Lawful Access (2016): There, I fixed it for you.

In December 2013, I posted "Lawful Access: There, I fixed it for you.". I didn't think I'd need to link to it again so soon, but in light of the Government of Canada's recent Green Paper on national security, lawful access is back in the public policy spotlight. If you'd thought that the Spencer decision had put a bullet into the law enforcement and national security argument that "basic subscriber information" needs no protection and should be available wholesale the state, you're apparently wrong. The RCMP and the Canadian Association of Chiefs of Police have been working behind the scenes to try to circumvent the SCC's Spencer decision (See Once again, the RCMP calls for warrantless access to your online info. Once again, the RCMP is wrong.)

In my 2013 post, I'd suggested a fix for the apparent problem of police having difficulty in getting access to "basic subscriber information". It's now relevant again and I offer it for your consideration. I've made some small tweaks since 2013.

I'm happy to hear any input ...

Subscriber information production order

*(1) A justice or judge, including a designated judge under the Canadian Security Intelligence Act, may order a telecommunications service provider to produce subscriber information.

Production to peace officer

(2) The order shall require the subscriber information or information regarding multiple subscribers to be produced within the time, at the place and in the form specified and given

(a) to a peace officer named in the order; or

(b) to a public officer named in the order, who has been appointed or designated to administer or enforce a federal or provincial law and whose duties include the enforcement of this or any other Act of Parliament.

Conditions for issuance of order

(3) Before making an order, the justice or judge must be satisfied, on the basis of an ex parte application containing information on oath in writing, that

(a) there are reasonable grounds to believe that an offense designated under this Section has been, is being or is about to be committed;

(b) there are reasonable grounds to believe that the subscriber information will afford evidence respecting the identity of the person or persons believed to be responsible for the commission of the offence, or the identity of the persons believed to be the victim or the intended victim of such offense;

(c) there are reasonable grounds to believe that the person who is subject to the order has possession or control of the documents or data; and

(d) the issuing of the order will not unduly infringe the relevant subscriber’s rights set out in the Charter of Rights and Freedoms, including freedom of expression, based on the totality of the circumstances.

Terms and conditions

(4) The order may contain any terms and conditions that the justice or judge considers advisable in the circumstances, including terms and conditions to protect a privileged communication between a lawyer and their client or, in the province of Quebec, between a lawyer or a notary and their client.

Power to revoke, renew or vary order

(5) The justice or judge who made the order, or a judge of the same territorial division, may revoke, renew or vary the order on an ex parte application made by the peace officer or public officer named in the order.

Notice

(6) Unless the justice or judge who made the order, or a judge of the same territorial division orders otherwise, aAny person whose information is obtained as a result of such order shall be notified of the order and the disclosure of his or her subscriber information within six months of the date of the order. An order to delay the giving of notice under this paragraph may be made by the justice or judge who made the order, or a judge of the same territorial division may be made shall only be applicable for a maximum of six months and shall only be made if such justice or judge is satisfied, based on information on oath in writing, that the giving of such notice will likely compromise an active investigation or prosecution of an offence under this or any other Act of Parliament.

Probative force of copies

(7) Every copy of a document produced under this section, on proof by affidavit that it is a true copy, is admissible in evidence in proceedings under this or any other Act of Parliament and has the same probative force as the original document would have if it had been proved in the ordinary way.

Return of copies

(8) Copies of documents produced under this section need not be returned.

Subscriber information

(9) For the purposes of this section, “subscriber information” means the name, address, telephone number and electronic mail address of any subscriber to any of the service provider’s telecommunications services and the Internet protocol address and local service provider identifier that are associated with the subscriber’s service and equipment.

Use and retention of subscriber information

(10) Unless otherwise ordered by the justice or judge who made the order, or a judge of the same territorial division,

(a) subscriber information obtained pursuant to an order under this Section shall only be used for the investigation and prosecution of the offense or offenses referred to in the information used to obtain the order; and

(b) if the person about whom the subscriber information relates has not been charged with an offense referred to in the information to obtain the order, subscriber information shall only be retained until six months following the date on which the relevant person is notified pursuant to paragraph (6) herein.

Designated offences

(11) For the purposes of this Section, a designated offense means

(a) any offence that may be prosecuted as an indictable offence under this or any other Act of Parliament, or

(b) a conspiracy or an attempt to commit, being an accessory after the fact in relation to, or any counselling in relation to, an offence referred to in paragraph (a).

Tele-production Orders

(12) Section 487.1 respecting telewarrants shall apply with respect to subscriber information production orders, mutatis mutandis, in the same manner as such section applies with respect to search warrants.

