Privacy breach class action certified against Government of Canada for medical marijuana breach

In a decision issued on July 27, 2015 but not yet published (but available here as a PDF), the Federal Court of Canada has certified a class action against the Government of Canada for disclosing the personal health information of participants in the "Marihuana Medical Access Program" in a botched mailout that was intended to advise program participants about changes to the regulation, which ironically where said to protect privacy and safety.

In November 2013, Health Canada sent notices to over 40,000 participants of the Marihuana Medical Access Program (MMAP) to advise of changes to regulations governing the use of medical marijuana in Canada. The notices were delivered in oversized envelopes that had the words “Health Canada - Marihuana Medical Access Program” on the return address, revealing to anyone who saw the envelope that the recipient was licensed to possess or produce medical marihuana for medical purposes. Previously, Health Canada’s mailings to MMAP members were discreet and made no mention of marijuana on the envelopes. Despite the Government of Canada’s acknowledgement of the error and that it was outside their normal practice, its reaction has consistently been "no harm, no foul".

What's most notable about this decision -- which is consistent with the recent decision in Condon v. Canada -- is that the court certified the plaintiffs' claim under the novel tort of "public disclosure of private facts". This tort is recognized in the United States, but is untested in Canada. It is a part of the four different privacy torts recognized by the Ontario Court of Appeal in Jones v. Tsige.

In March 2015, the Privacy Commissioner of Canada found that Health Canada's breach was a violation of the Privacy Act. At the certification hearing, the Government of Canada argued that the Privacy Commissioner's finding should be enough to satisfy everyone harmed by the breach, but the Court noted that the Commissioner can't award any of the damages sought by the plaintiffs.

Full disclosure: My firm is one of the firms representing the plaintiffs.

From the firms' media release:

Federal Court certifies privacy class action by Medical Marijuana patients against Health Canada

FOR IMMEDIATE RELEASE - July 28, 2015

The Federal Court of Canada has certified a class action commenced on behalf of more than 40,000 medical marijuana licensees alleging that Health Canada violated their privacy.

In November 2013, Health Canada sent notices to over 40,000 participants of the Marihuana Medical Access Program (MMAP) to advise of changes to regulations governing the use of medical marijuana in Canada. The notices were delivered in oversized envelopes that had the words “Health Canada - Marihuana Medical Access Program” on the return address, revealing to anyone who saw the envelope that the recipient was licensed to possess or produce medical marihuana for medical purposes. Previously, Health Canada’s mailings to MMAP members were discreet and made no mention of marijuana on the envelopes. Despite the Government of Canada’s acknowledgement of the error, it insists that no one was harmed by the breach.

In March 2015, the Office of the Privacy Commissioner of Canada concluded that Health Canada violated federal privacy laws. However, in the recent certification decision, the Court found that the class action is necessary to provide access to justice because the Privacy Commissioner cannot order the Government of Canada to compensate class members harmed by the breach. The Government has 30 days to appeal the certification decision.

McInnes Cooper, Branch MacMaster LLP, Charney Lawyers, and Sutts Strosberg LLP are jointly representing the plaintiffs in the medical marijuana privacy breach class action filed in the Federal Court against the Government of Canada. The plaintiffs seek damages for breach of contract, breach of confidence, invasion of privacy and Charter violations.

“We are very glad to see this case moving forward. The certification decision means that the Court has agreed that this is an appropriate case for a class action and that allowing all of the class members to proceed in a group is in the interests of justice,” said Ward Branch of Branch MacMaster LLP. “The Government of Canada has fought us at every turn, but have also lost each motion to date. We are hopeful that they will now see the wisdom of sitting down to resolve the issues created by this error.”

“This is not over yet, but the thousands of affected program members should take some comfort that every legal claim we advanced on their behalf has been approved to go forward,” said David Fraser of McInnes Cooper.

“As citizens of this great country, we rely on our government to protect our sensitive personal information from being disclosed and to protect our privacy during all communications. This decision sends a clear message to the government that our Courts consider privacy to be of the utmost importance and expect our government to take its privacy obligations seriously or face the consequences,” said Ted Charney of Charney Lawyers.

