Online reviews and privacy claims: Lessons from RateMDs v Bluler (BCCA)

 

Can a doctor claim a privacy violation because a website creates a profile for them using public information, hosts anonymous reviews, and ranks them against their peers?

The British Columbia Court of Appeal says no in RateMDs Inc. v. Bleuler, 2025 BCCA 329. Let’s walk through what happened — and what this means for privacy in Canada.

Let’s start with the background to this case.

RateMDs.com is a website where people can look up health professionals, read and post reviews, and compare ratings. You’ve probably seen it — you search for a physician, and you get their name, their contact information, their ratings, and often a long list of anonymous comments.

Dr. Ramona Bleuler, a BC physician, discovered that RateMDs had created a profile for her. She didn’t ask for it. She didn’t consent to it. And she couldn’t remove it.

The platform listed her name, her professional contact information, a list of reviews from anonymous users and a comparative ranking of doctors in her specialty and geographic region.

RateMDs also offers paid subscriptions that allow physicians to hide a limited number of reviews. Dr. Bleuler wanted to start a class action on her own behalf and on behalf of other physicians in Canada who had listings on RateMDs. 

Class actions – at least in Canada – have specific procedures, which require that the class action be certified before it can go ahead. There are a number of things the court must look at pursuant to the Class Proceedings Act, but the most important question for our analysis here is whether the pleadings disclose a cause of action. When you read the pleadings, and assume that the facts are true and provable, is there an actual legal claim there? This is a screening function to weed out any legal claims that are bound to fail, and the court is only supposed to examine the facts alleged in the statement of claim. 

This case principally turns on whether the legal claims made by the representative plaintiff are viable. 

So the plaintiff sued RateMDs and its parent company under the provincial Privacy Act. She said that by creating a profile for her, hosting reviews, and ranking her relative to her peers, RateMDs violated her privacy.

She wasn’t claiming that specific reviews contained private information. She wasn’t arguing defamation. Her claim was broader: she said the very act of aggregating, hosting, and ranking health professionals without their consent violated privacy law. In particular, the plaintiff was relying on the statutory privacy torts created by the legislatures of British Columbia, Saskatchewan, Manitoba and Newfoundland. The proposed class would be physicians who reside in those provinces. The plaintiff also tried to rely on Quebec’s privacy statute, but that part wasn’t allowed to proceed in the lower court. 

She relied on two sections of the British Columbia Privacy Act, and their equivalents in the other provinces.

First, section 1, which creates a tort — actionable without proof of damage — where a person ‘wilfully and without claim of right’ violates the privacy of another.

Violation of privacy actionable

1 (1) It is a tort, actionable without proof of damage, for a person, wilfully and without a claim of right, to violate the privacy of another.

Second, section 3(2), which prohibits the unauthorized use of someone’s name or portrait for the purpose of advertising or promoting the sale of goods or services.

Unauthorized use of name or portrait of another

3 (2) It is a tort, actionable without proof of damage, for a person to use the name or portrait of another for the purpose of advertising or promoting the sale of, or other trading in, property or services, unless that other, or a person entitled to consent on the other's behalf, consents to the use for that purpose.

Her argument was that RateMDs is a commercial enterprise. The profiles draw traffic, the reviews attract users, and the rankings keep people engaged. Because this commercial model depends on using doctors’ names and contact information, she said this amounted to both a privacy violation and commercial exploitation of identity.

The BC Supreme Court agreed the case should go forward. The judge certified the class action. I have to emphasize that this was only based on the pleadings and the court was essentially saying that the claims looked viable, but that didn’t mean the plaintiffs would win at any eventual trial. 

But RateMDs appealed. And at the Court of Appeal, everything changed.

The Court of Appeal approached the case by asking the basic but crucial question: Even assuming all the facts in the claim are true, is there a viable cause of action under the privacy statutes?

Again, this is a threshold question in class action certification. You don’t look at evidence. You look at the pleadings. You ask whether the claim has a reasonable chance of success.

A claim can be novel — that’s okay. But if it’s doomed to fail, the court must strike it.

Here’s the heart of the Court of Appeal’s reasoning:

At least for the purposes of a civil claim, privacy starts with identifying private information. And the claim failed at this starting point.

The Court of Appeal said:

●        A doctor’s name is not private.

●        Professional business contact information is not private.

●        Reviews written by patients about a doctor’s professional services are not private.

●        Rankings based on those reviews are not private.

The Court emphasized that privacy law protects reasonable expectations of privacy. And when someone is carrying out professional, public-facing work, the threshold for privacy protection is different.

The Court relied on earlier BC cases — including Niemela v. Malamas — which held that complaints about how a lawyer performs their work do not attract a reasonable expectation of privacy. Professional reputation is not the same thing as privacy.

The doctor tried to frame her privacy right as a right to control how information about her was used. But the Court said: control only exists if there’s a privacy interest in the underlying information. If the information is not private, there is nothing to control. Or at least privacy torts don’t leap in to give you that control. 

For privacy lawyers, this is an important clarification: The BC Privacy Act protects privacy, not reputation, and not personal preference about the use of publicly available professional information.

The Court concluded that because there was no reasonable expectation of privacy in the information posted on RateMDs, the privacy claim under section 1 was bound to fail.

The Court also noted an important distinction: This case wasn’t about whether any particular review contained sensitive information. The plaintiff expressly disclaimed that argument. She said the content didn’t matter — only the existence of the profile and the ranking system did.

The Court said that privacy law doesn’t work that way. You can’t claim a violation based on a website compiling publicly available information unless there’s some private content involved.

So the broad theory — that creating a profile and ranking professionals without their consent is itself a privacy violation — was rejected. There would have to be something more … and in this case, there was not.

The BC Supreme Court judge had relied in part on the rules governing how health professionals can advertise. For example, doctors can’t use testimonials. They can’t compare themselves to colleagues. The judge below thought this regulatory context created a privacy interest.

The Court of Appeal disagreed.

Those rules regulate doctors. They do not regulate third-party websites. They do not create privacy rights. And they do not convert publicly available information into private information. The Court of Appeal wrote at paragraph 98: “However, the interest of provincial regulators in restricting advertising by health professionals has no obvious connection to the respondent’s asserted privacy interest. The regulatory concern is to protect the public, not to protect the privacy of health professionals. That regulatory interest has nothing to do with the plaintiff’s reasonable expectation of privacy.”

So the regulatory framework could not be used to manufacture a privacy interest where none otherwise existed.

Next, the Court examined the claim under section 3(2) — unauthorized use of name or portrait for advertising.

This is the ‘misappropriation of personality’ tort. It typically covers: (a) using someone’s name or image in an ad, (b) using a person’s likeness to promote goods or services or (c) endorsements without consent.

RateMDs wasn’t using doctors’ identities to advertise or sell anything in the sense required by the statute. It was running a platform where reviews are posted and accessed. Running a commercial website that uses names in this manner doesn’t cut it. That’s not the kind of commercial exploitation section 3(2) is meant to capture.

So the Court of Appeal found that the claim under section 3(2) was also doomed to fail.

With both privacy causes of action rejected at the threshold stage, the Court of Appeal allowed the appeal, set aside the certification order and dismissed the action entirely. This was a complete win for RateMDs.

What are the broader implications?

First, the Court drew a clear boundary around privacy law: You can’t use privacy torts to challenge the existence of a professional review platform.

