Important new Ontario court decision on privilege in incident response documentation

The Ontario divisional court has just released a decision, LifeLabs LP v. Information and Privacy Commr. (Ontario), 2024 ONSC 2194, that should grab the attention of Canadian lawyers who work in cyber incident response. I don’t know whether it will be appealed, but the logic of the decision is pretty sound. But I expect this isn’t over. 

In a nutshell, after a significant ransomware incident, LifeLabs was assisted by well-known cybersecurity and forensic consultants for the investigation, remediation and negotiation with the ransomware bad guys. As required by the relevant privacy laws of those provinces, they notified the privacy commissioners of British Columbia and Ontario, and the commissioners started a joint investigation. In connection with their investigation, the commissioners demanded to see the consultants’ reports and LifeLabs claimed they were privileged. 

Not surprisingly, the ransomware incident was followed by a number of class action lawsuits that were still pending at all material times. 

In June 2020, the Commissioners issued a joint decision finding that LifeLabs had provided insufficient evidence to back up the privilege claim. They were also ordered to hand over the consultants’ reports.  So LifeLabs sought judicial review of the order in the Ontario Divisional Court. The Court just released its decision, upholding the IPC’s order. I’m not sure why it took so long to get to a hearing.

According to the IPC’s decision, there were five categories of records at issue:

i.          The investigation report prepared by the cybersecurity firm hired by LifeLabs, which described how the cyberattack occurred.

ii.          The email correspondence between the cyber intelligence firm and the cyber-attackers after the discovery of the attack by LifeLabs.

iii.         An internal data analysis prepared by LifeLabs on April 28, 2020 to describe which individual health information had been affected by the breach and to notify those affected pursuant to ss. 12(1) and 12(2) of the PHIPA.

iv.        A submission from LifeLabs to the Commissioners dated May 15, 2020 in response to certain specific questions, communicated through legal counsel.

v.         The report of Kevvie Fowler, Deloitte LLP dated June 9, 2020 prepared as part of the representations by LifeLabs and submitted to the Commissioners for that purpose.

Other than the internal LifeLabs assessments, the records were created by consultants retained by LifeLabs’ lawyers. The cybersecurity firm was already engaged by LifeLabs to assess the company’s security, and it was actually them who discovered the incident. They were instructed to provide their reports on the incident to legal counsel.  

The court reviewed the IPC’s privilege decision on a standard of correctness and found that it was correct. 

Before getting into the decision, it should be noted that LifeLabs claimed “solicitor client privilege” and “litigation privilege”. They are related and similar, but not the same. 

Solicitor client privilege protects communications that are made in confidence between a lawyer and their client (or third party acting on behalf of their client). In order to be privileged, the communication must be made for the purpose of seeking or giving legal advice, and the parties must have intended the communication to be confidential. Just because there’s a lawyer in the mix doesn’t make it privileged, and a third party’s involvement, like a consultant retained by the client or the lawyer, doesn’t waive that privilege.

Litigation privilege is intended to create a “zone of privacy” within which counsel can prepare draft questions, arguments, strategies or legal theories, in anticipation of litigation and for the purpose of preparing for that litigation. Documents created by others, to assist counsel, in preparing for litigation can also fit into this category. Notably, the privilege only exists while the litigation is anticipated or ongoing.

If you read the IPC’s decision, you’ll see that not much information was provided by LifeLabs (or at least not to the IPC’s satisfaction) to demonstrate that the five categories of records fit into either solicitor client privilege or litigation privilege.  In large measure, the IPC decided that LifeLabs HAD to investigate the incident and HAD an obligation to provide factual information to the IPC. It doesn’t look like the IPC was looking for actual advice given by counsel or anything related to LifeLabs’ trial strategy for their ongoing litigation. 

Ultimately, the decision turned on LifeLabs not providing evidence to the IPC’s satisfaction to back up their privilege claims.

The main conclusions, simplified a bit, are that: 

1.         Facts are not privileged, even if they were collected or compiled by a lawyer.

2.         If you have a statutory obligation to investigate and provide information to the regulator, the facts that are discovered in that investigation are not privileged.

3.         Solicitor client privilege only protects communications that are made for the purpose of seeking or obtaining legal advice.

4.         Litigation privilege only protects communications and records that are created for the dominant purpose of preparing for litigation.

This is not earth shattering, but it’s a reminder of how the law of privilege works in Canada. 

