Privacy Commssioner says beneficiary access to estate information is limited to his own personal information under PIPEDA, bigger jurisdictional question not addressed

The Office of the Privacy Commissioner of Canada has released a new report of findings related to an individual's request of a law firm for information about his possible entitlement as a beneficiary of the estates of his mother and grandmother. (See: Commissioner’s Findings - PIPEDA Report of Findings #2013-005: Beneficiary’s access to estate information is limited to his own personal information under PIPEDA.)

The law firm initially ignored the applicant's request and the individual complained. From the summary:

Our investigation determined that the legal firm receiving the access request ought to have responded to the individual within the 30-day time limit allowed by PIPEDA, even if the firm did not hold any of his personal information.

As for the access rights of the individual, we determined that the individual was only entitled to obtain information held in connection with the estates that was specifically about him. We noted that it was far from clear how much of the requested information and documents (i.e., statements of accounts, money received and receipts of disbursements) would qualify as the individual’s personal information. In the circumstances, we were satisfied that the legal firm had carried out a reasonable search of its records for the individual’s personal information.

The Office of the Privacy Commissioner of Canada found that, given the firm’s initial failure to respond to the access request in a timely manner before eventually answering, the complaint was well-founded and resolved.

What I find particularly interesting in this case is the lack of any discussion about whether the Commissioner had jurisdiction to investigate in the first place. As was definitively decided in State Farm Mutual Automobile Insurance Company v. Privacy Commissioner of Canada, 2010 FC 736, PIPEDA only applies to the collection, use and disclosure of personal information in the course of "commercial activities". In State Farm, the court found that a claim for damages between to individual litigants before the courts was not a "commercial activity" even though an insurance company, a law firm and a private investigator were all involved. At its core, it was a personal matter and not a commercial one.

I would think that in the case of an estate, it is similarly not a "commercial activity" at all, even if a law firm is involved. There's no mention of the issue in the finding, so it's likely that this issue was never raised.

Federal cyberbullying legislation expected tomorrow

The CBC is reporting that the federal government plans to introduce its anti-cyberbullying bill in Parliament tomorrow.

The bill is expected to focus on the non-consensual distribution of intimate images, but keep a close eye out for an attempt to bring in new lawful access powers, as well.

Here's the CBC report: Cyberbullying legislation to be announced Wednesday - Nova Scotia - CBC News.

For my comments on the discussion paper that likely prompted this legislation: Throne speech calls for "new tools for law enforcement" against cyberbullying.

Update (2013-11-20) - Some details are beginning to emerge about the bill, which PostMedia is suggesting will be called the "Protecting Canadians from Online Crime Act" (echoes of Bill C-30's "Protecting Children From Online Predators Act", maybe?)

From PostMedia News:

Federal government to table bill aimed at combating cyberbullying | canada.com

The federal government is poised to table new legislation Wednesday, aimed at modernizing the Criminal Code and combating cyberbullying, Postmedia News has learned.

The bill, dubbed the Protecting Canadians from Online Crime Act, will, among other things, amend the Criminal Code and the Evidence Act.

While details of the bill have not been released, a key recommendation contained in a July report by federal, provincial and territorial justice and public safety ministers recommended making it a new Criminal Code offence to knowingly distribute sexually explicit photos of a person without their consent. It recommended the offence be punishable by as many as five years in prison.

Justice Minister Peter MacKay said at the time he would seriously consider the chief recommendation.

The report also called for new provisions that would allow judges to order intimate images removed from the Internet and the forfeiture of cellphones, computers and other equipment used in the commission of an offence.

It’s unlikely Wednesday’s bill will create new laws to specifically address bullying and cyberbullying as the report ultimately concluded “existing” Criminal Code offences like criminal harassment, uttering threats, intimidation, unauthorized use of a computer, extortion, defamatory libel and child pornography “generally cover most serious bullying behaviour.” ...

Supreme Court of Canada finds Alberta privacy law to be unconstitutional infringement of freedom of expression

The Supreme Court of Canada today released its decision in Information and Privacy Commissioner et al v. United Food and Commercial Workers, Local 401, 2013 SCC 62.

