (WTW) (Application for Reconsideration).

B.      On October 13, 2015, the BCUC issued Order G-161-15, permitting FEI to store Customer Information, Employee Information and Sensitive Information on servers outside of Canada where (i) the data is encrypted or de-identified and (ii) the encryption keys and de-identification keys are located within FEI’s data centres that are located in Canada;

C.      FEI advised in its May 23, 2018 filing that the Chief Privacy Officer, in a recent internal review, identified that WTW has held the employee information regarding employees who participate in pension plans on US-based servers (Pension Data), without encryption or de-identification, for more than 30 years. This includes former and current employee information. In its filing, FEI stated that it wishes to apprise the BCUC of the issue, and to apply to the BCUC for an order that will determine how FEI proceeds;

D.      FEI submits that the BCUC’s jurisdiction under the UCA does not extend to employee data, or alternatively the BCUC should not exercise its jurisdiction in respect of Employee Information;

E.       On July 12, 2018, the BCUC issued order G-125-18, establishing a regulatory timetable to include submissions on BCUC jurisdiction by FEI and registered interveners;

F.       In their submission on August 10, 2018, registered intervener MoveUP requested to suspend the regulatory timetable to afford FEI an opportunity to consult with MoveUP and explore the possibility of finding an adequate resolution to the underlying issue of employee information protection. On September 24, 2018, after considering submissions by registered parties on MoveUP’s request, the BCUC issued Order G-174-18, denying MoveUP’s request to suspend the proceeding and establishing a regulatory timetable to include final arguments on BCUC jurisdiction by FEI and registered interveners. On September 26, 2018, the BCUC issued Order G-183-18 which replaced and rescinded Order G-174-18 to provide clarification on the next steps in the regulatory timetable;

G.      On September 26, 2018, FEI applied, pursuant to section 88(2) of the UCA, for temporary relief requesting that, pending the BCUC’s final order in this proceeding, FEI is temporarily exempted from Order G-161-15 as it relates to “Employee Information” sent to FEI’s pension actuaries, WTW, for the purpose of performing analysis for the preparation of FEI’s 2018 year-end audited external financial statements;

H.      On November 6, 2018, after considering submissions by registered parties on FEI’s request, the BCUC issued order G-210-18, approving FEI’s request for temporary relief for financial reporting until December 31, 2018; and

I.        The BCUC has reviewed FEI’s Application for Reconsideration and final and reply arguments of the parties and considers it appropriate to vary Order G-161-15.

NOW THEREFORE pursuant to section 99 of the UCA and for the reasons attached as Appendix A to this order, FEI’s request for reconsideration and variance of Order G-161-15 (Application for Reconsideration) is approved. Recitals D(b) through D(d) of Order G-161-15, to the extent to which they reference “Employee Data” as that term is defined in Order G-161-15, are rescinded.

 

DATED at the City of Vancouver, in the Province of British Columbia, this              30^th              day of January 2019.

 

BY ORDER

 

Original signed by:

 

D. J. Enns

Commissioner

 

 

Attachment

 

 

 

 

 

 

Table of Contents

Page no.

 

1.0         Introduction. 3

1.1          Background. 3

1.2          FEI Application for Reconsideration. 3

1.3          Applicable Legislation and Reconsideration Criteria. 4

1.4          Regulatory Process. 5

2.0         Parties’ Submissions. 5

2.1          FEI Position. 5

2.2          MoveUP Position. 7

2.3          FEI Reply Submission. 8

2.4          Other Party Submissions. 9

3.0         Panel Determination. 9

 

 

 

1.0              Introduction

1.1              Background

In 2005, the British Columbia Utilities Commission (BCUC) issued Order G-116-05 approving the acquisition of the common shares of Terasen Inc. (Terasen) by Kinder Morgan, Inc. (KMI). As a condition for approval of the transaction, the BCUC required that KMI not change the geographic location of any existing functions or data currently in Terasen’s service area without prior approval of the BCUC.

 

On June 26, 2006, the BCUC issued Letter L-30-06 clarifying the conditions issued by the BCUC in Order G-116-05.

 

In 2006, the BCUC also issued Order G-75-06 ordering that the location of data and servers providing service to Terasen is to be restricted to Canada and that any proposal to locate data and servers providing services to Terasen (including data and servers providing back-up services) outside Canada would require the BCUC’s approval.

 

In 2007, the BCUC issued order G-49-07 approving the acquisition of all of the issued and outstanding shares of Terasen by Fortis Inc. (FEI). As part of Order G-49-07, the BCUC determined that the conditions set out in BCUC Decision and Order G-116-05, revised by BCUC Order G-75-06 and clarified by BCUC Letter L-30-06 relating to ring-fencing, governance and location of functions and data should continue to be imposed.