National effect

(13) A subscriber information production order issued under this Section shall be applicable with respect to the telecommunciations service provider in any territorial division of Canada without requirement of endorsement by a justice or judge in the territorial division where the telecommunications service provider is located.

Compensation

(14) The telecommunciations service provider named in a subscriber information production order shall be compensated for the production of subscriber information in the manner and in the amount prescribed. Nothing herein shall require a telecommunications service provider to collect or retain any subscriber information beyond that which is ordinarily collected or retained in the course of the telecommunciations service provider’s business.

Report to Parliament

(15) Each calendar year, the Minister shall lay before Parliament a report regarding the use of subscriber information production orders, which report shall include:

(a) the number of subscriber information production orders issued in total for the previous calendar year;

(b) the number of subscriber information production orders issued per designated offense for the previous calendar year;

(c) the number of subscriber information production orders issued per territorial division of Canada for the previous calendar year;

(d) the number of and nature of the charges, prosecutions and convictions respecting each use of subscriber information production orders, including information respecting cases where charges do not result; and

(d) any other information the Minister considers relevant regarding the use of subscriber information production orders.

Application for review of production order

(16) Section 487.0193 shall apply with respect to subscriber information production orders, mutatis mutandis, in the same manner as such section applies to the production orders referred to in that Section.

Ontario court awards damages for family member's disclosure of mental health information

The Ontario Small Claims Court, in Halley v McCann, 2016 CanLII 58945 (ON SCSM), has recently awarded a plaintiff $9,000 in damages for breach of privacy. The case arose because the defendant disclosed the fact that the plaintiff had admitted herself to a mental health facility. The defendant is also the half-sister of the plaintiff. It was alleged that the defendant had told three people outside the facility about the plaintiff's stay there. No other information was disclosed.

10. The plaintiff left the crisis facility after a 6 day stay feeling much better and in control. Unfortunately this did not last. A week after returning home she was sitting on the front porch of Dean’s home when Lisa, Fabion’s former common law spouse, arrived. Upon seeing the plaintiff, Dean recalls that Lisa “blurted out ‘Were you in a crisis house?’ not even saying Hello first”. The plaintiff was visibly upset and shaken by the question and asked how she knew. Lisa said Fabion told her about the stay.

12. In the opinion of the plaintiff’s family doctor, filed as Exhibit 5, the plaintiff has “definitely” become more stressed, anxious and depressed since finding out that others were told of her stay in the crisis facility. It may also be contributing to her increased back pain.

13. Both the plaintiff and her boyfriend Dean report that she has become more fragile, anxious and reclusive than before the incident. Unlike before she rarely goes out, will not go shopping and has blackened the windows of her basement apartment. She will not seek respite care help even from other facilities because she fears treatment would likely come to the attention of the defendant through the network of caregivers.

The Court noted that two invasion of privacy torts exist in Ontario:

19. In sum, there are two recognized invasion of privacy torts in Ontario; neither requires proof of pecuniary loss or harm to an economic interest. Aggravated and punitive damages may be awarded and an award should serve as a deterrent to others.

20. These two common law torts exist in addition to the statutory right or cause of action available to a plaintiff under the privacy legislation. The Personal Health Information Protection Act, 2004 S.O. c. 3, Sch A, s. 65 (PHIPA) contemplates mental anguish damages for breaches of statutory duty up to a maximum of $10,000. In Hopkins v. Kay 2015 ONCA 112 (CanLII) (paras 44-45, 73) the Ontario Court of Appeal considered whether the complaints process available under PHIPA displaces the common law authority of the courts to award damages for breach of the statutory duty and found that the legislation is not intended to be an exhaustive or comprehensive compensatory scheme. The complaints process is more suited to systemic breaches and an individual victim retains the right to bring a civil court action for damages.

The Court made a number of conclusions that are worth noting:

27. I disagree for at least four reasons. First, personal health information includes information about the providing of health care (s. 4(1)(b) PHIPA), not just the details of diagnosis or treatment. The defendant’s disclosure told others that the crisis facility was providing health care to the plaintiff. “Visits” to the facility are expressly listed on the consent form as “confidential and/or personal health information”. I agree with the opinion of the crisis facility director; the staff and facility are under a statutory and contractual duty to keep the provision of care private.

28. Second, the names associated with the facility – Crisis Respite and Homes for Mental Health – provide some information about the mental health status or condition of the individuals who seek treatment there. Therefore the disclosure went beyond just the providing of care but gave some indication of the nature of the condition being treated. This health information was also required to be kept private.