The court emphasized that even if certain communications or documents are privileged, the facts referred to or reflected in those communications may not be privileged if they exist independently, outside of the privileged context. Facts that have an independent existence outside of solicitor-client privileged communications are not automatically privileged.

The court quoted and agreed with paragraph 49 of the IPC’s decision:

Even if the communication is privileged, the facts referred to or reflected to in those communications are not privileged if they exist outside the documents and are relevant and otherwise subject to disclosure. Some facts have a life outside the communication between lawyer and client but have also been communicated within the solicitor-client relationship. Facts that have an independent existence outside of solicitor-client privileged communications are not privileged. When deciding if such facts are privileged, one must keep one eye on the need to protect the freedom and trust between solicitor and client and another eye on the potential use of privilege to insulate otherwise discoverable evidence. While privilege is jealously guarded it must be interpreted to protect only what it is intended to protect and nothing more.

The court further clarified that simply depositing a document or providing counsel with a copy of a document does not automatically extend privilege to the original document. The protection of privilege is intended to safeguard the communication between lawyer and client and the adversarial preparation for litigation, not the underlying facts themselves.

Therefore, the court concluded that facts concerning the investigation or remediation, even if communicated within a privileged context, may not be privileged if they have an independent existence outside of privileged documents. 

If an organization has a legal obligation to investigate, remediate and report to the privacy commissioner, interjecting lawyers into the process does not relieve the organization of its obligation to report to the commissioner. This obligation includes cooperating with the commissioner's inquiries and providing information necessary for investigations.

The Court wrote:

[76]           Health information custodians, such as LifeLabs, cannot defeat these responsibilities by placing facts about privacy breaches inside privileged documents. Although the claims of privilege here were rejected, even if they had been accepted, this would not have defeated the ON IPC’s duty to inquire into the facts about the data breach within the control and knowledge of LifeLabs. This result flows not only from the ON IPC’s statutory mandate, but also from how litigation privilege and solicitor client privilege function.

…

[79]           Thus, the IPC’s statutory duty to inquire, and LifeLabs’ duty to respond, does not permit a claim of litigation privilege over facts obtained through its lawyers, even where those facts might also play a role in defending against parallel civil litigation. As Nordheimer, J. wrote in R. v. Assessment Direct, at para. 10, “the privilege does not protect information that would otherwise have to be disclosed”.  LifeLabs did not identify any litigation strategy that would be disclosed in the Investigation Report because of the Privilege Decision.

On this point, the Court agreed with the findings of the IPC:

[80]           Similarly, solicitor-client privilege does not extend to protect facts that are required to be produced pursuant to statutory duty. The ON IPC correctly articulated the law when it stated at para. 49:

… Facts that have an independent existence outside of solicitor-client privileged communications are not privileged. … While privilege is jealously guarded it must be interpreted to protect only what it is intended to protect and nothing more.”

Furthermore, the court emphasized that organizations cannot use claims of privilege to shield facts about privacy breaches from the commissioner. Even if privilege is claimed over certain documents or information, it does not absolve the organization from its duty to cooperate with the commissioner's investigation and provide relevant facts. The court noted that placing unpalatable facts within privileged documents to avoid investigative orders would undermine the purpose of regulatory oversight and accountability.

Just saying something is privileged does not make it privileged. Including a lawyer in a conversation does not make it privileged. Having the lawyer hire the consultant does not automatically make it privileged. 

The IPC and the Court noted that the cybersecurity consulting firm had a prior retainer with LifeLabs related to what it was doing before the incident, during the incident and afterwards. Simply having the report related to the incident addressed to counsel didn’t make that report privileged. The IPC referred to a US case called In re Capital One, which LifeLabs said was an error. The court disagreed with LifeLabs, and reached the same conclusion as the IPC: 

[90]           I disagree. The In re Capital One case affords persuasive authority to support a finding that where a company has a prior retainer with a cybersecurity firm to provide essentially the same services before and after a breach, inserting  counsel’s name into the contract and stating that the deliverables would be made to counsel on behalf of the client, does not render any report prepared subject to the U.S. work product doctrine, which is akin to Canada’s litigation privilege.

Interestingly, the IPC in their March 2020 decision on privilege left the door open for LifeLabs to prove that portions of the records may include information that is subject to solicitor client or litigation privilege. 