 

In 2015, the BCUC issued Order G-161-15 removing the restrictions imposed by G-49-07, and permitting FEI to store customer, sensitive and employee information outside Canada as long as the data is encrypted or de-identified and that transcription keys were retained and controlled in Canada.

 

On May 23, 2018, FEI filed a submission with the BCUC to advise that an internal audit process had discovered that FEI had failed to comply with Order G-161-15. FEI states that it understood no FEI data was being stored in the United States at that time. However, FEI has since discovered that employee information is stored on the US-based servers of Willis Towers Watson (WTW), its pension actuaries.[1]

 

In the May 23, 2018 submission, FEI provides information to the BCUC regarding the specific nature of the information stored in the United States and the security measures being taken to protect the information. FEI also provides information to show that employees have consented to the storage of data in the United States, and that steps are being taken to address why this issue was not flagged.[2]

 

1.2              FEI Application for Reconsideration

On May 23, 2018, accompanying its submission to advise that it had failed to comply with Order G-161-15, FEI filed an application pursuant to sections 88 and 99 of the Utilities Commission Act (UCA), requesting that:

•         the portion of Order G-161-15 applicable to “employee information” be rescinded, or alternatively;

•         all employee information, or at a minimum, employee data (pension data) held by FEI’s pension actuaries WTW, be exempted from Order G-161-15 (Application for Reconsideration).

 

FEI raises a fundamental concern that the BCUC erred in issuing Order G-161-15 and that the BCUC’s jurisdiction does not extend to employee data. Further, FEI submits that “…these matters are best addressed through the employment relationship and applicable privacy laws.”[3] FEI concludes that the BCUC acted beyond its jurisdiction when it ordered FEI to encrypt employee information and maintain control over the encryption keys in Canada under section 44(2) of the UCA.[4]

 

FEI accedes that Order G-161-15 is within BCUC’s jurisdiction with respect to requiring that customer and sensitive data, if stored outside of Canada, should be de-identified where required and encrypted.[5]

 

1.3              Applicable Legislation and Reconsideration Criteria

Section 44 of the UCA provides:

(1)    A public utility must have in British Columbia an office in which it must keep all accounts and records required by the commission to be kept in British Columbia.

(2)    A public utility must not remove or permit to be removed from British Columbia an account or record required to be kept under subsection (1), except on conditions specified by the commission.

Section 99 of the UCA provides:

The commission, on application or on its own motion, may reconsider a decision, an order, a rule or a regulation of the commission and may confirm, vary or rescind the decision, order, rule or regulation.

In addition, the BCUC Reconsideration Guidelines[6] provide the following:

 

An application for reconsideration by the BCUC proceeds in two phases:

 

Phase One:         In the interests of both efficiency and fairness, and before the BCUC proceeds with a determination on the merits of an application for reconsideration, the application undergoes an initial screening phase. In this phase the applicant must establish a prima facie case sufficient to warrant full consideration by the BCUC. In the first phase, the Panel generally applies certain criteria to determine whether or not a reasonable basis exists for allowing the reconsideration. This includes whether:

•         The BCUC had made an error in fact or law;

•         There has been a fundamental change in circumstances of facts since the decision;

•         A basic principle has not been raised in the original proceedings; or

•         A new principle has arisen as a result of the decision.

 

Phase Two:         If necessary, the reconsideration proceeds to the second phase where the BCUC hears the full arguments on the merits of the application.

 

 

1.4               Regulatory Process

By Order G-125-18, dated July 12, 2018, the BCUC established a regulatory timetable for FEI’s Application for Reconsideration and invited submissions from FEI and all registered interveners in the 2015 Application for Removal of the Restriction on the Location of Data and Servers Providing Service to the FEU, currently Restricted to Canada (2015 Data Order) proceeding. The BCUC received submissions from FEI, MoveUP and the Commercial Energy Consumers Association of British Columbia (CEC) with a reply submission from FEI. Within their submissions, Parties addressed both phase 1 and 2 reconsideration considerations.

 

By Order G-201-18, dated October 19, 2018, the BCUC established an amended regulatory timetable which included one round of information requests to FEI, intervener responses and reply submissions from FEI.

2.0              Parties’ Submissions

2.1              FEI Position

Application for Reconsideration

FEI argues that neither the UCA nor any other statute provides the BCUC the jurisdiction required to exclude employee data through Order G-161-15.