Second, the decision reinforces that privacy torts require a reasonable expectation of privacy in identifiable, specific information. That expectation must be grounded in: (a) the nature of the information, (b) the specific context, and (c) established privacy norms.

Third, platforms that rely on publicly available, professional information to generate profiles or rankings are, at least under BC’s statute and its equivalents, unlikely to face successful privacy claims — unless they publish actually private or sensitive data.

Fourth, the Court left open — deliberately — that if a review leaks confidential information or medical information, that could be a privacy violation. But that’s not what this case was about.

Finally, this is a reminder that privacy law is not a catch-all remedy for online reputational harm. Other legal avenues may exist such as defamation — but the privacy tort has a defined scope.

A last thing to note, which is important, is that this decision was made in the context of privacy torts – civil claims for invasion of privacy or use of image and likeness. Under our more general privacy statutes, such as the Personal Information Protection and Electronic Documents Act, whether information is “personal information” – and thus whether the statute applies to it – does not depend on whether the information is “private” or the “confidentiality” of the information.

A person’s name is subject to those laws, but may simply be less “sensitive”. Though a lot of the same principles may be in play, one should always be cautious about assuming that what a court says in the tort context will apply directly to our commercial privacy laws.

Ontario court adopts the "false light publicity" privacy tort

Regular readers of this (irregular) blog will recall the milestone case of Jones v Tsige, in which the Ontario Court of Appeal imported into Canada the US privacy torts. That list includes:

1. Intrusion upon the plaintiff's seclusion or solitude, or into his private affairs.
2. Public disclosure of embarrassing private facts about the plaintiff.
3. Publicity which places the plaintiff in a false light in the public eye.
4. Appropriation, for the defendant's advantage, of the plaintiff's name or likeness.

The fourth cause of action, commercial appropriation of the plaintiff's image, was already alive and well in Canadian tort law. The Court in Jones applied the "intrusion upon seclusion" tort and subsequent cases have applied "public disclosure of private facts" (See Ontario court explicitly adopts new privacy tort: public disclosure of private facts.)

In December 2019, the Ontario Superior Court of Justice explicitly recognized the "false light" privacy tort. In Yenovkian v. Gulian, 2019 ONSC 7279, Justice Kristjanson was dealing with an unpleasant family law case in which the husband had made wild accusations against his former spouse, particularly related to their two children. The judge noted, with respect to the list of privacy torts:

[170] With these three torts all recognized in Ontario law, the remaining item in the “four-tort catalogue” of causes of action for invasion of privacy is the third, that is, publicity placing the plaintiff in a false light. I hold that this is the case in which this cause of action should be recognized. It is described in § 652E of the Restatement as follows:

Publicity Placing Person in False Light

One who gives publicity to a matter concerning another that places the other before the public in a false light is subject to liability to the other for invasion of his privacy, if

(a) the false light in which the other was placed would be highly offensive to a reasonable person, and

(b) the actor had knowledge of or acted in reckless disregard as to the falsity of the publicized matter and the false light in which the other would be placed.

[171] I adopt this statement of the elements of the tort. I also note the clarification in the Restatement’s commentary on this passage to the effect that, while the publicity giving rise to this cause of action will often be defamatory, defamation is not required. It is enough for the plaintiff to show that a reasonable person would find it highly offensive to be publicly misrepresented as they have been. The wrong is in publicly representing someone, not as worse than they are, but as other than they are. The value at stake is respect for a person’s privacy right to control the way they present themselves to the world.

While I don't propose to list all the misconduct the husband was found to have carried out, this summary at the beginning of the decision is helpful for context:

[2] It is also about a father, Mr. Vem Yenovkian, who has engaged in years of cyberbullying of the mother, Ms. Sonia Gulian on websites, YouTube videos, online petitions and emails. It is about a father who videotapes court-ordered access visits with the children—both in-person and on Skype—and edits and posts those access visits and photographs of the children on the internet, with commentary. It is about a father who publicly posts on YouTube a video of his son cowering under a table while the father harangues him over Skype on a court-ordered access visit. It is about a father who posts videos of him describing his daughter, who suffers from a neurological disorder, as looking drugged, when she used to be “normal,” and posting that his daughter has a “broken” mind.

[3] Despite court orders prohibiting posting, the father continues his cyberbullying campaign abusing Ms. Gulian and her parents. He seeks to undermine the administration of justice through an online campaign to “unseat” a judge of this Honourable Court for rulings made, internet attacks on trial witnesses and the wife’s lawyer, and by flouting court orders and family law disclosure obligations.

The Court in this case did not follow the $20,000 "cap" on non-pecuniary damages set out in Jones v Tsige, but rather followed the divergent train of thought started with the Doe case:

[186] There is no claim for pecuniary damages; the only issue is non-pecuniary damages. The infliction of mental suffering and invasion of privacy are based on many of the same facts.

[187] On damages for intrusion on seclusion, the Court of Appeal in Jones v. Tsige held at paragraphs 87-88 that damages for intrusion upon seclusion in cases where the plaintiff has suffered no pecuniary loss should be modest, in a range up to $20,000. The important distinction with the two invasion of privacy torts in issue here, however, is that intrusion on seclusion does not involve publicity to the outside world: they are damages meant to represent an invasion of the plaintiff’s privacy by the defendant, not the separate and significant harm occasioned by publicity.

[188] The two Jane Doe cases have recognized that the cap on damages for intrusion upon seclusion may not apply to the other forms of invasion of privacy: Jane Doe 2016 at para. 58; Jane Doe 2018 at paras. 127-132. In this case, as is in those, the “modest conventional sum” that might vindicate the “intangible” interest at stake in Jones v. Tsige, para. 71, would not do justice to the harm the plaintiff has suffered.

[189] In Jane Doe 2016, at para. 52, Stinson J. turned to sexual battery cases for guidance in arriving at an award, and Gomery J. in Jane Doe 2018, at paras. 127-128 followed the same approach. In support of this approach, Stinson, J. pointed to the similarly of the psychological and emotional harm the plaintiff had suffered to that experienced by victims of sexual assault.

[190] I likewise adopt the method of looking to the factors applied to decide damage awards for a tort causing harms analogous to those the present plaintiff has suffered for invasion of privacy. The harm arising from the invasion of privacy in the present case is akin to defamation. Accordingly, in arriving at an award of non-pecuniary damages, I am guided by the factors described by Cory J. in Hill v Church of Scientology, at para. 187, which I am adapting to the tort of publicity placing a person a false light:

a) the nature of the false publicity and the circumstances in which it was made,
b) the nature and position of the victim of the false publicity,
c) the possible effects of the false publicity statement upon the life of the plaintiff, and
d) the actions and motivations of the defendant.

[191] In this case, the false publicity is egregious, involving alleged criminal acts including by Ms. Gulian against her children. The false publicity is widely disseminated on the internet, as well as through targeted dissemination to church friends and business associates. Ms. Gulian has suffered damage as a mother, as an employee, in the Armenian community, and in her church community. She is peculiarly vulnerable as the spouse of the disseminator of false publicity. The false publicity has had a detrimental effect on Ms. Gulian’s health and welfare, humiliation, caused her fear, and could be expected as well to affect her social standing and position. Mr. Yenovkian has not apologized, nor has he retracted the outrageous comments despite court orders.

[192] The damages for intentional infliction of mental suffering are intended to be compensatory. I award $50,000 compensatory damages for intentional infliction of mental suffering, relying on Boucher v. Wal-Mart Canada Corp., 2014 ONCA 419.