I would have liked to have seen a bit more analysis of what is reasonably contemplated litigation and dominant purpose, in the context of the discussion of litigation privilege. The reality is that in the aftermath of an incident like this, litigation is almost certain to follow. Much of the response or even the approach to the incident response is informed by that likelihood. Many records are created in anticipation of defending litigation, but those records are also useful for (or maybe necessary for) dealing with the commissioner’s investigation. Is 50/50 dominant enough? And some of these records would be created because that’s what’s expected of a reasonably prudent company. Is 33/33/33 dominant enough? Should we create different tracks in incident response, assigning certain investigators to the litigation track and others to the commissioner reporting track?

Maybe we should consider amending our privacy laws (or Evidence Acts more generally) to say that the provision of information to a regulator pursuant to a statutory duty does not amount to a waiver of privilege as far as third parties are concerned.

I think lawyers who work in this area will have some interesting discussions about this decision.

It will be interesting to consider how this affects certain activities that take place outside of the context of dealing with an active incident. For example, I may be retained by a client to provide them with my assessment of whether they are complying with their safeguarding obligations under privacy laws. Often, an engagement like that involves working with expert consultants who examine the network security, do penetration testing and benchmark against best practices. New facts are uncovered that will be included in my opinion and advice to the client, and at that stage there is no obligation to assist any privacy regulator in that endeavour. The new facts were “uncovered” or discovered only for the purpose of providing legal advice. I think there are arguments that can be made in both directions regarding whether those new facts can be privileged. That’s a discussion for another day …

I should add this decision doesn’t create any new law about privilege. Nor does it put a dizzying spin on privilege law, but it serves as a reminder that you can’t throw a blanket of privilege over everything associated with incident response. I also don’t think it does away with privilege in connection with incident response. I have provided a lot of advice to a lot of organizations, and I’ve worked with a lot of outside consultants in that context. I remain confident that my communications with my clients, in the context of them seeking my legal advice, is untouched by this decision. 

 

The value of legal privilege: Your diligent privacy consultant may become your worst enemy

A diligent privacy consultant will do a thorough privacy impact assessment, a threat risk assessment or a gap analysis. They'll take a thorough look at your current practices and benchmark them against not just your competitors but against best practices. Most companies will fall short in one way or another, and many will decide to only address 70% of the risks identified. But what about the other 30%? If you're later sued, your consultant's report will suggest to a judge or a jury that you decided not to get your house in order. What might have been negligence can quickly become recklessness.

The reality is that nothing that a consulant produces for you -- unless they are properly teamed with legal counsel -- will be privileged. I've seen loads of consultants who mark their reports as privileged, but a legend on a document will never stand up in court.

I'm involved with a class action lawsuit where the defendant had, on multiple occasions, brought in a privacy consultant to advise on a range of matters. As a diligent consultant should, they identified a number of problems with processes, practices and policies. They almost called the situation a dumpster fire. The organization sought to address most of these, but they didn't focus on all of them. When a huge breach happened and a huge class action lawsuit followed, the breach could be easily attributed to one of the areas where insufficient remediation took place. They went from being careless to being reckless. And the consultant's report will be Exhibit A in the lawsuit.

Even the most diligent organization, when it takes a microscope to its practices, will discover problems. Unless you're going to address every single shortcoming, you need to be aware of what you might discover. And what you discover may be handed on a silver platter to the plaintiffs.

In the case I'm referring to, if this report had been prepared by legal counsel--focusing on advising the organization about its actual legal risk rather than benchmarking against nebulous best practices--it never would become Exhibit A in the class action.

In this age of breach notification, when class actions will inevitably follow notifications, you need to make sure that you know your risks so you can address the most serious of them. And you need to make sure that these reports are truly seeking legal advice and will never see the light of day.

With many of my clients, we've been harnessing the capabilities of privacy consultants while structuring the engagement to make sure that all the findings are shielded from litigation discovery.

If you hire consultants, think about what might happen after a breach and you have to hand them over to plaintiffs' counsel. That can be addressed right now and you should think about it.

Supreme Court to hear important case about legal privilege and access to information/privacy laws

This morning, the Supreme Court granted leave to appeal the Alberta Court of Appeal decision in University of Calgary v JR, 2015 ABCA 118.

In a nutshell, this will be a revisiting of Blood Tribe, but in the context of the provincial access to information laws that govern public bodies and government agencies.

Here’s the summary of the issue in appeal from the SCC website:

36460
Information and Privacy Commissioner of Alberta v. Board of Governors of the University of Calgary

(Alberta) (Civil) (By Leave)

Keywords Privacy - Access to information.