 

In response to Panel IR 2.4, FEI confirmed that it is seeking a reconsideration of items D(b) and (d) in Order G-161-15 only. FEI stated that their question regarding BCUC jurisdiction does not apply to any previous orders (such as G-116-05, G-75-06 or G-49-07) as the restrictions established under those orders had not applied to employee information, and the employee information requirement was introduced for the first time in 2015.[7]

 

Regulating Storage of Employee Information

FEI argues that the purpose of utility regulation and the BCUC’s role relates to rates, service and integrity of the system. FEI cites ATCO Gas and Pipeline Ltd. v. Alberta (Energy and Utilities Board) (ATCO Gas) and the approach to statutory interpretation which establishes that the words of an Act are to be read in their entire context and in their grammatical and ordinary sense harmoniously with the scheme and object of the Act and the intent of Parliament.[8] Citing ATCO Gas, FEI states “The limits of the powers of the Board are grounded in its main function of fixing just and reasonable rates, and in protecting the integrity and dependability of the supply system.”[9]

 

FEI submits, “All of the information necessary for the Commission to assess pension costs, and the performance and management of the pension plans, is available on FEI’s BC servers. This includes the Employee Information sent to WTW as well as WTW’s final work product.”[10] FEI submits that “the BCUC cannot make orders regarding how and where additional copies that are already accessible to the BCUC are stored for the purpose of regulating employee privacy.”[11] Further, FEI states that “When the requirements of ATCO are properly considered, the impugned provisions of the Data Order are demonstrably ‘unlawful’.”[12]

 

FEI states that the essence of Order G-161-15 is to regulate the dissemination of copies of data for the purpose of regulating privacy. The effect, however, is that the Order G-161-15 overrides the terms of employment that expressly allow for FEI to send employee information out of the province. Further, FEI states that Order G-161-15 impermissibly regulates employee privacy and employment terms beyond the BCUC’s jurisdiction.[13]

 

The Personal Information Privacy Act (PIPA)[14] is the privacy legislation to which FEI must comply. PIPA does not restrict FEI’s storage of data outside Canada. FEI argues that PIPA and the provisions of Order G-161-15 are inconsistent and on that basis the restrictions governing the storage of data outside Canada are invalid.[15] FEI further argues that the Labour Relations Code gives jurisdiction over collective agreements. Citing British Columbia Hydro and Power Authority v. the British Columbia Utilities Commission, FEI states that the BCUC may not intervene in matters of management.[16]

 

FEI submits that section 44 of the UCA must be read in context and not in isolation because it uses open-ended language. Referring to ATCO Gas, FEI states that the BCUC cannot read section 44 without regard to the broad purpose and objects of the section or the UCA as a whole,[17] and supports its position through the four assertions which follow:

1.       Reading section 44 in context does not allow the regulation of where data must be stored because the intent of the section is to oblige utilities to provide information or to make it accessible to the BCUC.[18]

2.       The BCUC could, as an example, order utilities to adopt a uniform system of accounting so that the BCUC can review the accounts of all utilities on equal footing, regardless of where the information comprising the accounts is stored.

3.       In a case such as the foregoing, electronic copies of the information remain readily accessible to the BCUC notwithstanding copies being stored outside Canada.[19]

4.       The legislative history of section 44 supports the view that the storage of data simply remains accessible to the BCUC. Moreover, the accounts and records in section 44 must be rationally connected to the BCUC’s role which FEI interprets is not the case.[20] FEI asks how the information stored by WTW is relevant to the regulation of a public utility.

FEI submits that the BCUC had relied upon section 44 of the UCA to issue Order G-161-15, noting that it was the only potential basis for finding jurisdiction. Section 44 does refer to the location of “accounts and records”, but the section must be interpreted with regard to the purpose of the legislation and intention of the Legislature. The purpose and intent of section 44 is to ensure that records are available to allow the BCUC to regulate the utility, it is not about protecting privacy or dictating how and where electronic copies must be stored. Therefore, FEI believes Order G-161-15 was beyond the BCUC’s jurisdiction as it related to employee information.[21]

 

FEI concludes that in relying on section 44, the BCUC had neither explicit authority under the UCA, nor implicit authority through the doctrine of necessary implication because of the other statutes that cover issues of privacy and management’s capacity to decide, including the Labour Code and PIPA.[22]

 

2.2              MoveUP Position

Application for Reconsideration

MoveUP submits that the BCUC not only had the requisite jurisdiction to make Order G-161-15, including the provisions dealing with the storage of employee data, but also that FEI attorned and consented to Order G-161-15.[23]

 