This decision has been anxiously awaited as it has far-reaching implications for privacy legislation throughout Canada, as the provisions at issue in Alberta’s private sector privacy law are mirrored in the federal and British Columbia legislation.

The case arose in the context of a labour dispute at one of Alberta’s casinos. Striking employees set up a picket-line and video recorded replacement workers as they crossed the line. Images from the recordings were later placed on posters displayed at the picket‑line and appeared in newsletters and leaflets available to union members and the public.

Complaints were filed with the appellant Information and Privacy Commissioner of Alberta under that province’s Personal Information Protection Act. An adjudicator appointed by the Privacy Commissioner held that PIPA prohibited the Union from collecting, using and disclosing such photos and recordings without the consent of the individuals in question (which was unlikely to be forthcoming). The Union took the position that such a finding was in infringement of freedom of expression and sought judicial review in the Court of Queen’s Bench. which found that parts of the legislation were unconstitutional as an unreasonable infringement of freedom of expression as guaranteed under the Charter of Rights and Freedoms. The Alberta Court of Appeal concurred, and found that the infringement could not be justified.

On appeal, the Supreme Court of Canada has found that the provisions in question unduly limit the union's ability to communicate its message to the public and to other interested parties and are thus contrary to Section 2(b) of the Charter. This limitation is not justifible, the Court found:

[25] The price PIPA exacts, however, is disproportionate to the benefits it promotes. PIPA limits the collection, use and disclosure of personal information other than with consent without regard for the nature of the personal information, the purpose for which it is collected, used or disclosed, and the situational context for that information. As the Adjudicator recognized in her decision, PIPA does not provide any way to accommodate the expressive purposes of unions engaged in lawful strikes. Indeed, the Act does not include any mechanisms by which a union’s constitutional right to freedom of expression may be balanced with the interests protected by the legislation. As counsel for the Commissioner conceded during oral submissions, PIPA contains a general prohibition of the Union’s use of personal information (absent consent or deemed consent) to further its collective bargaining objectives. As a result, PIPA deems virtually all personal information to be protected regardless of context.

[26] But the extent to which significant values were actually impaired in the context of this case must be kept in context. The personal information was collected by the Union at an open political demonstration where it was readily and publicly observable. Those crossing the picketline would reasonably expect that their image could be caught and disseminated by others such as journalists, for example. Moreover, the personal information collected, used and disclosed by the Union was limited to images of individuals crossing a picketline and did not include intimate biographical details. No intimate details of the lifestyle or personal choices of the individuals were revealed.

[27] It goes without saying that by appearing in public, an individual does not automatically forfeit his or her interest in retaining control over the personal information which is thereby exposed. This is especially true given the developments in technology that make it possible for personal information to be recorded with ease, distributed to an almost infinite audience, and stored indefinitely. Nevertheless, PIPA’s restrictions operate in the context of a case like this one to impede the formulation and expression of views on matters of significant public interest and importance.

In the result, the provisions of PIPA were found to be unconstitutional and not justifiable. However, instead of striking down the provisions immediately and leaving a vacuum, the Court has suspended the declaration of invalidity for twelve months to allow the legislature to amend the legislation.

Because the provisions in question are effectively identical to those in British Columbia's privacy law and the Federal PIPEDA, it will be incumbent upon the BC legislature and the federal Parliament to make the same amendments to keep those laws constitutionally viable.

For previous blog posts on the case, click here and here's the headnote:

Constitutional law — Charter of Rights — Freedom of expression — Labour relations — Privacy — Union video‑taping and photographing individuals crossing its picket line for use in its labour dispute — Whether legislation restricting the collection, use and disclosure of personal information violates union’s expressive right under s. 2(b) of Charter and, if so, whether violation is justified — Canadian Charter of Rights and Freedoms, ss. 1, 2(b) — Personal Information Protection Act, S.A. 2003, c. P‑6.5 — Personal Information Protection Act Regulation, Alta Reg. 366/2003.

During a lawful strike lasting 305 days, both the Union and the employer video‑taped and photographed individuals crossing the picketline. The Union posted signs in the area of the picketing stating that images of persons crossing the picketline might be placed on a website. Several individuals who were recorded crossing the picketline filed complaints with the Alberta Information and Privacy Commissioner. The Commissioner appointed an Adjudicator to decide whether the Union had contravened the Personal Information Protection Act (PIPA). The Adjudicator concluded that the Union’s collection, use and disclosure of the information was not authorized by PIPA. On judicial review, PIPA was found to violate the Union’s rights under s. 2(b) of the Charter. The Court of Appeal agreed and granted the Union a constitutional exemption from the application of PIPA.

