This is the second in multi-part series of postings looking back at the year 2010 in privacy in Canada. (For an overview of legislative changes, see: Canadian Privacy Law Blog: Privacy year in review (2010): Legislation.)
Court Cases
State Farm Mutual Automobile Insurance v Office of the Privacy Commissioner, 2010 FC 736
This case arose out of a series of complaints brought by one plaintiff’s counsel in New Brunswick against a number of insurers. In this particular case, the plaintiff in a motor vehicle accident lawsuit demanded access to all of the personal information held by insurer, including documents said to be privileged. The insurer had already, as part of the litigation discovery process, provided all non-privileged documents to the plaintiff. Nevertheless, the plaintiff complained to the Office of the Privacy Commissioner of Canada.
When the OPC came knocking, the insurer (through its counsel – yours truly) said it had provided all relevant information but in any event, the OPC was without jurisdiction to investigate and to demand further documents. The basis of this argument was that the information was not collected, used or disclosed in the course of commercial activity, which is the basis for jurisdiction under PIPEDA.
The OPC never issued a finding in this file, but the Commissioner’s investigator did say that the OPC had concluded that she had jurisdiction.
The insurer said that New Brunswick courts had jurisdiction over matters of New Brunswick litigation, which began an odyssey through the New Brunswick courts until the Court of Appeal said it belonged in the Federal Court. A subsequent hearing and decision in the Federal Court found that the Insurer is an agent for the insured and was not engaged in commercial activity when defending its insured.
In particular, the Court said:
I conclude that, on a proper construction of PIPEDA, if the primary activity or conduct at hand, in this case the collection of evidence on a plaintiff by an individual defendant in order to mount a defence to a civil tort action, is not a commercial activity contemplated by PIPEDA, then that activity or conduct remains exempt from PIPEDA even if third parties are retained by an individual to carry out that activity or conduct on his or her behalf. The primary characterization of the activity or conduct under PIPEDA is thus the dominant factor in assessing the commercial character of that activity or conduct under PIPEDA, not the incidental relationship between the one who seeks to carry out the activity or conduct and third parties. In this case, the insurer-insured and attorney-client relationships are simply incidental to the primary non-commercial activity or conduct at issue, namely the collection of evidence by the defendant Ms. Vetter in order to defend herself in the civil tort action brought against her by Mr. Gaudet.
Since this case, the OPC has changed how it deals with access claims that raise privilege claims during litigation so that it declines to investigate, leaving it to the court where the matter is seized to determine privilege claims.
Privacy Commissioner of Canada v. Air Canada, 2010 FC 429
This case, handed down in April 2010, was another fight over privileged information. An applicant sought access to documents that Air Canada claimed to be privileged. The Commissioner demanded that Air Canada provide an affidavit setting out the basis for the privilege claims, which the company refused to do. It maintained that the information it has provided in previous correspondence was sufficient.
The Federal Court concluded that the Commissioner cannot require evidence to substantiate privilege claims:
[55] I see nothing in PIPEDA which would require Air Canada to disclose discoverable facts which are contained in a privileged document, other than in court proceedings. These facts were put at the disposal of its solicitors for legal advice. Indeed, Blank, above, is instructive. The Access to Information Act also denies production of privileged documents. That being said, section 49 provides that the Court may, nevertheless, order the production of the record or part thereof. The Motions Judge, in a judgment reported at [2000] F.C.J. No. 1147 (QL), ordered that some facts be severed from privileged documents and be made available to the applicant. The Crown did not appeal. In Mr. Blank’s appeal, Madam Justice Sharlow went out of her way to state at paragraph 22:The instances in which partial disclosure was ordered fall into two categories. In one category, disclosure was ordered of certain statements in the communication that were purely factual. It is arguable that those factual statements should not have been ordered disclosed because in each case they are inextricably linked to the legal issue under discussion that they ought to be treated as part of the privileged communication. To that extent, there may have been over-disclosure of some privileged documents. However, as the Minister has not cross-appealed, the order of the Judge will not be varied on that account.