Summary

Case summaries are prepared by the Office of the Registrar of the Supreme Court of Canada (Law Branch) for information purposes only.

Privacy — Access to information — What words must a statute employ to empower a tribunal to review records to determine whether a claim of privilege is valid?

In the course of a wrongful dismissal suit by an individual against the respondent University, the University asserted solicitor-client privilege over certain material. The individual made an access to information request under s. 7 of the Freedom of Information and Protection of Privacy Act, R.S.A. 2000, c. F-25, seeking certain records about her in the University’s possession. The University provided some disclosure, but claimed solicitor-client privilege over some of the requested material. The Commissioner’s delegate eventually directed the University to the Commissioner’s “Solicitor-Client Privilege Adjudication Protocol”. When the University did not comply, the delegate issued a “notice to produce records” under s. 56(3) of the Act. It reads, in part, “[t]he Commissioner may require any record to be produced to the Commissioner and may examine any information in a record… [d]espite any other enactment or any privilege of the law of evidence”. The delegate indicated in an accompanying letter that the purpose of the notice was to enable him to determine whether solicitor-client privilege had been properly asserted because the University had not provided sufficient evidence to allow him to make that determination. The University sought judicial review of the delegate’s decision to issue the notice to produce. The Law Society of Alberta was granted intervener status at the Court of Queen’s Bench and the Court of Appeal. The application for judicial review was dismissed, and the subsequent appeal was allowed.

In the same batch of leave applications, the Court dismissed leave to appeal from the Ontario decision of Hopkins v. Kay, 2015 ONCA 112. In that Case, the Ontario Court of Appeal declined to throw out a class action brought against a health authority which had argued that the provinces Personal Health Information Protection Act was a complete code which ousts claims for intrusion upon seclusion.

Commissioner can't demand evidence to back-up privilege claims

Dan Michaluk, over at All About Information, has a great summary of a recent case from the Federal Court holding that the Privacy Commissioner of Canada does not have the power to demand evidence to support a claim of privilege, as an exemption to the access principle under PIPEDA. See: Case Report – Federal Court says OPC can’t demand evidence supporting a privilege claim « All About Information.

This is very interesting because since Blood Tribe, the Commissioner has been demanding detailed information about the documents over which privilege is claimed.

This case is Privacy Commissioner of Canada v. Air Canada, 2010 FC 429 (CanLII), 2010 FC 429 (CanLII).

Newfoundland court concludes Information and Privacy Commissioner may not review privilege claims

The Supreme Court of Newfoundland has released what I think is a very important decision under that province's access to information legislation. The dispute in Newfoundland and Labrador (Attorney General) v. Newfoundland and Labrador (Information and Privacy Commissioner), 2010 NLTD 31 (not yet on CanLII) centered around whether the Information and Privacy Commissioner has the authority to request and review documents that were alleged to be subject to solicitor-client privilege.

The relevant portion of the Act on which the Commissioner was relying provides:

52. (1) The commissioner has the powers, privileges and immunities that are or may be conferred on a commissioner under the Public Inquiries Act.

(2) The commissioner may require any record in the custody or under the control of a public body that the commissioner considers relevant to an investigation to be produced to the commissioner and may examine information in a record, including personal information.

(3) The head of a public body shall produce to the commissioner within 14 days a record or copy of a record required under this section, notwithstanding another Act or regulations or a privilege under the law of evidence.

The Court concluded that solicitor-client privilege, though it may have started as a rule of evidence, is a substantive right that it not interfered with by Section 52(1). This is consistent with Privacy Commissioner of Canada v. Blood Tribe Department of Health, 2008 SCC 44 (S.C.C.).

Justice Marshall wrote:

[90] Section 52(3) of the ATIPPA does not oblige the DOJ to provide the Commissioner with solicitor-client records. The language of section 52(3) does not capture solicitor-client privileged documents. Similarly, section 52(2) does not give the Commissioner power to demand solicitor-client records. The open-textured language of section 52(2) is to be read as not including solicitor-client documents (Blood Tribe). Similarly, a restrictive interpretation of section 52(3) dictates that describing privilege solely as a rule of evidence is not broad enough to capture solicitor-client privilege. While this finding is based on a restrictive interpretation, it is also consistent with the objects of the ATIPPA. The “mischief” has been remedied by the legislature which has given the Commissioner the power of review; but not the power to violate solicitor-client privilege which is a “fundamental civil and legal right”.