Held: The appeal is substantially dismissed.

PIPA establishes a general rule that organizations cannot collect, use or disclose personal information without consent. None of PIPA’s exemptions permit the Union to collect, use and disclose personal information for the purpose of advancing its interests in a labour dispute. The central issue is whether PIPA achieves a constitutionally acceptable balance between the interests of individuals in controlling the collection, use and disclosure of their personal information and a union’s freedom of expression. To the extent that PIPA restricts collection for legitimate labour relations purposes, it is in breach of s. 2(b) of the Charter and cannot be justified under s. 1.

The purpose of PIPA is to enhance an individual’s control over his or her personal information by restricting the collection, use and disclosure of personal information without that individual’s consent. The objective of providing an individual with this measure of control is intimately connected to individual autonomy, dignity and privacy, self‑evidently significant social values.

But the Act does not include any mechanisms by which a union’s constitutional right to freedom of expression may be balanced with the interests protected by the legislation. This Court has long recognized the fundamental importance of freedom of expression in the context of labour disputes. PIPA prohibits the collection, use, or disclosure of personal information for many legitimate, expressive purposes related to labour relations. Picketing represents a particularly crucial form of expression with strong historical roots. PIPA imposes restrictions on a union’s ability to communicate and persuade the public of its cause, impairing its ability to use one of its most effective bargaining strategies in the course of a lawful strike. This infringement of the right to freedom of expression is disproportionate to the government’s objective of providing individuals with control over the personal information that they expose by crossing a picket line. It is therefore not justified under s. 1 of the Charter.

Given the comprehensive and integrated structure of the statute, the Government of Alberta and the Information and Privacy Commissioner requested that the Court not select specific amendments, requesting instead that the entire statute be declared invalid so that the legislature can consider the Act as a whole. The declaration of invalidity is therefore granted but is suspended for a period of 12 months to give the legislature the opportunity to decide how best to make the legislation constitutionally compliant.

Google updates transparency report; US government requests for user information double over three years

Google has today updated its industry leading transparency report and is reporting that user data requests by the US government have doubled over the past three years. (For Canada, the numbers have roughly held steady.)

Richard Salgado, Google's Legal Director, Law Enforcement and Information Security, writes in the Google Public Policy Blog:

Google Public Policy Blog: Government requests for user information double over three years

In a year in which government surveillance has dominated the headlines, today we're updating our Transparency Report for the eighth time. Since we began sharing these figures with you in 2010, requests from governments for user information have increased by more than 100 percent. This comes as usage of our services continues to grow, but also as more governments have made requests than ever before. And these numbers only include the requests we're allowed to publish.

Over the past three years, we've continued to add more details to the report, and we're doing so again today. We're including additional information about legal process for U.S. criminal requests: breaking out emergency disclosures, wiretap orders, pen register orders and other court orders.

We want to go even further. We believe it's your right to know what kinds of requests and how many each government is making of us and other companies. However, the U.S. Department of Justice contends that U.S. law does not allow us to share information about some national security requests that we might receive. Specifically, the U.S. government argues that we cannot share information about the requests we receive (if any) under the Foreign Intelligence Surveillance Act. But you deserve to know.

Earlier this year, we brought a federal case to assert that we do indeed have the right to shine more light on the FISA process. In addition, we recently wrote a letter of support for two pieces of legislation currently proposed in the U.S. Congress. And we're asking governments around the world to uphold international legal agreements that respect the laws of different countries and guarantee standards for due process are met.

Our promise to you is to continue to make this report robust, to defend your information from overly broad government requests, and to push for greater transparency around the world.

We strongly believe that the Electronic Communications Privacy Act (ECPA) must be updated in this Congress, and we urge Congress to expeditiously enact a bright-line, warrant-for-content rule. Governmental entities should be required to obtain a warrant—issued based on a showing of probable cause—before requiring companies like Google to disclose the content of users' electronic communications.