“Over one thousand people have registered on our secure website to tell us how the breach affected them. We will continue to pursue justice for those harmed by the breach,” said David Robins of Sutts, Strosberg LLP.

While it is not necessary to “opt in” to participate in the class action, class members are urged to visit the www.marijuanaclassaction.com website to obtain updates and to register because the information collected on the secured site will assist class counsel in communicating with class members and moving the case forward. Those who have already registered do not need to re-register but should update their information if their circumstances change or to report further harm suffered from the breach.

- 30 -

About Branch MacMaster LLP

Branch MacMaster LLP is a boutique litigation law firm established in 1998 and located in Vancouver, British Columbia. The firm focuses on class actions, health, insurance, and personal injury. The firm provides responsive, flexible, and cost-effective service to their clientele.

About Charney Lawyers

Charney Lawyers is a Toronto, Ontario firm with an established reputation for excellence in advocacy. The firm is experienced in personal injury, class proceedings, commercial litigation, insurance defence, employment law, medical malpractice, food borne illness, construction law and appeals.

About McInnes Cooper

McInnes Cooper is among the top business and litigation law firms in Canada, with more than 200 lawyers in seven Canadian offices, serving clients across North America and abroad. The firm is a market leader in energy and natural resources, business, litigation, employment, tax, real estate and insurance law. McInnes Cooper is the exclusive member firm in Newfoundland, New Brunswick, Nova Scotia and Prince Edward Island for Lex Mundi – the world’s leading network of independent law firms with in-depth experience in 100+ countries worldwide.

About Sutts Strosberg LLP

Sutts, Strosberg LLP is a nationally recognized law firm committed to excellence in litigation, with offices in Windsor and Toronto. The firm has a special interest in class actions, having represented groups or classes of individuals in every province and territory, and in every level of court, and is experienced in complex civil and commercial disputes, corporate, commercial and financial transactions, medical malpractice cases, personal injury cases, family law and criminal law.

For more information or to request an interview, please contact:

Ashley LeCroy
Manager, Marketing & Communications
902.457.5667
media@mcinnescooper.com

For more background, check out these previous posts.

Privacy Commissioner: Health Canada violated privacy laws by disclosing personal health information of over 40,000 Canadians

A press release issued today by my firm and the other firms listed below, who are representing more than 40,000 Canadians affected by a Health Canada privacy breach:

The Office of the Privacy Commissioner of Canada has completed its investigation of Health Canada's privacy breach affecting over 40,000 licensees of the Marihuana Medical Access Program (MMAP), concluding that Health Canada violated federal privacy laws.

In November 2013, Health Canada sent written notices to over 40,000 individuals, outlining changes to the MMAP. The envelopes used for the mail-out clearly included the words "Health Canada - Marihuana Medical Access Program" on the return address, indicating to anyone who saw the envelopes that the recipient was either licensed to possess medical marihuana or to grow it for medical purposes. The envelopes were oversized so more likely to come to people's attention. Previously, Health Canada had been discreet in its communications with program members.

Three hundred and thirty nine affected individuals complained to the Office of the Privacy Commissioner, who initiated an investigation. The complainants cited several concerns relating to the impact of Health Canada's actions on their personal lives including concerns about losing their jobs, reputational damage and personal safety.

In a finding dated March 3, 2015, the Commissioner determined that Health Canada had violated the federal Privacy Act, which is designed to protect the privacy of Canadians when the federal government handles their sensitive information. The Commissioner's Finding was only sent to the 339 individuals who filed complaints with the Privacy Commissioner, but a copy of the document can be found here. Affected individuals who were not among the original complainants do not have to file additional complaints to the Commissioner, as the investigation is concluded.

The finding rejects the justifications put forward by Health Canada, which include blaming the patients for having gone to the media about the breach, which brought attention to the matter. The government also suggested that including the full name of the program instead of an abbreviation that would protect privacy was one of the "reasonable options" available to it under the law.

McInnes Cooper, Branch MacMaster LLP, Charney Lawyers, and Sutts Strosberg LLP are jointly representing affected users in an intended class action lawsuit against Health Canada filed in the Federal Court.