Alberta law provides civil remedies for cyberbullying victims

Tort regarding non-consensual distribution of intimate images supplements recent criminal amendments

The Alberta legislature has passed a bill to provide civil remedies for victims of the non-consensual distribution of intimate images. Bill 202, Protecting Victims of Non-Consensual Distribution of Intimate Images Act, creates a new civil cause of action for what has become known “revenge porn” or non-consensual pornography. When the law comes into effect, in August 2017, it will be actionable in the province, without proof of harm, for anyone to distribute “an intimate image of another person knowing that the person depicted in the image did not consent to the distribution, or is reckless as to whether or not that person consented to the distribution”. The statute builds upon the criminal provisions for such actions added to the Criminal Code in Bill C-13 and closely follows the similar statute in Manitoba, the Intimate Image Protection Act.

An “intimate image” is defined as an image or video in which the person depicted is nude or includes the breasts, genitals or anal region, or depicts explicit activity. It is further defined with reference to the expectation of privacy that existed at the time the image was created or distributed:

(ii) which was recorded in circumstances that gave rise to a reasonable expectation of privacy in respect of that image, and

(iii) if the image has been distributed, in which the person depicted in the image retained a reasonable expectation of privacy at the time it was distributed;

Importantly, that expectation of privacy is not necessarily lost if the image was taken by another person or was given to another person where it was not to be further distributed:

Expectation of privacy
5 In an action for the distribution of an intimate image without consent, the person depicted in the image does not lose the expectation of privacy in respect of the image if that person

(a) consented to another person recording the images, or

(b) provided the image to another person,

in circumstances where that other person knew or ought reasonably to have known that the image was not distributed to any other person.

The bill also contains a public interest defence, which is similar to that found in the Criminal Code for other pornography and obscenity offences. Also of note, if the defendant in an action under the new law is a child, the statute specifically deems that the parent of the defendant will not be jointly and severally liable unless the parent “directly participated” in the distribution of the image.

Ontario court explicitly adopts new privacy tort: public disclosure of private facts

For anyone who was wondering: the arc of the common law is long and it bends towards privacy. The Ontario Superior Court of Justice has this past week expressly recognized the tort of "public disclosure of private facts".

This is a huge deal, as it explicitly expands the scope of privacy protection under the common law and stands as an example of how the traditional courts (and perhaps new-ish torts) can be called upon to help victims of cyberbullying.

Arising from a horrific case of revenge porn where the defendant had uploaded to the internet an explicit sexual video of the plaintiff, the Court in Doe v D., 2016 ONSC 541 (CanLII) [Edit: try this version -- I understand that CanLII may have inadvertently published some details contrary to the publication ban], said this about the ability to sue for invasion of privacy:

C. Invasion of Privacy

[34] In Jones v. Tsige, 2012 ONCA 32 (CanLII), the Court of Appeal for Ontario recognized the existence of the tort of invasion of privacy in the context of intrusion upon seclusion. In that case, the Court found that the defendant had committed the tort of intrusion upon seclusion when she used her position as bank employee to repeatedly examine private banking records of her spouse's ex-wife. While that case dealt with a significantly different fact situation, many of the Court’s comments are germane to this case, and I will therefore refer extensively to that decision.

[35] To begin with, the Court noted (at para. 15) that “[t]he question of whether the common law should recognize a cause of action in tort for invasion of privacy has been debated for the past one hundred and twenty years. Aspects of privacy have long been protected by causes of action such as breach of confidence, defamation, breach of copyright, nuisance and various property rights. Although the individual's privacy interest is a fundamental value underlying such claims, the recognition of a distinct right of action for breach of privacy remains uncertain.”

[36] The Court went on to recognize as authoritative a seminal American legal article on the subject by William L. Prosser, "Privacy" (1960), 48 Cal. L. Rev., noting that “Prosser argued that what had emerged from the hundreds of cases he canvassed was not one tort, but four, tied together by a common theme and name, but comprising different elements and protecting different interests. Prosser delineated a four-tort catalogue, summarized as follows, at p. 389:

1. Intrusion upon the plaintiff's seclusion or solitude, or into his private affairs.

2. Public disclosure of embarrassing private facts about the plaintiff.

3. Publicity which places the plaintiff in a false light in the public eye.

4. Appropriation, for the defendant's advantage, of the plaintiff's name or likeness. “

[37] The Court also noted (at para. 19) that “[t]he tort that is most relevant to this case, the tort of ‘intrusion upon seclusion’, is described by the Restatement [Restatement (Second) of Torts (2010)], at 652B as: ‘One who intentionally intrudes, physically or otherwise, upon the seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the invasion would be highly offensive to a reasonable person.’”

[38] The Court went on to note (at para. 20) that “[t]he comment section of the Restatement elaborates this proposition and explains that the tort includes physical intrusions into private places as well as listening or looking, with or without mechanical aids, into the plaintiff's private affairs. Of particular relevance to this appeal is the observation that other non-physical forms of investigation or examination into private concerns may be actionable. These include opening private and personal mail or examining a private bank account, ‘even though there is no publication or other use of any kind’ of the information obtained.’” The Court commented that if the plaintiff in Jones had a right of action, it fell into the first category of intrusion upon seclusion, described by Prosser as comprised of the following elements:

• there must be something in the nature of prying or intrusion;

• the intrusion must be something which would be offensive or objectionable to a reasonable person;

• the thing into which there is prying or intrusion must be, and be entitled to be, private; and

• the interest protected by this branch of the tort is primarily a mental one. It has been useful chiefly to fill in the gaps left by trespass, nuisance, the intentional infliction of mental distress, and whatever remedies there may be for the invasion of constitutional rights.

[39] Later in its reasons, when considering the desirability of recognizing the tort of intrusion upon seclusion, the Court made a number of comments that are relevant to the issues in this case, including the following:

39 Charter jurisprudence identifies privacy as being worthy of constitutional protection and integral to an individual's relationship with the rest of society and the state. The Supreme Court of Canada has consistently interpreted the Charter's s. 8 protection against unreasonable search and seizure as protecting the underlying right to privacy. In Hunter v. Southam Inc., 1984 CanLII 33 (SCC), [1984] 2 S.C.R. 145, [1984] S.C.R. No. 36, at pp. 158-59 S.C.R., [page254] Dickson J. adopted the purposive method of Charter interpretation and observed that the interests engaged by s. 8 are not simply an extension of the concept of trespass, but rather are grounded in an independent right to privacy held by all citizens.

…

43 In Hill v. Church of Scientology of Toronto 1995 CanLII 59 (SCC), [1995] 2 S.C.R. 1130, Cory J. observed, at para. 121, that the right to privacy has been accorded constitutional protection and should be considered as a Charter value in the development of the common law tort of defamation. …

…

45 While the Charter does not apply to common law disputes between private individuals, the Supreme Court has acted on several occasions to develop the common law in a manner consistent with Charter values: [citations omitted].

46 The explicit recognition of a right to privacy as underlying specific Charter rights and freedoms, and the principle that the common law should be developed in a manner consistent with Charter values, supports the recognition of a civil action for damages for intrusion upon the plaintiff's seclusion ….