Regulating Storage of Employee Information

MoveUP claims that employee information plays a significant role in setting rates and that reasonable steps should be taken to protect the private information of both customers and employees and from clandestine access through the USA Patriot Act. MoveUP asserts that these requirements fall within the BCUC’s authority under section 44 of the UCA.[24]

 

MoveUP cites Dunsmuir v. New Brunswick (Dunsmuir) and Rio Tinto Alcan v. Carrier Sekani Tribal Council (Rio Tinto Alcan), and states that since ATCO Gas, the jurisdiction of tribunals such as the BCUC has been broadened. The BCUC may interpret the extent of its power beyond its parent statute.[25] MoveUP further states that administrative tribunals are “…free to …interpret their statutes, so long as their decisions fall within a range of potential reasonable outcomes.”[26]

 

In MoveUP’s view FEI’s argument is too narrow because it seeks to confine the scope of section 44 to conditions which existed when its ancestral provisions were originally passed.[27] Citing Rio Tinto Alcan, MoveUP argues that the narrow reading of the section does not provide a full understanding of its meaning and that the courts have broadened the BCUC’s authority to read section 44 more widely.[28]

 

In limiting the argument to employee data rather than including customer and sensitive data as Order G-161-15 indicates, MoveUP submits that, “…the utility’s argument is inconsistent and contradictory.”[29]

 

MoveUP submits “…PIPA does not confer exclusive jurisdiction on the Office of the Information and

Privacy Commissioner in the enforcement of the rights it creates. It does not oust any powers

the Commission or any other tribunal might otherwise have had.”[30] MoveUP agrees that the text of section 44(2) is broadly worded and therefore must be read considering the purpose and intent of the legislation and not in isolation. MoveUP differs with FEI in that it believes the BCUC has the jurisdiction under section 44(2) to order the location of employee data and that the role of the BCUC has expanded beyond the role of its core functions to include protection from privacy issues like the impact of the USA Patriot Act.[31] Therefore, MoveUP’s position is that the BCUC’s jurisdiction has grown to deal with employee privacy concerns.

 

MoveUP submits that the BCUC has the jurisdiction to make determinations regarding the scope of its jurisdiction and that the legislature has left it up to the BCUC to determine what considerations it may take into account when formulating a section 44(2) condition such as storing data outside of British Columbia. MoveUP claims the 2015 decision is a lawful one.[32]

 

2.3              FEI Reply Submission

FEI responds that, although it agrees that pension data impacts rates, it does not mean the BCUC obtains jurisdiction simply because of information having cost implications.[33] The areas where the BCUC may direct FEI in non-rate making dealings, such as the issuance of securities and approving asset sales, are expressly set out in the UCA.[34] FEI notes, “When rates are set, the Commission leaves utility management to reallocate resources as they see fit.”[35]

 

FEI retains a copy of employee information on servers in British Columbia so that it remains accessible at all times. “The aspect of the 2015 Data Order that is ultra vires the UCA is the regulation of how and where all copies of Employee Information are stored for the sole purpose of protecting employee privacy. Simply put, section 44 is about transparency and the accessibility of information needed for regulation, not privacy regulation.”[36]

 

Although FEI acknowledges that it agreed employee information should be subject to encryption in the Streamlined Review Process transcript of the 2015 Data Order proceeding, this agreement alone does not give the BCUC jurisdiction that is not provided by the legislation in the context of ATCO Gas. Further, FEI states “…the consent of a party to a tribunal proceeding cannot confer on a tribunal any power to act beyond its jurisdiction”.[37]FEI concludes by stating that the BCUC’s jurisdiction comes from the UCA and not from other sources such as agreement, consent or attornment.[38] Regulating where and how employee information is stored goes beyond the jurisdiction of the BCUC.[39]

 

FEI submits that the BCUC must act lawfully when making orders under section 44(2) of the UCA and, to do so, the BCUC must be mindful of the ATCO Gas decision that broadly-worded provisions, such as section 44, must be interpreted with regard to the purpose and intention of the section and the UCA as a whole. Therefore, the application of section 44 is much more limited and cannot sustain the provisions of Order G-161-15 at issue.[40]

FEI submits there is a difference between regulating to ensure the BCUC has access to information and limiting how and where FEI can store additional copies of employee information already within British Columbia for the purpose of regulating employee privacy. For clarity, FEI is not taking a position with respect to the BCUC’s jurisdiction on the storage of customer data.

