Wednesday, October 07, 2020

Presentation: Little Brother - Surveillance Technology and Privacy Law

I had the pleasure of speaking at the University of New Brunswick Law School's weekly speaker hour, on the topic of non-police use of surveillance technology and how that intersects/collides with Canadian privacy laws. Here are the slides in case it's of wider interest ...

Friday, April 10, 2020

Privacy best practices in a pandemic public health emergency

Since the early days of the COVID-19 pandemic, privacy questions have been in the headlines. International media reported stories from Asia about smartphones being used to enforce quarantine orders. In Ontario, Premier Ford suggested using telecom data to track social isolation compliance and more recently the Quebec police announced that it had arrested a woman in violation of a quarantine order by tracking her down via her cellphone.

Companies are wondering what information they can require from employees about their health, diagnosis or risk factors, and what information they can provide to public health authorities if asked. Companies also have similar questions about customer information.

What privacy laws apply?

Since Canada has a patchwork of privacy laws, the first question is always whether a privacy law applies at all and if so, which one. In Atlantic Canada, public sector employers and “federal works, undertakings and businesses” are subject to privacy regulation for employee information, but the private sector is only covered for customer information. The majority of private-sector employers in Canada (other than in British Columbia, Alberta and Quebec) fall in the gap without privacy regulation for the workplace. Even if no law applies, this does not mean that privacy should be thrown out the window.

Companies should be guided by privacy best practices described below, all of which are embodied in privacy statutes across Canada. These best practices align closely with what employees have come to expect regarding handling of their personal information. Organizations that adopt these principles generally avoid negative reaction from employees that their personal information has been misused. Transparency also encourages honest reporting, as individuals are usually more comfortable with disclosing personal information to an organization that is forthright about how they propose to use the information.

Organizations should be concerned about the relatively new common law causes of action for “intrusion upon seclusion” and “public disclosure of private facts”. Given that health information is particularly sensitive and the irrational stigma that seems to attach to COVID-19 disease, one might allege that disclosing infection risk or status to others may meet the “highly offensive to a reasonable person” threshold for the torts. Applying best practices would minimise the risk of liability.

Balancing privacy with public and occupational health

For employers, what should emerge is a careful balance between privacy principles and legitimate occupational health and safety concerns. The occupational health and safety imperative is a legal one, on both the employer and the employees, as the Occupational Health and Safety Act of Nova Scotia places obligations on both sides to ensure a safe workplace. Given the mode of transmission of the novel coronavirus, employers have a responsibility to keep employees who are at risk of spreading infection out of their workplaces. Some companies have decided to take the temperature of everyone entering the premises and excluding anyone with a fever. Others have adopted questionnaires or mandatory reporting of risk factors. Each of these scenarios involves the collection of personal information, so tread carefully.

What practices to adopt should be informed by the following privacy best practices:

(i) the collection of personal information must be justified, reasonable and non-discriminatory;

(ii) individuals should be given notice of the purposes for the collection, use and disclosure through policy or other direct communications such as signage;

(iii) personal information collected should be restricted to the minimum that is reasonable in the circumstances;

(iv) personal information should only be used for those purposes and should not be disclosed further than necessary; and

(v) the personal information should be accurate, as it will be used to make a decision of whether the employee, contractor or visitor will be permitted to work in the workplace.

What is justifiable and reasonable should be informed by the latest information from public health.

Disclosing personal information to public health authorities

Until recently, public health officials have largely been out of the spotlight, but they have been discreetly and diligently working to contain public health hazards, such as sexually transmitted infections. They are often been given special powers to do so, which includes the ability to require personal information from others. For example, in Nova Scotia, section 15 of the Health Protection Act gives the Chief Medical Officer of Health or his delegate broad powers to order information from third parties. Every privacy law in Canada permits disclosures where required by law and many also permit disclosures where it’s reasonably necessary related to the health and safety of the individual. Obviously, check your local statutes.

That said, we have to be very, very careful about attempts to get data in bulk, such as location data from telcos.

While health and safety are of course top of mind in this pandemic, privacy considerations should also be taken into account.

[Note: This post is based on an upcoming article for the Canadian Bar Association - Nova Scotia's Nova Voce magazine.]

Monday, February 17, 2020

Ontario court adopts the "false light publicity" privacy tort

Regular readers of this (irregular) blog will recall the milestone case of Jones v Tsige, in which the Ontario Court of Appeal imported into Canada the US privacy torts. That list includes:

1. Intrusion upon the plaintiff's seclusion or solitude, or into his private affairs.
2. Public disclosure of embarrassing private facts about the plaintiff.
3. Publicity which places the plaintiff in a false light in the public eye.
4. Appropriation, for the defendant's advantage, of the plaintiff's name or likeness.

The fourth cause of action, commercial appropriation of the plaintiff's image, was already alive and well in Canadian tort law. The Court in Jones applied the "intrusion upon seclusion" tort and subsequent cases have applied "public disclosure of private facts" (See Ontario court explicitly adopts new privacy tort: public disclosure of private facts.)