Important decision on constitutionality of privacy legislation to be released by Supreme Court on Friday

Hot off the presses:

(For more background, check out posts tagged UFCW Case (Alberta).)

Supreme Court of Canada - Decisions

Supreme Court of Canada / Cour suprême du Canada

JUDGMENT TO BE RENDERED IN APPEAL

November 12, 2013
For immediate release

OTTAWA – The Supreme Court of Canada announced today that judgment in the following appeal will be delivered at 9:45 a.m. EST on Friday, November 15, 2013. This list is subject to change.

Information and Privacy Commissioner et al v. United Food and Commercial Workers, Local 401 (Alta.) (34890)

34890 Information and Privacy Commissioner v. United Food and Commercial Workers, Local 401 ‑ and between ‑ Attorney General of Alberta v. United Food and Commercial Workers, Local 401

Charter ‑ Freedom of expression ‑ Privacy law ‑ Labour relations ‑ Administrative law ‑ Privacy legislation prohibiting Respondent Union from collecting, using or disclosing images of individuals at or near a picket line during the course of a lawful strike ‑ Do the Personal Information Protection Act, S.A. 2003, c. P‑6.5 and the Personal Information Protection Act Regulation, Alta Reg. 366/2003 violate s. 2(b) of the Canadian Charter of Rights and Freedoms insofar as they restrict a union’s ability to collect, use or disclose personal information during the course of a lawful strike? ‑ If so, is the infringement a reasonable limit prescribed by law, which can be demonstrably justified in a free and democratic society under s. 1 of the Canadian Charter of Rights and Freedoms? ‑ What is the administrative tribunal’s role when its enabling legislation is the subject of a constitutional challenge and it does not have the power to decide the constitutional question?

The respondent union recorded video and took still photos of individuals located near and/or crossing a picket line during a lawful strike. Certain images collected by the union were subsequently placed on posters displayed at the picket‑line and appeared newsletters and leaflets available to union members and the public. Complaints were filed with the appellant Information and Privacy Commissioner of Alberta pursuant to the Personal Information Protection Act, S.A. 2003, c. P‑6.5 (“PIPA”). An adjudicator appointed by the Privacy Commissioner held that PIPA prohibited the Union from collecting, using and disclosing such photos and recordings without the consent of the individuals in question.

Origin of the case: Alberta

File No.: 34890

Judgment of the Court of Appeal: April 30, 2012

Counsel:

Roderick Wiltshire for the appellant Attorney General of Alberta

Glenn Solomon, Q.C. and Rob W. Armstrong for the appellant Information and Privacy Commissioner of Alberta

Gwen J. Gray, Q.C. for the respondent

Yes, you can photograph or video police in public in Canada

An interesting discussion on Reddit brought a new Ontario case to my attention that has a lot to say about the right of a member of the public to video or photograph police officers in a public place in Canada.

In R. v. Zarafonitis, 2013 ONCJ 570, the Court was considering the appropriate sentence for a police officer who pled guilty to using excessive force in arresting a photographer who was recording an altercation outside a crowded, noisy bar. The police arrested the individual with the camera for public intoxication, which was admitted to be justified, but used grossly disproportionate force when the photographer resisted and injured the man significantly. The man had been singled out and ordered by the officer to stop taking pictures:

While the noise investigation was ongoing in the restaurant, Mr. Farkas took pictures of Mr. Zarafonitis and another officer inside the restaurant. When Mr. Zarafonitis expelled a performer onto the street, Mr. Farkas followed them and tried to photograph the event. The scene outside the restaurant was noisy, with agitated restaurant patrons screaming and yelling at the officers; the crowd was drunk, aggressive and confrontational. Mr. Farkas stood on the sidewalk taking photographs and Mr. Zarafonitis told him to stop photographing and to leave the area. Mr. Farkas declined to leave, feeling he was entitled to continue taking photographs. Mr. Zarafonitis responded to the refusal by arresting Mr. Farkas for public intoxication under the Liquor Licence Act, an arrest that Mr. Zarafonitis believed to be valid.