Supreme Court rules on Privacy Commissioner's power to review privileged documents

The Supreme Court of Canada has just handed down its decision in Canada (Privacy Commissioner) v. Blood Tribe Department of Health, which was a question of whether the Privacy Commissioner could review documents to determine whether claims of privilege have been properly applied. The unanimous Court, on appeal from the Federal Court of Appeal, determined that she cannot.

From the headnote:

Privacy — Investigations of complaints — Powers of Privacy Commissioner — Production of documents — Solicitor‑client privilege — Dismissed employee filing complaint with Commissioner and seeking access to her personal employment information — Employer claiming solicitor‑client privilege over some documents — Whether Commissioner can compel production of privileged documents — Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 12.

Following her dismissal, an employee asked to have access to her personal employment information because she suspected that the employer had improperly collected inaccurate information and used it to discredit her before its board. The employer denied the request, and the employee filed a complaint with the Privacy Commissioner seeking access to her personal file. The Commissioner requested the records from the employer in broad terms. All records were provided except for those over which the employer claimed solicitor‑client privilege. The Commissioner then ordered production of the privileged documents pursuant to s. 12 of the Personal Information Protection and Electronic Documents Act (“PIPEDA”), which confers the powers to compel the production of any records “in the same manner and to the same extent as a superior court of record” and to “receive and accept any evidence and other information . . . whether or not it is or would be admissible in a court of law”. The employer applied for judicial review of the Commissioner’s decision. The reviewing judge determined the Commissioner was empowered to compel production of documents over which solicitor‑client privilege was claimed in order to effectively complete her statutory investigative role. The Federal Court of Appeal set aside the decision of the reviewing judge and vacated the Commissioner’s order for production of records.

Held: The appeal should be dismissed.

Solicitor‑client privilege is fundamental to the proper functioning of our legal system. The complex of rules and procedures is such that, realistically speaking, it cannot be navigated without a lawyer’s expert advice. However, experience shows that people who have a legal problem will often not make a clean breast of the facts to a lawyer without an assurance of confidentiality “as close to absolute as possible”. Without that assurance, access to justice and the quality of justice in this country would be severely compromised. It is in the public interest that the free flow of legal advice be encouraged. [9]

When the appropriate principles of statutory interpretation are applied to the general language of PIPEDA, the right of the individual or organization that is the target of the complaint to keep solicitor‑client confidences confidential must prevail. The Commissioner is an officer of Parliament vested with administrative functions of great importance, but she does not, for the purpose of reviewing solicitor‑client confidences, occupy the same position of independence and authority as a court. It is well established that general words of a statutory grant of authority to an office holder, including words as broad as those contained in s. 12 of PIPEDA, do not confer a right to access solicitor‑client documents, even for the limited purpose of determining whether the privilege is properly claimed. That role is reserved to the courts. Express words are necessary to permit a statutory official to “pierce” the privilege. Such clear and explicit language does not appear in PIPEDA. [1-2]

An adjudication of a claim of privilege by the Commissioner, who is an administrative investigator not an adjudicator, would be an infringement of the privilege. Client confidence is the underlying basis for the solicitor‑client privilege, and infringement must be assessed through the eyes of the client. To a client, compelled disclosure to an administrative officer, even if not disclosed further, would constitute an infringement of the confidentiality. The objection is all the more serious where, as here, there is a possibility of the privileged information being made public or used against the person entitled to the privilege. Furthermore, in pursuit of its mandate, the administrative officer may become adverse in interest to the party whose documents it wants to access. Not only may it take the resisting party to court but it may decide to share compelled information with prosecutorial authorities without court order or the consent of the party from whom the information was compelled. [20‑21] [23]

Here, the only reason the Commissioner gave for compelling the production and inspection of the documents in this case is that the employer indicated that such documents existed. She does not claim any necessity arising from the circumstances of this particular inquiry. The Commissioner is therefore demanding routine access to such documents in any case she investigates where solicitor‑client privilege is invoked. In the Commissioner’s view, piercing the privilege would become the norm rather than the exception in the course of her everyday work. Even courts will decline to review solicitor‑client documents to adjudicate the existence of privilege unless evidence or argument establishes the necessity of doing so to fairly decide the issue. [17]

The Commissioner has not made out a case that routine access to solicitor client confidences is necessary to achieve the ends sought by PIPEDA. There are other less intrusive remedies. Firstly, she may, at any point in her investigation, refer a question of solicitor‑client privilege to the Federal Court under s. 18.3(1) of the Federal Courts Act. Secondly, within the framework of PIPEDA itself, the Commissioner has the right to report an impasse over privilege in her s. 13 report and, with the agreement of the complainant, bring an application to the Federal Court for relief under s. 15. The court is empowered, if it thinks it necessary, to review the contested material and determine whether the solicitor‑client privilege has been properly claimed. This procedure permits verification while preserving the privilege as much as possible. [31] [33‑34]

Some past coverage of this case on this blog: Canadian Privacy Law Blog: Decision: Blood Tribe (Dept. of Health) v. Canada (Privacy Commissioner), Canadian Privacy Law Blog: Commissioner cannot compel privileged documents: FCA.