29. Third, the plaintiff considered this a “private matter” – she did not tell anyone in her family and signed consents limiting the access to information to only two people. The defendant saw the file, and Dean’s name on the paperwork. “Visits” to the facility are expressly listed on the consent form as “confidential and/or personal health information”. The defendant knew or should have known that this was a private matter and it was a secret to be kept from other family members. In her evidence and counsel submissions, the defendant acknowledges the private nature of the stay when she submits that she did everything she could to protect the plaintiff’s privacy during her shift. She claims to have sought advice, stopped reading the file, remained out of sight and gave away her other shifts, all out of respect for the plaintiff’s privacy. These actions show that prior to disclosure she knew the stay was a private matter to be held in confidence.

30. Finally, the confidentiality agreement signed by the defendant included a broad undertaking to keep confidential “any information regarding any consumer” – this promise extends beyond just personal health information. It clearly prohibits the health care worker from discussing resident’s information at all. The privacy policy requires a staff member to obtain the consumer’s express consent before giving personal health information or personal information to a “family member who is not a substitute decision maker.” The word “Express” is in bold font. In sum, I find that the information disclosed was personal health information, was a private matter concerning the private life of the plaintiff, and was information that the defendant was required to keep confidential under her confidentiality agreement and the privacy policy. Disclosure fell below the privacy standard established by the legislation and the crisis facility and forms the basis for tort liability.

The Court took judicial notice that mental health issues are particularly stigmatized and concluded that the disclosure of this information is highly offensive to a reasonable person: "I have no trouble finding that a reasonable person would find disclosure of their need for crisis mental health treatment to be highly offensive."

The Court also found malice:

39. I have already found that the disclosures were made intentionally and not for advice, support or concern. The defendant denies that they were done with malice but on the facts I am prepared to infer that the disclosures were done with malice, particularly that to the brother. They were intended to diminish the plaintiff in the eyes of her family and cause her embarrassment. I emphasize the brother because I suspect the defendant’s daughter and husband had already had their opinion of the plaintiff shaped by the defendant. However, the brother appeared to be trying to walk a middle ground between the two feuding sisters. The defendant seemed engaged in some kind of competition for her brother’s attention as evidenced when she races to be the first to invite him to Christmas dinner, calling the plaintiff “crazy” as she did so. This subsequent conduct along with her failure to apologize, confirms malice.

On the topic of damages, the Defendant argued that it was a case for nominal damages of around $300. The Court strongly disagreed:

42. I disagree. Actual emotional harm was suffered by the plaintiff. The doctor’s opinion confirms the worsening of her mental health condition following the public disclosure. In submissions during closing, the defendant asks me to disregard the general practitioner’s opinion but did not summons or cross examine the doctor’s opinion nor supply contrary medical expert evidence. Therefore, I accept the opinion of the plaintiff’s doctor as to the plaintiff’s worsened anxiety and depression. It is the only medical expert evidence submitted at trial and was not contradicted.

43. As to the claim that the plaintiff’s reaction is extreme and unusual, again I disagree. It is completely reasonable and foreseeable that the mental health of a patient already suffering from anxiety will deteriorate when someone releases mental health information about them. Unlike Mustapha the withdrawal of the plaintiff is not an extreme, unpredictable or unusual reaction – it is completely reasonable and foreseeable. This is an obvious situation of “take your victim as you find them” – mental fragility was not an unknown or hidden condition which the defendant could not have foreseen. The defendant knew the mental health status of the plaintiff before she committed the wrongful act and therefore she must take her victim as she found her and (I would add) as she knew her to be.

44. Finally, the defendant argues that the failure to subsequently seek treatment at other facilities is a failure to mitigate which goes to reduce her damage award. The failure to seek in-patient treatment is completely predictable in the circumstances and is a by-product of the defendant’s humiliation and embarrassment of the plaintiff. The defendant’s actions have made it more difficult for the plaintiff to seek treatment as she no longer trusts institutional care. She is still privately seeing her family doctor for out-patient care as the doctor’s opinion verifies. Failure to seek in-patient treatment is a symptom evidencing the worsening of the plaintiff’s condition. Prior to the disclosure the plaintiff was willing to seek in-patient treatment, after she was not. In sum the severity of her anxiety and depression is worsened, she rarely leaves her darkened apartment and her quality of life is severely reduced.

45. This is not a case for nominal damages. It properly falls within the range set for non-pecuniary damages in Jones. The summary of past damage awards contained in Appendix A & B of Jones offers a context for setting damages in this case. The documented psychological harm suffered takes the damages well beyond nominal amounts for embarrassment and humiliation while the limited number of people told and the temporary manner of communication (telephone rather than internet) go to contain the award. I award $7,500 for general damages.

The Court then awarded an additional $1500 in punitive damages.