In December 2019, the Ontario Superior Court of Justice explicitly recognized the "false light" privacy tort. In Yenovkian v. Gulian, 2019 ONSC 7279, Justice Kristjanson was dealing with an unpleasant family law case in which the husband had made wild accusations against his former spouse, particularly related to their two children. The judge noted, with respect to the list of privacy torts:

[170] With these three torts all recognized in Ontario law, the remaining item in the “four-tort catalogue” of causes of action for invasion of privacy is the third, that is, publicity placing the plaintiff in a false light. I hold that this is the case in which this cause of action should be recognized. It is described in § 652E of the Restatement as follows:
Publicity Placing Person in False Light

One who gives publicity to a matter concerning another that places the other before the public in a false light is subject to liability to the other for invasion of his privacy, if

(a) the false light in which the other was placed would be highly offensive to a reasonable person, and

(b) the actor had knowledge of or acted in reckless disregard as to the falsity of the publicized matter and the false light in which the other would be placed.

[171] I adopt this statement of the elements of the tort. I also note the clarification in the Restatement’s commentary on this passage to the effect that, while the publicity giving rise to this cause of action will often be defamatory, defamation is not required. It is enough for the plaintiff to show that a reasonable person would find it highly offensive to be publicly misrepresented as they have been. The wrong is in publicly representing someone, not as worse than they are, but as other than they are. The value at stake is respect for a person’s privacy right to control the way they present themselves to the world.

While I don't propose to list all the misconduct the husband was found to have carried out, this summary at the beginning of the decision is helpful for context:

[2] It is also about a father, Mr. Vem Yenovkian, who has engaged in years of cyberbullying of the mother, Ms. Sonia Gulian on websites, YouTube videos, online petitions and emails. It is about a father who videotapes court-ordered access visits with the children—both in-person and on Skype—and edits and posts those access visits and photographs of the children on the internet, with commentary. It is about a father who publicly posts on YouTube a video of his son cowering under a table while the father harangues him over Skype on a court-ordered access visit. It is about a father who posts videos of him describing his daughter, who suffers from a neurological disorder, as looking drugged, when she used to be “normal,” and posting that his daughter has a “broken” mind.

[3] Despite court orders prohibiting posting, the father continues his cyberbullying campaign abusing Ms. Gulian and her parents. He seeks to undermine the administration of justice through an online campaign to “unseat” a judge of this Honourable Court for rulings made, internet attacks on trial witnesses and the wife’s lawyer, and by flouting court orders and family law disclosure obligations.

The Court in this case did not follow the $20,000 "cap" on non-pecuniary damages set out in Jones v Tsige, but rather followed the divergent train of thought started with the Doe case:

[186] There is no claim for pecuniary damages; the only issue is non-pecuniary damages. The infliction of mental suffering and invasion of privacy are based on many of the same facts.

[187] On damages for intrusion on seclusion, the Court of Appeal in Jones v. Tsige held at paragraphs 87-88 that damages for intrusion upon seclusion in cases where the plaintiff has suffered no pecuniary loss should be modest, in a range up to $20,000. The important distinction with the two invasion of privacy torts in issue here, however, is that intrusion on seclusion does not involve publicity to the outside world: they are damages meant to represent an invasion of the plaintiff’s privacy by the defendant, not the separate and significant harm occasioned by publicity.

[188] The two Jane Doe cases have recognized that the cap on damages for intrusion upon seclusion may not apply to the other forms of invasion of privacy: Jane Doe 2016 at para. 58; Jane Doe 2018 at paras. 127-132. In this case, as is in those, the “modest conventional sum” that might vindicate the “intangible” interest at stake in Jones v. Tsige, para. 71, would not do justice to the harm the plaintiff has suffered.

[189] In Jane Doe 2016, at para. 52, Stinson J. turned to sexual battery cases for guidance in arriving at an award, and Gomery J. in Jane Doe 2018, at paras. 127-128 followed the same approach. In support of this approach, Stinson, J. pointed to the similarly of the psychological and emotional harm the plaintiff had suffered to that experienced by victims of sexual assault.

[190] I likewise adopt the method of looking to the factors applied to decide damage awards for a tort causing harms analogous to those the present plaintiff has suffered for invasion of privacy. The harm arising from the invasion of privacy in the present case is akin to defamation. Accordingly, in arriving at an award of non-pecuniary damages, I am guided by the factors described by Cory J. in Hill v Church of Scientology, at para. 187, which I am adapting to the tort of publicity placing a person a false light:

a) the nature of the false publicity and the circumstances in which it was made,
b) the nature and position of the victim of the false publicity,
c) the possible effects of the false publicity statement upon the life of the plaintiff, and
d) the actions and motivations of the defendant.

[191] In this case, the false publicity is egregious, involving alleged criminal acts including by Ms. Gulian against her children. The false publicity is widely disseminated on the internet, as well as through targeted dissemination to church friends and business associates. Ms. Gulian has suffered damage as a mother, as an employee, in the Armenian community, and in her church community. She is peculiarly vulnerable as the spouse of the disseminator of false publicity. The false publicity has had a detrimental effect on Ms. Gulian’s health and welfare, humiliation, caused her fear, and could be expected as well to affect her social standing and position. Mr. Yenovkian has not apologized, nor has he retracted the outrageous comments despite court orders.

[192] The damages for intentional infliction of mental suffering are intended to be compensatory. I award $50,000 compensatory damages for intentional infliction of mental suffering, relying on Boucher v. Wal-Mart Canada Corp., 2014 ONCA 419.