…

67 For over 100 years, technological change has motivated the legal protection of the individual's right to privacy. In modern times, the pace of technological change has accelerated exponentially. Legal scholars such as Peter Burns have written of "the pressing need to preserve 'privacy' which is being threatened by science and technology to the point of surrender": "The Law and Privacy: the Canadian Experience", at p. 1. See, also, Alan Westin, Privacy and Freedom (New York: Atheneum, 1967). The Internet and digital technology have brought an enormous change in the way we communicate and in our capacity to capture, store and retrieve information. As the facts of this case indicate, routinely kept electronic databases render our most personal financial information vulnerable. Sensitive information as to our health is similarly available, as are records of the books we have borrowed or bought, the movies we have rented or downloaded, where we have shopped, where we have travelled and the nature of our communications by cellphone, e-mail or text message.

68 It is within the capacity of the common law to evolve to respond to the problem posed by the routine collection and aggregation of highly personal information that is readily accessible in electronic form. Technological change poses a novel threat to a right of privacy that has been protected for hundreds of years by the common law under various guises and that, since 1982 and the Charter, has been recognized as a right that is integral to our social and political order.

69 Finally, and most importantly, we are presented in this case with facts that cry out for a remedy. …

[40] The passage quoted immediately above most certainly applies to the case before me.

[41] While the facts of this case bear some of the hallmarks of the tort of "intrusion upon seclusion", they more closely fall within Prosser’s second category: “Public disclosure of embarrassing private facts about the plaintiff.” That category is described by the [Restatement (Second) of Torts (2010) at 652D as follows: “One who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of his privacy, if the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public.”

[42] The comment section of the Restatement elaborates on this proposition as follows:

Every individual has some phases of his life and his activities and some facts about himself that he does not expose to the public eye, but keeps entirely to himself or at most reveals only to his family or to close friends. Sexual relations, for example, are normally entirely private matters, as are family quarrels, many unpleasant or disgraceful or humiliating illnesses, most intimate personal letters, most details of a man's life in his home, and some of his past history that he would rather forget. When these intimate details of his life are spread before the public gaze in a manner highly offensive to the ordinary reasonable man, there is an actionable invasion of his privacy, unless the matter is one of legitimate public interest.

Although written in somewhat antiquated language, the concepts described are entirely apposite to this case. Among the illustrations offered by the Restatement is the following: “A publishes, without B's consent, a picture of B nursing her child. This is an invasion of B's privacy.”

[43] Prosser listed the features of this tort as follows:

• the disclosure of the private facts must be a public disclosure, and not a private one;

• the facts disclosed to the public must be private facts, and not public ones; and

• the matter made public must be one which would be offensive and objectionable to a reasonable man of ordinary sensibilities.

[44] Plainly, writing in 1960, Prosser was discussing events that might occur in a pre-Internet world, where the concepts of pornographic websites and cyberbullying could never have been imagined. Nevertheless, the essence of the cause of action he described is the unauthorized public disclosure of private facts relating to the plaintiff that would be considered objectionable by a reasonable person. In the electronic and Internet age in which we all now function, private information, private facts and private activities may be more and more rare, but they are no less worthy of protection. Personal and private communications and the private sharing of intimate details of persons’ lives remain essential activities of human existence and day to day living.

[45] To permit someone who has been confidentially entrusted with such details – and in particular intimate images - to intentionally reveal them to the world via the Internet, without legal recourse, would be to leave a gap in our system of remedies. I therefore would hold that such a remedy should be available in appropriate cases.

[46] I would essentially adopt as the elements of the cause of action for public disclosure of private facts the Restatement (Second) of Torts (2010) formulation, with one minor modification: One who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of the other’s privacy, if the matter publicized or the act of the publication (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public. [modification shown by underlining]

[47] In the present case the defendant posted on the Internet a privately-shared and highly personal intimate video recording of the plaintiff. I find that in doing so he made public an aspect of the plaintiff’s private life. I further find that a reasonable person would find such activity, involving unauthorized public disclosure of such a video, to be highly offensive. It is readily apparent that there was no legitimate public concern in him doing so.

[48] I therefore conclude that this cause of action is made out.

Privacy breach class action certified against Government of Canada for medical marijuana breach

In a decision issued on July 27, 2015 but not yet published (but available here as a PDF), the Federal Court of Canada has certified a class action against the Government of Canada for disclosing the personal health information of participants in the "Marihuana Medical Access Program" in a botched mailout that was intended to advise program participants about changes to the regulation, which ironically where said to protect privacy and safety.

In November 2013, Health Canada sent notices to over 40,000 participants of the Marihuana Medical Access Program (MMAP) to advise of changes to regulations governing the use of medical marijuana in Canada. The notices were delivered in oversized envelopes that had the words “Health Canada - Marihuana Medical Access Program” on the return address, revealing to anyone who saw the envelope that the recipient was licensed to possess or produce medical marihuana for medical purposes. Previously, Health Canada’s mailings to MMAP members were discreet and made no mention of marijuana on the envelopes. Despite the Government of Canada’s acknowledgement of the error and that it was outside their normal practice, its reaction has consistently been "no harm, no foul".

What's most notable about this decision -- which is consistent with the recent decision in Condon v. Canada -- is that the court certified the plaintiffs' claim under the novel tort of "public disclosure of private facts". This tort is recognized in the United States, but is untested in Canada. It is a part of the four different privacy torts recognized by the Ontario Court of Appeal in Jones v. Tsige.

In March 2015, the Privacy Commissioner of Canada found that Health Canada's breach was a violation of the Privacy Act. At the certification hearing, the Government of Canada argued that the Privacy Commissioner's finding should be enough to satisfy everyone harmed by the breach, but the Court noted that the Commissioner can't award any of the damages sought by the plaintiffs.

Full disclosure: My firm is one of the firms representing the plaintiffs.

From the firms' media release:

Federal Court certifies privacy class action by Medical Marijuana patients against Health Canada

FOR IMMEDIATE RELEASE - July 28, 2015

The Federal Court of Canada has certified a class action commenced on behalf of more than 40,000 medical marijuana licensees alleging that Health Canada violated their privacy.

In November 2013, Health Canada sent notices to over 40,000 participants of the Marihuana Medical Access Program (MMAP) to advise of changes to regulations governing the use of medical marijuana in Canada. The notices were delivered in oversized envelopes that had the words “Health Canada - Marihuana Medical Access Program” on the return address, revealing to anyone who saw the envelope that the recipient was licensed to possess or produce medical marihuana for medical purposes. Previously, Health Canada’s mailings to MMAP members were discreet and made no mention of marijuana on the envelopes. Despite the Government of Canada’s acknowledgement of the error, it insists that no one was harmed by the breach.

In March 2015, the Office of the Privacy Commissioner of Canada concluded that Health Canada violated federal privacy laws. However, in the recent certification decision, the Court found that the class action is necessary to provide access to justice because the Privacy Commissioner cannot order the Government of Canada to compensate class members harmed by the breach. The Government has 30 days to appeal the certification decision.

McInnes Cooper, Branch MacMaster LLP, Charney Lawyers, and Sutts Strosberg LLP are jointly representing the plaintiffs in the medical marijuana privacy breach class action filed in the Federal Court against the Government of Canada. The plaintiffs seek damages for breach of contract, breach of confidence, invasion of privacy and Charter violations.

“We are very glad to see this case moving forward. The certification decision means that the Court has agreed that this is an appropriate case for a class action and that allowing all of the class members to proceed in a group is in the interests of justice,” said Ward Branch of Branch MacMaster LLP. “The Government of Canada has fought us at every turn, but have also lost each motion to date. We are hopeful that they will now see the wisdom of sitting down to resolve the issues created by this error.”