Court of Appeal considers insured's right of access to IME notes

Last month, the Federal Court of Appeal issued its decision in Wyndowe v. Rousseau, 2008 FCA 39 (CanLII). This case involved an individual's request for access to information generated by a physician hired by his insurer for the purposes of an independent medical examination. At trial, Justice Tietelbaum held the information was "personal information" for the purposes of PIPEDA and that it was not covered by litigation privilege (See Rousseau v. Wyndowe, 2006 FC 1312 (CanLII) and Canadian Privacy Law Blog: FCA grants stay of judge's order for disclosure of personal information). The question of litigation privilege was not appealed.

The Federal Court of Appeal has some interesting things to say about the interplay of the common law and PIPEDA, the definition of personal information, the nature of "commercial activities".

On the question of "commercial activities", the Court was clear that the collection of the applicant's personal information was in the course of commercial activities:

[35] The question is whether the IME transaction was of a “commercial nature”, as defined in section 2. The transaction between Dr. Wyndowe’s corporation and Maritime Life, who was paying for the IME, is of a commercial nature. Mr. Rousseau’s relationship between himself and Maritime Life is also clearly of a commercial nature: it is governed by a contract between Mr. Rousseau and his insurer, where Mr. Rousseau presumably paid some premiums (or his employer paid the premiums as part of Mr. Rousseau’s compensation for employment) and he therefore may or may not be entitled to benefits.

[36] In the context of these two commercial relationships – between Dr. Wyndowe’s corporation and Maritime Life on the one hand and between Mr. Rousseau and Maritime Life on the second hand – I find it hard to believe that by introducing a third relationship – between Dr. Wyndowe and Mr. Rousseau – the commercial nature of the overall transaction is defeated. In my view, Dr. Wyndowe is merely the medical agent of Maritime Life. If Dr. Wyndowe worked as a full time doctor for Maritime life, there would be no question the transaction is commercial; being examined by him would merely be a step which Mr. Rousseau had to follow to collect his benefits. In that sense the examination would be akin to filling out a form required by Maritime Life in order to begin collecting benefits. Just because Dr. Wyndowe is an independent consultant hired by Maritime Life does not change the fact that the overall transaction retains its commercial nature. It also does not change the fact that Mr. Rousseau was only doing what his contract with Maritime Life required him to do to maintain his benefits, i.e. submitting to an IME.

With respect to whether the information is "personal information" of the applicant, the Court concluded it was:

[49] In light of the Privacy Commissioner’s recognition that there are in the notes information which is personal to Mr. Rousseau and information which is not, it may be said that in the end, Mr. Rousseau has a right of access to the information he gave the doctor, and to the final opinion of the doctor in the form of the report to the insurer. In accordance with Principle 4.9.1. of Schedule I to the PIPED Act, this enables Mr. Rousseau to correct any mistakes in the information he gave the doctor or which the doctor noted, as well as any mistakes in the doctor’s reasoned final opinion about his medical condition. But the process of getting to that final opinion from the initial personal information of Mr. Rousseau belongs to the doctor.

[50] This Court, in Canada (Information Commissioner) v. Canada (Minister of Citizenship and Immigration) (above, at para. 8), has recognized that “the same information can be “personal” to more than one individual” (at para. 15). It may well be, in the end, that some information in the notes will be personal to both Mr. Rousseau and Dr. Wyndowe. A balancing exercise similar to that proposed in our ruling in Canada (Information Commissioner) would then need to be performed.

And on the interplay between the common law and PIPEDA:

[26] A) the common law

The appellant first submits that as the PIPED Act does not clearly and unambiguously override the common law respecting the right of access to one’s personal health record, the common law should apply. At common law, as the argument goes, the right to inspect one’s medical records is only recognized where there is a fiduciary relationship between physician and patient (see McInerney v. MacDonald, 1992 CanLII 57 (S.C.C.), [1992] 2 S.C.R. 138. As there is no fiduciary relationship between the insured and the insurer’s doctor performing an IME (see X(Minors) v. Bedfordshire County Council, [1995] 3 All E.R. 353 (H.L.), the insured has no right of access to his medical records.