Randall v. Nubodys Fitness Centres, 2010 FC 681
This case arose because of a disclosure of the applicant’s personal information by a health club to the applicant’s employer. The employer subsidised gym memberships and the gym disclosed to the employer how often employees visited the gym.
The applicant complained to the Privacy Commissioner and then took the matter to the Federal Court, seeking $85,000 damages.
The Court found that the disclosure was minimal and caused no injury:
[55] Pursuant to section 16 of the PIPEDA, an award of damages is not be made lightly. Such an award should only be made in the most egregious situations. I do not find the instant case to be an egregious situation.[56] Damages are awarded where the breach has been one of a very serious and violating nature such as video-taping and phone-line tapping, for example, which are not comparable to the breach in the case at bar: Malcolm v. Fleming (B.C.S.C.), Nanaimo Registry No. S17603, [2000] B.C.J. No. 2400; Srivastava c. Hindu Mission of Canada (Québec) Inc. (Q.C.A.), 2001 CanLII 27966 (QC C.A.), [2001] R.J.Q. 1111, [2001] J.Q. no 1913.
[57] While the applicant asserts that he suffered damages in “retaliation” by his employer in the form of being subject to commentary in the workplace regarding his gym usage; the only employee to have to work extended hours on one occasion; reassignment to a different workstation; and fearing the loss of his job, I am not convinced that any of this is attributable to the actions of the respondent or that the respondent conducted itself in a high-handed manner towards the applicant nor did the respondent clearly cause the “injury” to the applicant which he alleges.
[58] I am of the view that the alleged breach of the PIPEDA was the result of an unfortunate misunderstanding on the part of the respondent with respect to the question of consent by subscribers to its corporate membership program which has now been resolved. I do not find that the breach was the result of any sort of malicious behaviour on the part of the respondent: Hill v. Church of Scientology of Toronto, 1995 CanLII 59 (S.C.C.), [1995] 2 S.C.R. 1130, [1995] S.C.J. No. 64, at para. 196, that would justify the award of damages, let alone aggravated or punitive damages, for the respondent’s conduct.
Stevens v. SNF Maritime Metal Inc., 2010 FC 1137
In this case, the applicant had apparently defrauded his employer. Another company, who was a party to the applicant’s conduct, disclosed information about the applicant’s actions to his employer. The employee was terminated and claimed damages against the other company for the resulting loss.
Court saw this as an end-run around any claims he might have against his employer and noted that damages are only available for breach of privacy, not for a case such as this:
[27] PIPEDA’s s. 14 right and s. 16 remedy is not a substitute for matters which are truly claims for wrongful dismissal. The Court must examine the real nature of the remedy claimed. Such claims as humiliation, loss of community support, diminution of standings and loss of income flowing therefrom (to name but a few) caused by breach of the Act fall within the statutory cause of action created by the Act. Claims for loss of income and similar loss due to termination of employment not caused by breach of the Act, do not.[28] The source of the Applicant’s complaint is the loss of his employment. He even claims for loss due to loss of a second job. But all of his loss claimed is tied directly to his termination for cause. While the termination might not have occurred if there had not been disclosure, the nexus to the claimed loss is termination of employment for which Stevens had, but gave up, the right to claim was unlawful.
[29] The PIPEDA right of action is not an end run on existing rights to damages. It is a right to a different type of damages claim – breach of the right to privacy.
[30] The Applicant’s claim, in excess of $148,000, is out of proportion to the privacy invaded. The information disclosed was not deeply personal or intimate. It was commercial and the type of information frequently spoken about in a social context.
Arcand v. Abiwin Co-operative Inc., 2010 FC 529
A general release signed to settle litigation also is a bar to a proceeding for damages under PIPEDA in the Federal Court related to matters raised in the litigation.
Nammo v. Transunion of Canada Inc., 2010 FC 1284
In this case, the self-represented applicant alleged that the credit bureau had violated the accuracy principle of PIPEDA and sought damages related to having been wrongfully denied a loan due to erroneous information in his credit file.
The court awarded $5000 in damages after considering the principles to be applied by the court in awarding damages under the statute.