"It was clear to me, as soon as my phone started ringing in November 2013, that there was no justification for the careless error made by Health Canada in this case," said privacy lawyer David Fraser of McInnes Cooper. "It's one thing to acknowledge making a mistake, which Health Canada did, but immediately turning around to blame the victims is repulsive."

"We are pleased that the Privacy Commissioner of Canada agrees that Health Canada violated the law in its mishandling of patients' personal information," said David Robins of Sutts Strosberg LLP.

"Hundreds of people have reached out to us through our secure website for the class action to tell us how the breach has affected them, from lost jobs, effects on family relationships and social stigma. Each person who was a part of the MMAP was promised by Health Canada that their confidentiality would be protected," said Ted Charney of Charney Lawyers, adding that "the Commissioner is not able to award compensation to the victims or penalize Health Canada for its unlawful conduct, so the class action lawsuit is important in pursuing justice."

"We expect that the court hearing to ask that the case be blessed as a certified class action will take place in the early summer. If the judge agrees, we can move forward with the merits of the case," said Ward Branch of Branch MacMaster. "The privacy commissioner's report serves as a helpful roadmap for the case."

Affected class individuals are encouraged to register at www.marijuanaclassaction.com. While class members are not required to "opt in" to participate in the intended class action lawsuit, providing contact information and advising class counsel about how this privacy breach has affected you individually will help class counsel in bringing the case forward. Those who have already registered on the secure website do not need to re-register, but may want to update their information if their circumstances have changed or if they have experienced additional harms as a result of the breach.

About Branch MacMaster LLP

Branch MacMaster LLP is a boutique litigation law firm established in 1998 and located in Vancouver, British Columbia. The firm focuses on class actions, health, insurance, and personal injury. The firm provides responsive, flexible, and cost-effective service to their clientele.

About Charney Lawyers

Charney Lawyers is a Toronto, Ontario firm with an established reputation for excellence in advocacy. The firm is experienced in personal injury, class proceedings, commercial litigation, insurance defence, employment law, medical malpractice, food borne illness, construction law and appeals.

About McInnes Cooper

McInnes Cooper is among the top business and litigation law firms in Canada, with more than 200 lawyers in seven Canadian offices, serving clients across North America and abroad. The firm is a market leader in energy and natural resources, business, litigation, employment, tax, real estate and insurance law. McInnes Cooper is the exclusive member firm in Newfoundland, New Brunswick, Nova Scotia and Prince Edward Island for Lex Mundi – the world's leading network of independent law firms with in-depth experience in 100+ countries worldwide.

About Sutts Strosberg LLP

Sutts, Strosberg LLP is a nationally recognized law firm committed to excellence in litigation, with offices in Windsor and Toronto. The firm has a special interest in class actions, having represented groups or classes of individuals in every province and territory, and in every level of court, and is experienced in complex civil and commercial disputes, corporate, commercial and financial transactions, medical malpractice cases, personal injury cases, family law and criminal law.

Court agrees to protect plaintiffs' identities in invasion of privacy case against Health Canada

In a decision issued yesterday, the Federal Court ordered the the identity of plaintiffs in a putative class action against Health Canada should be protected to allow them to pursue their claim against the Government for the breach of privacy of members of the Medical Marihuana Access Program.

As blogged about last year, my firm filed a proposed class action lawsuit against Health Canada after it sent a mailing to approximately 40,000 people who are authorized to possess or grow marijuana under the program administered by Health Canada. (More info is here.)

Shortly after the breach occurred, lawsuits were filed in the federal courts by my firm, McInnes Cooper of Nova Scotia, and Branch McMaster of British Columbia. Sutts Strosberg of Ontario filed a lawsuit in the Ontario Superior Court. Each of these cases has a separate named plaintiff and all three of them were filed with the intent that they would be certified as class actions on behalf of all similarly affected participants in the MMAP.

The suit commenced by McInnes Cooper was filed on behalf of “John Doe”, a resident of Nova Scotia. The suit commenced by Sutts Strosberg was filed on behalf of “Suzie Jones”, a resident of Ontario. The case commenced by Branch McMaster was filed on behalf of an individual who chose to identify himself. The “John Doe” and “Suzie Jones” cases have been consolidated into one case in the Federal Court of Canada.