[27] I am not persuaded that at common law an insured has no right of access to his medical records. In any event, it is my view that the common law should not prevail where the very purpose of the PIPED Act is to provide new privacy protections to Canadians not otherwise enjoyed under the common law.

In the result, the Court of Appeal held that the applicant/insured had a right of access to the notes of the examining physician under PIPEDA.

Commissioner speaks at the PIPEDA review hearings

Michael Geist has a summary of the third day of the PIPEDA review hearings, at which the Privacy Commissioner appeared. She called for mandatory breach notification and amendments to PIPEDA to get around the recent Blood Tribe that curtailed her ability to review claims of privilege. Check it out: Michael Geist - PIPEDA Hearings - Day 03 (Privacy Commissioner of Canada).

Update (20070118): For links to the full hearing transcripts, go to: Canadian Privacy Law Blog: PIPEDA Review Transcripts.

Commissioner cannot compel privileged documents: FCA

The Federal Court of Appeal yesterday released its decision in Blood Tribe Department of Health v. Canada (Privacy Commissioner). This is the important decision in which the Federal Court had held that the Privacy Commissioner had jurisdiction to review documents that are claimed to be privileged to determine if the privilege was properly claimed in a request for access (FCT case).

The Court of Appeal held (and forgive the bad OCR of a faxed copy of the decision -- a cleaned up version will appear shortly):

(e) How to Deal with a Claim of Solicitor-Client Privilege under PIPEDA

[31] Section 15 of PIPEDA permits the Commissioner to apply to the Federal Court in relation to any matter referred to in section 14 which in turn encompasses solicitor-client privilege pursuant to subsection 9(3) of that Act (supra, at paragraph 4).

[32] The Intervener, the Law Society of Alberta, directed the panel to the Supreme Court of Canada of R v, McClure, 2001 SCC 14 [McClure]. That case outlined useful principles to be applied regarding a review of solicitor-client privilege by civil and criminal courts. McClure faced sexual charges from twelve former students, including one 'J.C.' who had also commenced a civil action. In the criminal action, McClure sought production of JC's civil litigation file in order to determine the nature of his allegations and to test his motivation in fabricating or exaggerating incidents of abuse. Major J. outlhed a three stage procedural test to protect the solicitor-client privilege. In the first two stages, the party seeking privileged material must establish that there i s no other compellable source for the privileged information as well as an evidentiary basis upon which to conclude that the information would be legally useful. In the third stage, the judge must then examine the documents and will not release them unless satisfied that they would likely give rise to an issue of relevance pertinent to the ,ultimate disposition of the case.

[33] In my analysis, the Commissioner's ability to conduct her investigation is not fettered by a rule that protects privileged communication. In circumstances where a broad claim of solicitor client privilege is used as a shield to thwart on investigation, judges of the Federal Court are equal to the task of developing procedures that adequately minimize the potential invasion of the privilege (see also Goodis v. Ontario (Ministry of Correctional Services}, 2006 SCC 3 1 at paragraph 2 1).

V. Conclusion

[34] In summay, the Judge erred in adopting a purposive and liberal interpretation of paragraphs 12(l)(a) and (c) of PIPEDA and in adopting AIA principles in a PIPEDA review. The appeal should be allowed, the order of the Judge dated March 8, 2005 should be set aside and the Commissioner's order for production of rccords dated October 22, 2003 should be vacated. Costs to the appellant in this appeal. No costs were sought by the intervener, the Law Society of Alberta.

Supreme Court of Canada sides with solicitor client privilege in freedom of information case

In a freedom of information decision released yesterday, the Supreme Court of Canada came down strongly (and unanimously) in support of solicitor client privilege as an almost absolute bar to disclosure under Ontario's freedom of information law:

Goodis v. Ontario (Ministry of Correctional Services), 2006 SCC 31 (CanLII)

Rothstein J. (McLachlin C.J. and Bastarache, Binnie, LeBel, Deschamps, Fish, Abella and Charron JJ. concurring)

Access to information — Access to records — Exemption — Solicitor‑client privilege — Access to records for determination of whether they should be disclosed under Freedom of Information and Protection of Privacy Act — Whether records may be disclosed to requester’s counsel notwithstanding claim of solicitor‑client privilege — Whether Divisional Court bound by Act’s provisions prohibiting Commissioner from disclosing any records until final decision made — Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31, s. 19.