The Court made some important observations about the right of the public to photograph police and the lack of justification for an officer to direct an individual to either move, leave the scene or stop photographing:

Police-citizen interaction typically involves a significant power imbalance. Just as judges should be hesitant to second-guess police decisions often made under stress without time for long reflection in back alleys late at night, we have to recognize that the citizen on the other side of that interaction, who may or may not have committed an offence and who is entitled to the protection of the rule of law, is also often alone in a back alley late at night. In the absence of an overarching and tangible safety concern, such as telling a photographer at a fire scene to back away if there is a danger that the building will collapse on him, telling people not to record these interactions, whether they be a bystander or the person the police are dealing with, is not a lawful exercise of police power. An officer who conducts himself reasonably has nothing to fear from an audio, video or photographic record of his interaction with the public. The public has a right to use means at their disposal to record their interactions with the police, something that many police services themselves do through in-car cameras and similar technology. The officer’s powers exist to allow him to protect the public and himself and to enforce the law; they do not extend to controlling the public record of what happened. The maintenance of that public record plays a significant role in the maintenance of the rule of law. The existence of this form of objective “oversight” has great potential to minimize abuses of authority and to maintain peaceable interaction between police and the citizenry, all of which is very much in the public interest. Interference by a police officer in the public’s exercise of that right is a significant abuse of authority.

Update: For further discussion on this topic, with lots of comments, check out: Canadian Privacy Law Blog: Photographing and filming police officers in Canada.

Computers should be treated as "separate places" for search warrant purposes, Supreme Court of Canada says

The Supreme Court of Canada just released its decision in R. v. Vu, 2013 SCC 60. The issue under appeal was whether police could search a computer that was seized pursuant to a warrant that did not specifically authorize the search of the computer.

I haven't had a chance to read the entire decision (the electrons are still warm), but the summary in the headnote is very interesting:

The traditional legal framework holds that once police obtain a warrant to search a place for certain things, they do not require specific, prior authorization to search in receptacles such as cupboards and filing cabinets. The question in this case is whether this framework is appropriate for computer searches. Computers differ in important ways from the receptacles governed by the traditional framework and computer searches give rise to particular privacy concerns that are not sufficiently addressed by that approach.

... The second issue is whether the warrant authorized the search of the computers and cellular phone. Section 8 of the Charter — which gives everyone the right to be free of unreasonable searches and seizures — seeks to strike an appropriate balance between the right to be free of state interference and the legitimate needs of law enforcement. This balance is generally achieved in two main ways. First, the police must obtain judicial authorization for a search before they conduct it, usually in the form of a search warrant. Second, an authorized search must be conducted in a reasonable manner, ensuring that the search is no more intrusive than is reasonably necessary to achieve its objectives. The privacy interests implicated by computer searches are markedly different from those at stake in searches of receptacles such as cupboards and filing cabinets. It is difficult to imagine a more intrusive invasion of privacy than the search of a personal or home computer. Computers potentially give police access to an almost unlimited universe of information that users cannot control, that they may not even be aware of, may have tried to erase and which may not be, in any meaningful sense, located in the place of search. The numerous and striking differences between computers and traditional receptacles call for distinctive treatment under s. 8 of the Charter. The animating assumption of the traditional rule — that if the search of a place is justified, so is the search of receptacles found within it — simply cannot apply with respect to computer searches.

In effect, the privacy interests at stake when computers are searched require that those devices be treated, to a certain extent, as a separate place. Prior authorization of searches is a cornerstone of our search and seizure law. The purpose of the prior authorization process is to balance the privacy interest of the individual against the interest of the state in investigating criminal activity before the state intrusion occurs. Only a specific, prior authorization to search a computer found in the place of search ensures that the authorizing justice has considered the full range of the distinctive privacy concerns raised by computer searches and, having done so, has decided that this threshold has been reached in the circumstances of a particular proposed search. This means that if police intend to search any computers found within a place they want to search, they must first satisfy the authorizing justice that they have reasonable grounds to believe that any computers they discover will contain the things they are looking for. If police come across a computer in the course of a search and their warrant does not provide specific authorization to search computers, they may seize the computer, and do what is necessary to ensure the integrity of the data. If they wish to search the data, however, they must obtain a separate warrant. In this case, the authorizing justice was not required to impose a search protocol in advance with conditions limiting the manner of the search. While such conditions may be appropriate in some cases, they are not, as a general rule, constitutionally required. [emphasis added]

Some thoughts on Chitrakar v. Bell TV and damage awards under Canadian privacy law

On Thursday I posted about the new Federal Court case of Chitrakar v. Bell TV (Canadian Privacy Law Blog: Federal Court chastises Bell for accessing customer credit file without consent; $21K in damages) and promised I'd provide some thoughts once I'd had an opportunity to read the decision.