“This is not over yet, but the thousands of affected program members should take some comfort that every legal claim we advanced on their behalf has been approved to go forward,” said David Fraser of McInnes Cooper.

“As citizens of this great country, we rely on our government to protect our sensitive personal information from being disclosed and to protect our privacy during all communications. This decision sends a clear message to the government that our Courts consider privacy to be of the utmost importance and expect our government to take its privacy obligations seriously or face the consequences,” said Ted Charney of Charney Lawyers.

“Over one thousand people have registered on our secure website to tell us how the breach affected them. We will continue to pursue justice for those harmed by the breach,” said David Robins of Sutts, Strosberg LLP.

While it is not necessary to “opt in” to participate in the class action, class members are urged to visit the www.marijuanaclassaction.com website to obtain updates and to register because the information collected on the secured site will assist class counsel in communicating with class members and moving the case forward. Those who have already registered do not need to re-register but should update their information if their circumstances change or to report further harm suffered from the breach.

- 30 -

About Branch MacMaster LLP

Branch MacMaster LLP is a boutique litigation law firm established in 1998 and located in Vancouver, British Columbia. The firm focuses on class actions, health, insurance, and personal injury. The firm provides responsive, flexible, and cost-effective service to their clientele.

About Charney Lawyers

Charney Lawyers is a Toronto, Ontario firm with an established reputation for excellence in advocacy. The firm is experienced in personal injury, class proceedings, commercial litigation, insurance defence, employment law, medical malpractice, food borne illness, construction law and appeals.

About McInnes Cooper

McInnes Cooper is among the top business and litigation law firms in Canada, with more than 200 lawyers in seven Canadian offices, serving clients across North America and abroad. The firm is a market leader in energy and natural resources, business, litigation, employment, tax, real estate and insurance law. McInnes Cooper is the exclusive member firm in Newfoundland, New Brunswick, Nova Scotia and Prince Edward Island for Lex Mundi – the world’s leading network of independent law firms with in-depth experience in 100+ countries worldwide.

About Sutts Strosberg LLP

Sutts, Strosberg LLP is a nationally recognized law firm committed to excellence in litigation, with offices in Windsor and Toronto. The firm has a special interest in class actions, having represented groups or classes of individuals in every province and territory, and in every level of court, and is experienced in complex civil and commercial disputes, corporate, commercial and financial transactions, medical malpractice cases, personal injury cases, family law and criminal law.

For more information or to request an interview, please contact:

Ashley LeCroy
Manager, Marketing & Communications
902.457.5667
media@mcinnescooper.com

For more background, check out these previous posts.

Court of Appeal finds negligence and breach of confidence claims should go forward in privacy class action against the Federal Government

The Federal Court of Appeal in Condon v Canada, 2015 FCA 159 (not yet available on CanLII but here as a Google Drive PDF), has reversed a lower court decision to not certify claims of negligence and breach of confidence in the class action lawsuit that followed the Federal Government's loss of a hard drive containing personal information about 583,000 Canada Student Loan recipients.

The plaintiffs, in Condon v Canada, 2014 FC 250, sought certification under a number of causes of action, including breach of contract, intrusion upon seclusion (invasion of privacy), negligence and breach of confidence. Breach of contract and intrusion upon seclusion do not require damages for an individual to recover, and both of these causes of action were certified. Those that do require damages to succeed, negligence and breach of confidence, were not successful at the certification motion.

The Court of Appeal noted that the proper test for certification is only to review the pleadings and to not inquire into the evidence. Since the plaintiffs had pleaded damages, that should be determinative:

[13] As stated by the Supreme Court, the determination of whether the pleadings disclose a reasonable cause of action is to be based on the assumption that the facts as pleaded are true. This would mean that evidence is not to be submitted at the hearing of the motion. Otherwise, the hearing of the motion could turn into a full hearing on the merits.

[14] In this case, the parties submitted affidavit evidence. In paragraphs 68 and 69 of her reasons the Federal Court Judge noted that:

68 In addition, a summary review of the evidence adduced by both parties leads the Court to the conclusion that the Plaintiffs have not suffered any compensable damages. The Plaintiffs have not been victims of fraud or identity theft, they have spent at most some four hours over the phone seeking status updates from the Minister, they have not availed themselves of any credit monitoring services offered by the credit reporting agencies nor have they availed themselves of the Credit Flag service offered by the Defendant.

69 Nor does the evidence adduced support a claim for increased risk of identity theft in the future. Since the Data Loss, Equifax has produced reports pertaining to the credit files of the 88,548 individuals who availed themselves of the Credit Flag service. These reports show that there had been no increase in the relevant indicia that would be consistent with an increase in criminal activities involving those individuals' Personal Information. The rate of criminal activities registered was not higher than the 3% of the population generally victim of identity theft. Moreover, the Plaintiffs submitted a CBC news article concerning a Class Member who had been a victim of identity theft yet the article noted no proven causal link between the Data Loss and that theft.

[15] It appears that the Federal Court Judge evaluated the evidence in concluding that the Appellants had not suffered any “compensable damages”. The determination of whether the Appellants had a reasonable cause of action in negligence or breach of confidence should have been made based on the facts as pled, not on the evidence adduced in support of the motion.

…

[22] Reading the Consolidated Statement of Claim with this principle in mind, the Appellants have claimed that they have suffered damages and they have identified the nature of the damages that they are claiming. In particular, the Appellants have claimed special damages for “costs incurred in preventing identity theft” and “out-of-pocket expenses” and, as noted above, it is to be assumed that these costs have been incurred. As a result there was no basis to not include the claims for negligence and breach of confidence as part of the class proceeding.

The Federal Court of Appeal has sent the matter back to the trial level for determination, including the claims for negligence and breach of confidence and to determine the common questions in the class proceeding in relation to those claims.

Newfoundland Supreme Court considers privacy class action, clears first hurdle to certification

The Supreme Court of Newfoundland and Labrador this week considerd the first part of a bifurcated application to certify a class action in Hynes v. Western Regional Integrated Health Authority, 2014 NLTD(G) 137. The cases arose from inappropriate browsing of personal health records by an employe of the defendant health authority. The application was split into two parts and the first focused on whether the pleadings disclosed a cause of action.

The court agreed that the case could proceed on the basis of the following causes of action:

• breach of privacy based on statutory tort established under the Privacy Act;
  
• breach of privacy based on common law tort (“intrusion upon seclusion”);
  
• negligence; and
  
• breach of contract.

What's remarkable is that Newfoundland already has a statutory tort of invasion of privacy under the Privacy Act. This case stands for the proposition that the existence of the statutory invasion of privacy law does not preclude the existence of the common law "intrusion upon seclusion" tort as described in Jones v Tsige. This is the opposite of the repeated holdings of the courts of British Columbia, where courts have held that the provincial Privacy Act means that the common law tort does not exist there. (See: No common law tort of invasion of privacy in British Columbia, judge finds.)