“John Doe” and “Suzie Jones” are pseudonyms for the proposed representative plaintiffs, so that the identities of those individuals would not become known. On February 20, 2014, a motion was heard in the Federal Court of Canada for an order of the court protecting the identities of “John Doe” and “Suzie Jones”. In most cases, parties to a legal action are required to name themselves and this information appears on the public record. Because the case against Health Canada is based on the disclosure of program members’ identities in association with the MMAP, requiring participants in these lawsuits to name themselves would further harm their privacy.

On February 25, 2013 we received the decision of the Court. The Court agreed that to deny the plaintiffs anonymity in the court proceeding would disclose the very information they seek to protect and exacerbate the damage and/or risk of harm that has already been caused by Health Canada’s mailing that identified them as a participant in the Program.

Government lawyers, on behalf of Health Canada, argued that this was a matter related solely to marihuana use and that the plaintiffs’ privacy should not be protected. Relying on newspaper articles and internet research, they argued that public opinion about marihuana use has changed to be more accepting. The Court rejected this evidence as irrelevant, explaining:

“What the Plaintiffs’ marijuana use discloses is their medical and health information. The Plaintiffs are patients, no simply “users”. Disclosing their identities discloses that a course of treatment has been prescribed by them by a medical doctor, and that they suffer from serious health conditions and symptoms. Identifying the Plaintiffs by name or information that discloses their personal identity also discloses that they have or are likely to have medical marihuana in their homes – something that Health Canada itself saw as a serious safety and security risk.

Accordingly, I am satisfied that in the within case of John Doe and Suzy Jones, without the protection they seek on this motion, the important issues they raise in their Amended Statement of Claim may not be determined in this forum, and that the issues they raise regarding patient rights, privacy and whether Health Canada owes a duty of care and has breached that duty and is liable are issues that are in the public interest to be determined. The Plaintiffs have requested only that their personal identity be protected and with minimum intrusion on the open court process.”

It's particularly gratifying that the Court acknowledged that this isn't just a matter of protecting the privacy of marihuana users, but more centrally concerns sensitive health information that was disclosed.

(Members of the proposed class can register and get more information at http://www.marijuanaclassaction.com).

Class Action filed against Health Canada in Medical Marijuana privacy breach

This afternoon, my firm filed a statement of claim in the Federal Court against Health Canada (John Doe v. Her Majesty) in connection with the massive privacy breach associated with the government’s medical marijuana program. As we understand it, Health Canada irresponsibly deviated from their usual practice of plain brown envelopes, couriers and registered mail by sending a mailing to around 40,000 individuals associated with the program clearly announcing the “Medical Marihuana Program” on the return address.

Between Friday and today, I have had many calls from individuals whose privacy was compromised by this breach, most of them fearing for their jobs and all of them concerned about their own safety. If it gets out in your community that you lawfully possess cannabis, this makes you a target for break and enters. The risk is even more heightened if you are a licensed grower of the plant. While this is a lawful program, the use of medical marijuana is heavily stigmatized.

This is not like most large-scale privacy breaches where the harm is mostly theoretical, since the missing hard-drive or thumb-drive likely didn’t leave the building. In this case, sensitive personal information was exposed to people who had no right to see it. I am told that some people have already lost their jobs because of this. For the rest, it is hard to put a price on legitimate concern about your family’s safety. I lived for a number of years in a community of 400 people, where the Canada Post employees were also neighbours.

Health Canada has dismissed this as a simple administrative error that they’ll endeavour to not repeat. But that’s not good enough from our government. People get to choose the businesses they deal with. If you don’t like how your bank or other service provider handles your personal information, you can change banks or businesses. But that’s not the case with your government. It’s a non-consensual relationship and the government owes a special duty of care to its citizens to protect them and to protect their sensitive personal information. Participants in this program were obtaining a restricted drug for medical purposes and could not do so lawfully except through the government program. Citizens should not have to choose between doing it lawfully or doing it safely. And we are talking about sensitive personal health information, which is generally recognized in Canada as the most sensitive personal information.