[71] As indicated, PIPEDA provides the Court broad remedial powers and, in my view, s. 16 of PIPEDA permits the Court, in an appropriate case, to award damages even when no actual financial loss has been proven. In Randall v Nubodys Fitness Centres, 2010 FC 681, Justice Mosley found that an award of damages under s. 16 is not to be made lightly and that such an award should only be made “in the most egregious situations.” This is such a situation. In Randall, which involved the disclosure of how often the applicant used his gym membership to his former employer, Justice Mosley determined that the impugned disclosure of personal information was “minimal,” that there had been no injury to the applicant sufficient to justify an award of damages, that the respondent did not benefit commercially from the breach of PIPEDA, that the respondent did not act in bad faith, and, perhaps most importantly, that there was no link between the disclosure and the employer’s alleged retaliation against the applicant. The same cannot be said here. Not only was the disclosure of inaccurate information directly linked to the refusal of the loan and the associated injury to the applicant, but the respondent also profited from the disclosure and acted in bad faith in failing to take responsibility for its error and failing to rectify the problem in a timely manner. The violation of Mr. Nammo’s rights under PIPEDA was not “the result of an unfortunate misunderstanding,” as was the case in Randall. It was a serious breach involving financial information of high personal and professional importance. The fact that there is no precedent for an award of damages under PIPEDA should not impact the Court from making an award of damages where the circumstances and justice demands it. In my view, for the reasons that follow, this is such a case....
[74] The Supreme Court found that “to be ‘appropriate and just’, an award of damages must represent a meaningful response to the seriousness of the breach and the objectives of compensation, upholding Charter values, and deterring future breaches.” In my view, the same reasoning applies to a breach of PIPEDA, which is quasi-constitutional legislation.
[75] In Lavigne v Canada (Office of the Commissioner of Official Languages), 2002 SCC 53, the Supreme Court held that the Privacy Act, R.S.C.1985, c. P-21, was quasi-constitutional legislation that must be interpreted with its special purposes in mind. In Eastmond v Canadian Pacific Railway, 2004 FC 852, at para. 100, Justice Lemieux confirmed that PIPEDA also enjoys quasi-constitutional status:
I have no hesitation in classifying PIPEDA as a fundamental law of Canada just as the Supreme Court of Canada ruled the federal Privacy Act enjoyed quasi-constitutional status (see Justice Gonthier's reasons for judgment in Lavigne v. Canada (Office of the Commissioner of Official Languages, [2002] 2 S.C.R. 773 at paragraphs 24 and 25).[76] Applying the Supreme Court’s reasoning in Ward to PIPEDA applications before this Court indicates that both the question of whether damages should be awarded and the question of the quantum of damages should be answered with regard to whether awarding damages would further the general objects of PIPEDA and uphold the values it embodies. Furthermore, deterring future breaches and the seriousness or egregiousness of the breach would be factors to consider.
[77] One of the central objects of PIPEDA is to encourage those who collect, use and disclose personal information to do so with a degree of accuracy appropriate to the use to which the information is to be put and to correct errors quickly and effectively. I have found that TransUnion failed to collect accurate information on the applicant. Further, when apprised of its error, it failed to address the complaint quickly and effectively. It further failed to quickly and effectively correct the inaccurate information it had disseminated. Lastly, it failed to take responsibility for its error, first blaming CBV, and then in this action attempting to attribute some blame to the applicant. In my judgment, these are circumstances that warrant an award of damages based on the considerations of vindication and deterrence.
R. v. Gomboc, 2010 SCC 55
Police, without a warrant, obtained information about electricity consumption from a utility company and used that info to get a search warrant.
The Court considered that Alberta's Electrical Utilities Act and related Code of Conduct Regulation would have given the homeowner the ability to keep electricity consumption information confidential, but the homeowner did not opt out. The Court also noted that the utility was not a disinterested third party because the circumvention of the electricity meter meant that it was also being defrauded by the illegal consumption of electricity.
In the result, the Court concluded that the above factors combined with the specific language in the electricity services contract led to reduced expectation of privacy. The Information was not collected contrary to the Charter and was admissible.