Ontario provincial health privacy law does not pre-empt invasion of privacy claim in tort

The Ontario Superior Court in Hopkins v. Kay, 2014 ONSC 321 (CanLII) has concluded that the Personal Health Information Protection Act does not pre-empt a claim for "intrusion upon seclusion" against a hospital and its employees for unlawfully perusing personal health records:

[29] While it is argued by counsel for the Hospital that Jones dealt with Federal privacy legislation (“PIPEDA”), it is equally clear to me that Sharpe J.A. conducted a review of other similar legislation and specifically referred in his decision to PHIPA. At paragraphs 47-51, however, and again at paragraphs 52-54, there can be no doubt that Sharpe J.A. was well aware of the provisions of PHIPA and the potential impact of recognizing a common law tort of breach of privacy. In dealing with whether or not the legislation had occupied the field, the comments of Justice Sharpe at paragraph 54 are particularly apropos when he states:

Significantly, however, no provincial legislation provides a precise definition of what constitutes an invasion of privacy. The courts and provinces with a statutory tort are left with more or less the same task as courts and provinces without such statutes. The nature of these acts does not indicate that we are faced with a situation where sensitive policy choices and decisions are best left to the legislature. To the contrary, existing provincial legislation indicates that when the legislatures have acted, they have simply proclaimed a sweeping right to privacy and left it to the courts to define the contours of that right.

[30] I am not satisfied from a review of Jones that it should be, as suggested by counsel for the Hospital, restricted to the facts of that case. Rather, I am of the view that the Court of Appeal in Jones has determined that the common law right to proceed with a claim, based on the tort of breach of privacy, as alleged in the plaintiff’s statement of claim is a claim that should be allowed to proceed. This is not a case that, in my view, is so plain and obvious that the court should strike out the claim. If the position of the Hospital is to be sustained, it will require a decision of the Court of Appeal, which as the British Columbia Court of Appeal has done, determines that there is no claim for breach of privacy and that the claim must rest on the provisions of PHIPA. The defendants’ motion is therefore dismissed with costs.

Thanks to Barry Sookman for pointing this case out ...

Breach of privacy case allowed to proceed Hopkins v. Kay, 2014 ONSC 321 (CanLII) http://t.co/PUEQlK73by

— Barry Sookman (@bsookman) February 15, 2014

No common law tort of invasion of privacy in British Columbia, judge finds

This probably shouldn't be too surprising for lawyers practicing in this area, but a judge of the British Columbia Supreme Court has stated that there is no common law tort of invasion of privacy in the province. In Demcak v. Vo, 2013 BCSC 899, the plaintiffs were suing the City of Richmond (among others) related to an inspection of the property carried out under provincial law and municipal authority:

[10] The City has a statutory authorization to enter and inspect property including residences and uses of property within the City boundaries. That statutory authorization is provided for in s. 16 of the Community Charter, S.B.C. 2003, c. 26. The City may also attend pursuant to relevant enacted bylaws. The consent of the occupants is not required where valid written notice of the inspection is given. This occurred in the case at bar.

The inspectors entered the premises and took photos. The plaintiff claimed for trespass and some sort of "invasion of privacy". The plaintiff, notably, did not make any claims under the British Columbia Privacy Act, which creates a statutory right of action for invasion of privacy. The Court found that there was no common law tort of invasion of privacy and struck the claim from the plaintiff's pleadings.

[8] The issue which arises from these allegations is whether there is a tort for breach of privacy in British Columbia. No common law tort of invasion or breach of privacy exists in British Columbia: Hung v. Gardiner, 2002 BCSC 1234 (CanLII), 2002 BCSC 1234 at para. 110 aff’d 2003 BCCA 257 (CanLII), 2003 BCCA 257 and Bracken v. Vancouver Police Board, 2006 BCSC 189 (CanLII), 2006 BCSC 189 at para. 28. The plaintiffs are not represented by counsel, and notwithstanding they appear to have received legal advice, the claim as filed is ill founded.

[9] A breach of privacy is actionable under statue in British Columbia pursuant to the Privacy Act, R.S.B.C. 1996, c. 373 (“Privacy Act”). The plaintiffs made no pleadings regarding the Privacy Act. The pertinent sections to the case at bar are:

Violation of privacy actionable

1 (1) It is a tort, actionable without proof of damage, for a person, wilfully and without a claim of right, to violate the privacy of another.

(2) The nature and degree of privacy to which a person is entitled in a situation or in relation to a matter is that which is reasonable in the circumstances, giving due regard to the lawful interests of others.

(3) In determining whether the act or conduct of a person is a violation of another's privacy, regard must be given to the nature, incidence and occasion of the act or conduct and to any domestic or other relationship between the parties.

(4) Without limiting subsections (1) to (3), privacy may be violated by eavesdropping or surveillance, whether or not accomplished by trespass.

Exceptions

2 (1) In this section:

"court" includes a person authorized by law to administer an oath for taking evidence when acting for the purpose for which the person is authorized to take evidence;

"crime" includes an offence against a law of British Columbia.

(2) An act or conduct is not a violation of privacy if any of the following applies:

(a) it is consented to by some person entitled to consent;

(b) the act or conduct was incidental to the exercise of a lawful right of defence of person or property;

(c) the act or conduct was authorized or required under a law in force in British Columbia, by a court or by any process of a court;

(d) the act or conduct was that of

(i) a peace officer acting in the course of his or her duty to prevent, discover or investigate crime or to discover or apprehend the perpetrators of a crime, or

(ii) a public officer engaged in an investigation in the course of his or her duty under a law in force in British Columbia,

and was neither disproportionate to the gravity of the crime or matter subject to investigation nor committed in the course of a trespass.

...

[10] The City has a statutory authorization to enter and inspect property including residences and uses of property within the City boundaries. That statutory authorization is provided for in s. 16 of the Community Charter, S.B.C. 2003, c. 26. The City may also attend pursuant to relevant enacted bylaws. The consent of the occupants is not required where valid written notice of the inspection is given. This occurred in the case at bar.

[11] The owner of a rented residential property or landlord has the right to inspect that property as provided in s. 29(1) of the Residential Tenancy Act, S.B.C. 2002, c. 78. Again, clear written notice of the inspection was given to the plaintiffs more than 24 hours before the inspection according to the filed documents.

[12] On the facts of the case now before me, the inspections of the property, including the residences or vehicles thereon, were authorized by law. These inspections are outside the scope of the tort created by s. 1 of the Privacy Act. As there is no common law tort of privacy in BC, the claims contained in para. 13 of the present notice of civil claim are without legal foundation and cannot hope to succeed. The claims in that paragraph are dismissed.

It is worth noting that the Court didn't go into any detailed analysis of the issue, but it is clear to me that what was complained-of did not fit within the tort set out in the Privacy Act, nor would it be actionable as an intrusion upon seclusion under the Jones v Tsige tort.

Alberta Court says claims for invasion of privacy must go to Commissioner first

In the recent case of Martin v. General Teamsters, Local Union No. 362, 2011 ABQB 412, the Alberta Court of Queen's Bench struck a portion of a plaintiff's statement of claim related to invasion of privacy, holding that the plaintiff must first complain to the Information and Privacy Commissioner before appearing in court:

Paragraph Nine

[43] It is alleged:

On or about June 2009 and again on or about August 24, 2009 Bernie Haggarty, Business Agent for the Defendant violated my rights with regards to the release of private medical information without first obtaining written consent.

[44] Bernie Haggarty has filed an Affidavit in response to this allegation denying that he improperly released any private medical information of the Plaintiff as alleged or at all, and showing the circumstances of his involvement in efforts to allow the Plaintiff’s employer to evaluate whether or not it accommodate the injury restrictions of Ms. Martin. He deposes that Ms. Martin was present when he sent the information and that he did so wholly with her consent.