If you, or anyone you know, has been affected by this breach, please go to http://www.healthprivacyclassaction.com to provide your contact information so we can keep you apprised of this case as it progresses. Please provide an e-mail address that is confidential only to you. If this breach has had a particular impact on you, there is a portion of the form to provide details about this. Any information you provide will be kept confidential.

Here is the media release:

McInnes Cooper law firm files national class action in medical marijuana privacy breach

HALIFAX, Nov. 25, 2013 /CNW/ - McInnes Cooper law firm today filed a proposed class action in Federal Court against the Government of Canada in response to Health Canada's breach of the privacy rights of 40,000 patients in the Marijuana Medical Access Program. Under the Marijuana Medical Access Program, patients are permitted to grow marijuana in their residence for medicinal purposes.  

Earlier this month, Health Canada sent these patients a letter via Canada Post that clearly indicated on the envelope that the named patient participated in the Marijuana Medical Access Program.

Health Canada's disclosure of the patients' private medical information has raised serious employment and security concerns, and caused the patients to suffer considerable stress and anxiety.

"As a result of Health Canada's error, we have already spoken with a number of people whose lives have been affected by this breach," said David Fraser, a national expert on privacy law, and McInnes Cooper's lead lawyer on this case.

"We have heard that some individuals have already lost their jobs as a result, and everyone we've spoken with is concerned about their safety in their homes."

SOURCE: McInnes Cooper

The statement of claim is here:

FEDERAL COURT

 

PROPOSED CLASS ACTION

 

 

BETWEEN:

 

JOHN DOE

 

                                                                                                                            PLAINTIFF

 

- and -

                                                                                                                                                                

                                                                                                                                                                 

HER MAJESTY THE QUEEN

 

                                                                DEFENDANT

 

 

STATEMENT OF CLAIM

 

 

TO THE DEFENDANT:

 

A LEGAL PROCEEDING HAS BEEN COMMENCED AGAINST YOU by the Plaintiff.  The claim made against you is set out in the following pages.

 

                IF YOU WISH TO DEFEND THIS PROCEEDING, you or a solicitor acting for you are required to prepare a statement of defence in Form 171B prescribed by the Federal Courts Rules, serve it on the Plaintiff’s solicitor or, where the Plaintiff does not have a solicitor, serve it on the Plaintiff, and file it, with proof of service, at a local office of this Court, WITHIN 30 DAYS after this Statement of Claim is served on you, if you are served within Canada.

 

                If you are served in the United States of America, the period for serving and filing your Statement of Defence is forty days.  If you are served outside Canada and the United States of America, the period for serving and filing your Statement of Defence is sixty days.

 

                Copies of the Federal Courts Rules, information concerning the local offices of the Court and other necessary information may be obtained on request to the Administrator of this Court at Ottawa (telephone: 613-992-4238) or at any local office.

 

                IF YOU FAIL TO DEFEND THIS PROCEEDING, judgment may be given against you in your absence and without further notice to you.

 

 

Date:  _____________________________________

 

Issued by:  _________________________________

[Registry Officer]

 

Address of local office:  1801 Hollis Street,

                                            17th Floor, Suite 1720

                                            Halifax, N.S.  B3J 1S7

                             

 

To:                   The Attorney General of Canada

Attention:     Mr. Willian F. Pentney, Deputy Attorney General of Canada

 

 

 

Claim

 

1.    The Plaintiff claims on his own behalf and on behalf of the proposed Class:

 

a.    An Order pursuant to Rules 334.16(1) and 334.17 of the Federal Courts Rules certifying this action as a class proceeding;

 

b.    An Order pursuant to Rules 334.12(3), 334.16(1)(e) and 334.17(b) appointing the Plaintiff as the representative plaintiff for the Class;

 

c.    Damages for the torts of intrusion upon seclusion, publicity given to private life, breach of confidence and negligence;

 

d.    An Order pursuant to Rule 334.28(1) and (2) for the aggregate assessment of monetary relief and its distribution to the Plaintiff and the Class;

 

e.    Prejudgment interest pursuant to section 36 of the Federal Courts Act;

 

f.     Costs, if appropriate; and

 

g.    Such further and other relief as this Honourable Court deems just.