 

2.4              Other Party Submissions

In their submission on jurisdiction, the CEC submits that they agree with and adopt the submissions of FEI as set out in their final submissions, noting that “The CEC’s support of the FEI Submissions on employee data are without prejudice to CEC’s view that determinations on the collection and storage of Customer Information is within the jurisdiction of the Commission.”[41]

3.0              Panel Determination

Application for Reconsideration

In the Application for Reconsideration, FEI seeks a reconsideration of Order G-161-15 on the basis that the jurisdiction of the BCUC does not extend to the storage of FEI’s employee information. FEI requests a variation of Order G-161-15 to exclude Employee Data (as that term is defined in Order G-161-15).

 

The BCUC is a creature of statute and its jurisdiction is limited by legislation including the UCA and the doctrine of jurisdiction by necessary implication.[42] FEI argues that neither the UCA nor any other statute provides the BCUC with the jurisdiction required to make Order G-161-15 address Employee Data. MoveUP, on the other hand, submits that the BCUC not only had the requisite jurisdiction for Order G-161-15, including the provisions dealing with the storage of Employee Data, but also that FEI attorned and consented to Order G-161-15.

 

The Panel notes that although FEI’s Application for Reconsideration is not a formal, traditional reconsideration application, the Panel is treating it as such. The Panel has considered FEI’s Application for Reconsideration and submissions from all parties and determines that a prima facie case has been made; therefore the Panel will proceed directly to phase 2 of the reconsideration process.

Regulating Storage of Employee Information

The 2006 Supreme Court of Canada decision in ATCO Gas & Pipelines Ltd. v. Alberta (Energy & Utilities Board)[43](ATCO Gas), sets out the test for the interpretation of statutory jurisdiction for administrative tribunals, in part, beginning at paragraph 37:

37           For a number of years now, the Court has adopted E. A. Driedger’s modern approach as the method to follow for statutory interpretation (Construction of Statutes (2nd ed. 1983), at p. 87):

Today there is only one principle or approach, namely, the words of an Act are to be read in their entire context and in their grammatical and ordinary sense harmoniously with the scheme of the Act, the object of the Act, and the intention of Parliament. [citations omitted]

38           But more specifically in the area of administrative law, tribunals and boards obtain their jurisdiction over matters from two sources: (1) express grants of jurisdiction under various statutes (explicit powers); and (2) the common law, by application of the doctrine of jurisdiction by necessary implication (implicit powers) (see also D. M. Brown, Energy Regulation in Ontario (loose-leaf ed.), at p. 2-15).

In order for the BCUC to direct FEI’s storage of Employee Data, it must find its jurisdiction to do so in either the express words of the UCA or implied through the doctrine of jurisdiction by necessary implication. In the Decision accompanying Order G-161-15, the BCUC states that “Section 44 of the Utilities Commission Act is the only section of the statute that addresses the location of public utility records…”[44].

 

The Panel has not identified any other provision of the UCA which it considers provides the basis to explicitly direct how and where a utility should store copies of Employee Data. The Panel agrees with FEI’s submissions that the purpose and intent of section 44 is to ensure that records are available to the BCUC to allow it to regulate the public utility but not to protect employee privacy or dictate where electronic copies of “accounts or records” may be stored. This interpretation is further supported when one considers the purpose and intent of utility regulation, which, as stated by the Supreme Court of Canada in ATCO Gas is: “…to protect the public from monopolistic behaviour and the consequent inelasticity of demand while ensuring the continued quality of an essential service...”[45]

 

The Panel agrees with the parties that section 44 of the UCA is a broadly worded provision, which must not be interpreted in isolation but must be examined within the context, purpose and scheme of the legislation.[46] As set out in ATCO Gas, a utility regulator’s main function is “…fixing just and reasonable rates (‘rate setting’) and in protecting the integrity and dependability of the supply system.”[47] The principal function of the BCUC is therefore the determination of rates and any supervisory power over a public utility’s “accounts or records” is incidental to fixing rates.[48]

 

As described earlier, the powers provided by the UCA include not only the express grants of power but also those required which are practically necessary to accomplish the BCUC’s main function of rate setting and maintaining the integrity of the system. In the present case, the Panel does not find the regulation of the location of copies of Employee Data to be necessarily incidental to the legislative purpose and object of the UCA but rather is a matter for utility management.

 

Finally, although FEI consented to the initial Order G-161-15, it does not confer on the BCUC any power to act beyond its jurisdiction where none previously existed.

 

The Panel therefore finds that directing how and where employee data is to be stored as set out in Order G-161-15 goes beyond the jurisdiction of the BCUC and was an error of law. For these reasons, the Panel directs that recitals D(b) through D(d) of Order G-161-15, to the extent to which they reference “Employee Data” as that term is defined in Order G-161-15, are rescinded.