[45] This claim appears to be one of invasion of privacy. In Bank of Montreal v. Cochrane, [2010] A.J. No. 1210, Kent, J. discussed claims for breach of privacy, paras. 6, 7 and 8:

6 The second arguable claim is for breach of privacy. BMO first says that if there is a statutory claim for breach of privacy both provincial and federal legislation require certain conditions to be met before a claim can be brought before a court: see Personal Information Protection Act,S.A. 2003, c.P-6.5 and Personal Information Protection and Electronics Documents Act, S.C. 2000, c.5, ss.14-15. These preconditions have not been met.

7 If the pleading claims a common law claim for breach of privacy, BMO argues that there is no such claim: Mohl v. University of British Columbia,[2009] B.C.J. No. 1096 (B.C.C.A.). BMO also argues that the litigation process is intended to be a public process so that anything contained in pleadings cannot be a breach of privacy.

8 I agree with BMO.

[46] In the case referenced by Justice Kent of Mohl v. University of British Columbia, the B.C. Court of Appeal noted at para. 13, “there is no common law claim for breach of privacy”.

[47] If a claimant wishes to make a claim for damages arising from a breach of privacy, the Personal Information Protection Act, S.A. 2003, c.P-6.5requires a claimant to proceed with his or her claim before the Commissioner appointed under that Act. If the Commissioner makes an Order under the Actagainst an organization, an individual affected by the Order then has a cause of action against the organization for damages for loss or injury that the individual has suffered as a result of the breach of the Act by the organization. (Para. 60 of the Act)

[48] Therefore, claims for a breach of privacy which have not first proceeded before the Commissioner cannot be heard by the Court. Further, the Affidavit evidence of Bernie Haggarty on this matter, uncontroverted by the Plaintiff, satisfies me that there is genuine issue to be tried. Paragraph 9 would be struck pursuant to Rule 3.68(a). However, on the uncontroverted evidence of Mr. Haggerty it is dismissed.

Court says there's no tort of invasion of privacy in Ontario

The Ontario Superior Court of Justice just released a decision today in Jones v. Tsige, 2011 ONSC 1475 (PDF), which states, clearly and without ambiguity that there is no free-standing tort of invasion of privacy in Ontario.

The facts involve a claim against an employee of a bank who reviewed the plaintiff's confidential banking records on at least 174 occasions. Whitaker J. canvassed a number of authorities, including the well-known case of Somwar v MacDonalds, but concluded that there is no such tort. The Court notes that the plaintiff had a remedy under PIPEDA:

In Ontario, it cannot be said that there is a legal vacuum that permits wrongs to go unrighted - requiring judicial intervention.

[54] More particularly here, there is no doubt that PIPEDA applies to the banking sector and Ms. Jones had the right to initiate a complaint to the Commissioner under that statute with eventual recourse to the Federal Court. For this reason I do not accept the suggestion that Ms. Jones would be without any remedy for a wrong, if I were to determine that there is no tort for the invasion of privacy.

[55] Notwithstanding the careful reasoning in Somwar and its adoption in Nitsopoulos, conclude that the decision of the Court of Appeal in Euteneier is binding and dispositivc of the question as to whether the tort of invasion of privacy exists at common law.

[56] I would also note that this is not an area of law that requires judge-made rights and obligations. Statutory schemes that govern privacy issues are, for the most part, carefully nuanced and designed to balance practical concerns and needs in an industry-specific fashion.

[57] I conclude that there is no tort of invasion of privacy in Ontario.

It will be interesting to see if this conclusion may be avoided if there is no remedy available under PIPEDA or any other statute. It'll also be interesting to see if it's appealed.

Major tip o' the hat to Dan Michaluk: No Invasion of Privacy Tort in Ontario « All About Information.

Nova Scotia Court of Appeal favours open courts over youth privacy in Facebook defamation case

Yesterday, the Nova Scotia Court of Appeal issued a decision (AB v Bragg Communications Inc, 2011 NSCA 26) denying a child-plaintiff's application to proceed in a defamation action under a pseudonym and to impose a publication ban on the defamatory materials. The case involves a fake Facebook profile created by an unknown person and the dissemination of defamatory messages via that profile. The plaintiff sought the court's assistance in tracking town the intended defendant based on the IP address. At the original hearing, the judge denied the application to proceed under a pseudonym, which was upheld by the Court of Appeal. In short, the open courts principle trumps her concerns.

Since I was one of the lawyers working for the young girl who sought the application, you should read Dan Michaluk's summary for an unbiased view: Nova Scotia CA Favours Open Courts Over Youth Privacy in Facebook Defamation Case « All About Information.

Tracking Internet miscreants

A growing portion of my practice is working with the litigators in my firm on cases of online torts, including defamation and harassment. This mainly involves working to track down people who do harmful things under a veil of supposed internet anonymity. This includes people who hide behind pseudonyms on chat boards and other internet fora while saying defamatory things in addition to the (apparently) growing problem of creating fake Facebook profiles in order to harass and bully others. We've dealt with similar situations involving online dating sites, where people have set up fake profiles in the names of the victims in order to harass them.

I'm not sure about the psychology behind this, but it certainly appears as though many people feel free to say things about others on the internet that they would never say in "public" or to the person's face. Others, bullies in particular, see the internet as a great place to extend their activities, often with very harmful results.

Some of the cases I've worked on have become well-publicized in this region, and I was asked by the Canadian Bar Association - New Brunswick Branch to present on the topic at their annual Mid-Winter Meeting. In case you're interested, below is a presentation on what sorts of tracks people leave online and how they can be assembled and used to try to identify otherwise unnamed defendants. In almost all cases, they involve applying to the court for Norwich orders, which is a form of order from the court to require a mostly uninvolved third-party to provide information that will lead to the identification of the actual defendant. The court, acting as the gatekeeper, needs to balance the interests of the plaintiff who is looking for a remedy against the interests of both the third party service provider and the unnamed defendant. In short, the court should not allow a fishing expedition, nor should it allow the disclosure if the claim is not reasonably well established. Only if the plaintiff is able to satisfy the following test will the court order disclosure:

(1) the applicant must establish a bona fide claim against the unknown alleged wrongdoer;

(2) the third party against whom discovery is sought must be in some way connected to or involved in the misconduct;

(3) the third party must be the only practical source of the information available to the applicant;

(4) the third party must be reasonably compensated for expenses and legal costs arising out of compliance with the discovery order; and

(5) the public interest in favour of disclosure must outweigh the legitimate privacy interests.

Here is the presentation I gave to the Canadian Bar Association New Brunswick's Mid-Winter Meeting:

https://docs.google.com/present/view?id=ddpx56cg_379fgxwmgd4&interval=60

Here are a couple of notable reported cases where we have been successful in obtaining information from third party service providers to identify defendants:

• A.B. v. Bragg Communications Inc., 2010 NSSC 215
• Mosher v. Coast Publishing Ltd., 2010 NSSC 153

Mirror, mirror on the web

This week's Lawyers Weekly quotes me in an article by donalee moulton on monitoring and protecting your online defamation. See: Mirror, mirror on the web.

The Slow Demise of Defamation and the Privacy Torts

Daniel Solove at Concurring Opinions has some interesting thoughts on the progressive demise of defamation and privacy tort cases in the United States:

Concurring Opinions - The Slow Demise of Defamation and the Privacy Torts

I think this turn of events is unfortunate. People used to resort to self-help (violence and duels) to vindicate their reputations. Civilized society replaced these methods with a more humane alternative — using the court system to resolve disputes. Sadly, that method is increasingly becoming too expensive and cumbersome for people to use.