A judge of the Divisional Court, who was reviewing a decision of the Ontario Information and Privacy Commissioner, granted the requester’s counsel access to records notwithstanding a claim of solicitor‑client privilege by the Ministry of Correctional Services. The judge treated the motion for access as one by the requester’s counsel, and not as one by the requester, in order to enable counsel to argue whether those records should be disclosed under the Freedom of Information and Protection of Privacy Act. The order for disclosure was made subject to a confidentiality undertaking. Panels of the Divisional Court and of the Ontario Court of Appeal upheld that decision and found that the judge had discretion to order disclosure.

Held: The appeal should be allowed.

Records subject to a claim of solicitor‑client privilege may be ordered disclosed only where absolutely necessary — a test just short of absolute prohibition. A different test is not justified for access to information cases. Here, the evidence revealed no such absolute necessity, and any records claimed to be subject to solicitor‑client privilege should not be disclosed. It is difficult to envisage circumstances where this test could be met if the sole purpose of disclosure is to facilitate argument by requester’s counsel on the question of whether privilege is properly claimed. While the principle of hearing from both sides of an issue is to be departed from only in exceptional cases, judges are well acquainted with privilege and well equipped to determine if a record is subject to it. [20‑25]

The procedural provisions of the Freedom of Information and Protection of Privacy Act apply to the Commissioner, not the courts which are bound rather by the legislation governing their procedures on judicial review. Since the provisions of the Act prohibiting the Commissioner from disclosing any records until a final decision is made are procedural, the matter of disclosure is accordingly left to the court’s discretion, subject to statutory or common law rules. Where no common law rule prescribes the manner in which to deal with records, the court must adopt a procedure which will protect the confidentiality of records until a substantive decision is made. [30‑32]

In this case, the judge of the Divisional Court considered the appropriateness of the confidentiality undertaking and that the integrity of counsel providing the undertaking had not been attacked. His approach was correct to the extent the records were not privileged and confidentiality had been claimed on some other basis. However, in the case of documents subject to solicitor‑client privilege, this approach was inappropriate unless the “absolute necessity” test was met. [33]

Privacy Commissioner's power to review privilege claims

About a year ago, Justice Moseley of the Federal Court of Canada ruled that the Privacy Commissioner of Canada has the power to compel the production of documents for which solicitor client privilege is claimed in order to review the privilege claims (Blood Tribe (Dept. of Health) v. Canada (Privacy Commissioner), 2005 FC 328 (CanLII)). It is now being appealed to the Federal Court of Appeal and the Law Society of Alberta has been granted leave to intervene in the appeal (Blood Tribe Department of Health v. Canada (Privacy Commissioner), 2006 FCA 101).

Privacy Privacy Commissioner PIPEDA Privilege

Decision: Blood Tribe (Dept. of Health) v. Canada (Privacy Commissioner)

The Federal Court of Canada has been given the opportunity to consider the powers of the Privacy Commissioner under PIPEDA to compel the production of information for which solicitor-client privilege is claimed. In Blood Tribe (Dept. of Health) v. Canada (Privacy Commissioner), Justice Mosley concluded that the Commissioner does have the power to compel information for the purposes of determining whether it is privileged:

"[58] Having regard to the overall scheme of the statute and the Commissioner's responsibility to conduct an effective investigation, the principles enunciated by the Supreme Court of Canada in Lavallee do not, in my view, require that section 12 of the PIPED Act be given the restrictive interpretation called for by the applicant. The production order issued by the Commissioner will not limit or deny any solicitor-client privilege that the applicant may enjoy in the questioned documents. I am satisfied that in order to complete her investigation it is necessary that the claim of privilege be assessed by the Commissioner to determine whether it properly applies to the questioned documents or not. That will not prevent the applicant from continuing to assert the claim in any other proceedings that may arise in relation to the complaint.

[59] Accordingly, the Commissioner correctly exercised her authority to issue the production order and this application will be dismissed. As the question of interpretation of the scope of the PIPED Act in relation to solicitor-client privilege appears to have arisen for the first time in these proceedings, I will exercise my discretion to make no order of costs in favour of the successful party."

This was a judicial review of the Commissioner's order and the standard of review applied in this case was correctness.