 

Parties

 

2.    The Plaintiff is an individual who resides in Nova Scotia. He is employed in the health care field.

 

3.    The Plaintiff brings this action on his own behalf and on behalf of the members of the proposed class, which is defined as follows:

 

All persons who were sent a letter from Health Canada in November 2013 that had the phrase Marihuana Medical Access Program or a similar French phrase visible on the front of the envelope.

 

4.    The Defendant, Her Majesty the Queen, is named as a representative of the Federal Government of Canada and Health Canada. Health Canada administers the Marihuana Medical Access Program under the Marihuana Medical Access Regulations.

 

Medical Marihuana Access Program

 

5.    Through the Marihuana Medical Access Program, the Defendant grants access to marihuana for medical use to Canadians suffering from grave and debilitating illnesses.

 

6.    Marihuana (cannabis) is categorized as a controlled substance, regulated in Canada under the Controlled Drugs and Substances Act. It is not legal to grow or possess marihuana except with legal permission by the Defendant under the Marihuana Medical Access Program.

 

7.    The Plaintiff applied to participate in the Defendant’s Marihuana Medical Access Program to grow and possess marihuana to alleviate the pain that he suffers due to a medical condition. The Defendant approved the Plaintiff’s application.

 

Disclosure of the Plaintiff’s Private Information

 

8.    The Defendant typically corresponds to the Plaintiff by courier service with plain unmarked brown envelopes.

 

9.    During the week of November 21, 2013, the Defendant sent the Plaintiff a letter plainly and clearly indicating on the envelope that it was from Health Canada and that it was in regards to the Marihuana Medical Access Program.

 

10.  By publically indicating that the Plaintiff was a participant in the Marihuana Medical Access Program, the Defendant disclosed the personal health information about the Plaintiff. Furthermore, the Defendant’s disclosure creates a security concern by alerting other individuals that the Plaintiff may possess and/or grow marihuana at his residence.

 

Negligence

 

11.  At all material times, the Defendant owed a duty of care to the Plaintiff and the proposed Class.

 

12.  Furthermore, the Defendant had a statutory duty under subsection 8(1) of the Privacy Act to not disclose personal information without that individual’s consent. The Plaintiff’s and the Class’ participation in the Marihuana Medical Access Program constitutes personal information as it is confidential information and relates to their medical history.

 

13.  The Defendant breached its duty of care owed to the Plaintiff and the Class by:

 

a.    Failing to meet its statutory duties and/or policies in the collection, retention and disclosure of personal information;

 

b.    Failing to take reasonable steps to ensure the personal information was not disclosed;

 

c.    Failing to communicate with the Plaintiff and the Class in a manner that did not disclose their personal information; and

 

d.    Other such particulars as counsel may advise.

 

Publicity Given to Private Life

 

14.  Through its actions stated above, the Defendant gave publicity to the Plaintiff’s private, personal information, particularly his medical condition.

 

15.  The Plaintiff’s private personal information is of no legitimate concern to the public. The Defendant’s disclosure of the Plaintiff’s private personal information is highly offensive to a reasonable person.

 

Breach of Confidence

 

16.  The Plaintiff states that the Defendant committed the tort of breach of confidence.

 

17.  In applying to participate in the Marihuana Medical Access Program, the Plaintiff conveyed confidential information in confidence to the Defendant.

 

18.  In its actions stated above, the Defendant misused the Plaintiff’s confidential information to the Plaintiff’ detriment.

 

Intrusion upon Seclusion

 

19.  The Defendant’s above stated actions constitute an intrusion on seclusion in a manner that would be highly offensive to a reasonable person.

 

Relief Sought

 

20.  The Defendant’s actions have caused the Plaintiff and the Class to suffer the following damages:

 

a.    Costs incurred in taking additional security precautions;

b.    Damage to reputation;

c.    Damage to employment;

d.    Mental distress;

e.    General damages; and

f.     Inconvenience, frustration and anxiety.

 

General

 

21.  The Plaintiff proposes that this trial take place in Halifax.

 

DATED at Halifax, in the Province of Nova Scotia, this 25th day of November 2013.

 

 

PLACE OF TRIAL:                    HALIFAX, NOVA SCOTIA

 

 

                                                                ____________________________________

                                                                            David T.S. Fraser

Solicitor for the Plaintiff