Some commentators argue that today, people can more readily have the record corrected or improve their reputations by posting good things about themselves online. But it is hard to manipulate Google and other search engines to make the good information crowd out the bad. The problem is that bad information is often more interesting and juicy — and hence more popular. And popularity is the key to getting information to the top of search engine results. Many people have short attention spans and don’t care to dig to find out the boring truth or other facts about a person.

We need to have an outlet in civilized society for people to vindicate their reputations. We need to have some meaningful way to prevent defamation and invasion of privacy. Otherwise, people will spread all sorts of damaging rumors and gossip about each other online, and victims will return to self-help methods. That would be a big step backwards.

I don't have any Canadian stats at my fingertips, but I would hazard a guess that defamation is flourishing in Canada while the privacy torts are stuck in neutral.

Quebec movie theatre ordered to pay $10K in damages for bag search

According to CTV News, a Quebec movie theatre is liable for $10,000 in damages when it searched a family's bags (ostensibly for video recording equipment) and exposed the eldest daugther's birth control pills to her unknowing parents. See: CTV.ca Cinema ordered to pay $10K in damages for search.

(Before extending this decision to the rest of Canada, remember that the private right of damages for privacy invasion is different in Quebec.)

English case looks under the hood of Facebook in privacy case

A colleague just brought to my attention a case handed down yesterday by the High Court of Justice (Queen's Bench Division) of England & Wales: Applause Store Productions Ltd. & Anor v Raphael [2008] EWHC 1781 (QB) (24 July 2008).

The case relates to the misuse of private information and defamation. The defendant in this case had set up a false Facebook profile in the name of the plaintiff and established a Facebook group that was, shall we say, not flattering of the plaintiff. The court found in favour of the defendant on both claims.

What's additionally interesting is the detail with which the Court reviews the logging data generated by Facebook and provided to the Court. The case is an interesting read for privacy issues, but also is a good chance to look under the hood of Facebook, forensically speaking.

Boring lawsuit over Google's "Street View"

(I couldn't resist.)

Mr. and Ms. Boring of Pittsburgh is suing Google for intentional invasion of privacy since Google's Street View feature shows a picture of the home despite the fact that their street is marked as a private road. The Smoking Gun has the facts and their pleadings:

Couple Sues Google Over "Street View" - April 4, 2008

APRIL 4--A Pittsburgh couple is suing Google for invasion of privacy, claiming that the web giant's popular "Street View" mapping feature has made a photo of their home available to online searchers. Aaron and Christine Boring accuse Google of an "intentional and/or grossly reckless invasion" of their seclusion and privacy since they live on a street that is "clearly marked with a 'Private Road' sign," according to a lawsuit the couple filed this week in Allegheny County's Court of Common Pleas. A copy of the April 2 complaint can be found below. According to the Borings, they purchased their Oakridge Lane home in late-2006 for "a considerable sum of money," noting that a "major component of their purchase decision was a desire for privacy." But when Pittsburgh was added last October to the roster of cities covered by Google's "Street View" feature, the Borings allege, their "private information was made known to the public," causing them "mental suffering" and diminishing the value of their home (which cost the couple $163,000, according to property records). The Borings are seeking in excess of $25,000 in damages and want a court order directing Google to destroy images of their home. Click here for some photos of the Boring property, which is now even easier to locate via Google Maps, since the plaintiffs included their home address on the lawsuit's first page. And while they are litigating, perhaps the Borings should consider suing Allegheny County's Office of Property Assessments, which includes a photo of their home (which was built in 1916 and sits on 1.82 acres) on its web site. Here's a screen grab. (8 pages)

If you look at the pictures of their property, you might think that if the Borings were concerned about their privacy they would have put a fence around their pool. I'm just saying ...

UPDATE (2008.04.06): The Wall Street Journal's Law Blog has a response from Google:

There is no merit to this action. It is unfortunate litigation was chosen to address the concern because we have visible tools, such as a YouTube video, to help people learn about imagery removal and an easy-to-use process to facilitate image removal.

As a matter of policy, imagery for Street View is taken in public streets and what any person can readily capture or see in the public domain. Street View is a popular, engaging feature that allows people to easily find, discover, and plan activities relevant to a location.

What's most interesting -- at least from my perspective -- is that this argument doesn't hold much water in Canada. Up here, there are two different privacy laws. There is some caselaw that's similar to tort law in the US suggesting that you can sue for invasion of privacy, if there's been an "unreasonable invasion of privacy". In the US, there is no expectation of privacy in the streets or in a public place and, other than in Quebec, that's probably the law in Canada. The second law is PIPEDA, which is a separate statute that governs all collection, use and disclosure of personal information in connection with commercial activity. Since Google's doing commercial activity, the law requires consent for the collection and disclosure of personal information. (There's some serious doubt that the photo of your house without any other information would be your personal information.) Since street view often includes photos of people, Google would require consent to use those photos for commercial purposes. Since the Google street sweepers do not get consent, there's no easy way to have street view in Canada.

I expect that Google will have technology to blur out individuals so they can take street view to Canada and other jurisdictions where privacy laws would prohibit photos of pedestrians.

More on Facebook and defamation

Not much of a privacy angle here, but I thought I'd post it nevertheless.

I was interviewed yesterday by the CBC to talk generally about issues related to defamation and Facebook, after it was reported that Facebook has shut down a group that falsely accused a Nova Scotia university of using dogs for scientific experiments.

Here's the video:

Substantial potential economic losses don't cut

A plaintiff seeking compensation for having personal information compromised has to face the hurdle of needing to prove damages. Under a conventional cause of action for negligence, harm is an essential element. If there is no harm, there's no negligence. No negligence, no cash. Just a risk of harm or an increased risk of harm is not enough.

This was recently affirmed by a US federal appeals court, which denied a class action brought following the release of personal information of customers of Old National Bancorp. See Wired's coverage:

Threat Level - Wired Blogs

Tens of thousands of Old National Bancorp customers whose personal and financial information was hijacked by a computer hacker cannot recover damages from the Indiana banking institution who lost the data in 2005, a federal appeals court ruled Thursday.

In dismissing a proposed class action against Old National Bancorp, the 7th U.S. Circuit Court of Appeals said damages were unavailable to victims of data theft if those victims did not suffer economically.

The three-judge panel of the circuit, mirroring decisions of federal courts in Ohio, Minnesota, Arizona and Michigan, ruled (.pdf): "Without more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy."

The plaintiffs did not allege direct financial loss and did not claim they had been the victim of identity theft. They alleged they suffered "substantial potential economic damages" and demanded compensation for emotional harm out of fear they would suffer economic damages by those who stole their information.

The bank's customers also demanded a "monitoring procedure to insure prompt notice to plaintiffs of any attempt to use their confidential personal information stolen from the defendants."

The appeals court also ruled that the law in Indiana, where the bank is located, did not protect the customers either.

"Had the Indiana Legislature intended that a cause of action should be available against a database owner for failing to protect adequately personal information, we believe that it would have made some more definite statement of that intent," the court wrote.

The court added that the plaintiffs "have not come forward with a single case or statute, from any jurisdiction, authorizing the kind of action they now ask this federal court, sitting in diversity, to recognize as a valid theory of recovery under Indiana law."

The court noted that the investigation into the security breach was under seal. But the judges added that "the scope and manner of access suggests that the intrusion was sophisticated, intentional and malicious."