I managed to get a copy of the decision (Chitrakar v. Bell TV, 2013 FC 1103 [Google Doc]) from the Federal Court yesterday and it provides a lot of food for thought and some important questions for practitioners of Canadian privacy law.

In this case, the Court awarded the Applicant $21,000 in total, broken down as $10,000 in general damages, $10,000 in exemplary damages and $1000 in costs. The award of exemplary damages is completely attributable to the Court's view of Bell's handling of the case. They gave him the "royal run-around" and did not even show up in Court to respond to the Applicant's allegations. The Court obviously was not impressed.

But what of the $10,000 in general compensatory damages? What was alleged is that Bell TV had done a credit inquiry on the Applicant without the full knowledge and consent of the Applicant. (The inquiry was made one month BEFORE the customer had signed any agreement with Bell.) The credit inquiry, in and of itself, may have a negative impact upon a consumer's credit rating. The Applicant was subsequently denied a loan, but it was not proved that this was attributable to Bell's credit inquiry. So, in the end, the Court awarded $10,000 for a credit inquiry without consent that may or may not have actually caused any harm or damage to the Applicant.

The Court's discussion of how the damage award was arrived at is interesting:

[24] The fixing of damages for privacy rights’ violations is a difficult matter absent evidence of direct loss. However, there is no reason to require that the violation be egregious before damages will be awarded. To do so would undermine the legislative intent of paragraph 16(c) which provides that damages be awarded for privacy violations including but not limited to damages for humiliation.

[25] Privacy rights are being more broadly recognized as important rights in an era where information on an individual is so readily available even without consent. It is important that violations of those rights be recognized as properly compensable.

[26] The Court must bear in mind such factors as meaningful compensation, deterrence and vindication (see Vancouver (City) v Ward, 2010 SCC 27, [2010] 2 SCR 28).

[27] In this case, Chitraker had his rights violated in a real sense with potentially adverse consequences. Bell is a large company for whom a small damages award would have little material impact. Chitraker spent a considerable period dealing with the Bell bureaucracy and in pursuing his claim. These factors suggest that a damages award should not be minimalistic.

The Court found his rights were violated and there may have been consequences (but this was unproven). The Court also found that given the size of Bell, a small damage award would have little material consequence. On this basis, the Court awarded $10,000.

Damage awards under PIPEDA have generally been modest, such as $5000 for an inaccurate credit report that resulted in a loan application being denied and $4500 for a bank sending a customer's records to the customer's soon-to-be ex-spouse following receipt of a subpoena. In many other cases, the courts have declined to award damages at all.

This can and should be contrasted to the Jones v Tsige case from the Ontario Court of Appeal. In that case, which was outside of PIPEDA and established the tort of "intrusion upon seclusion" in Ontario, the Court found that general damages for non-pecuniary loss for that tort would range up to $20,000 and fixed the damages payable at the middle of the range.

While these damage awards appear to remain modest in light of the size of the companies involved, one can easily see how this could multiply in connection with a class-action. If a company adopted a procedure under which hard credit inquiries are routinely carried out before the customer signs any contract, each of those customers may be essentially entitled to $10,000 in compensation. Though we have not yet seen a class-action lawyer devise a way to get a class of complainants through a Privacy Commissioner investigation (which is a pre-requisite for getting to the Federal Court), I am sure that day will come and companies should be mindful that a bad practice spread across a customer base may give rise to a very large cumulative liability.

Federal Court chastises Bell for accessing customer credit file without consent; $21K in damages

According to the CBC (I haven't found the decision yet), the Federal Court of Canada has called Bell "reprehensible" for accessing a customer's credit file without consent and then showing disdain for his complaint. According to the report, Bell didn't even show up to respond to the matter in Court. Here's the article: Bell TV 'reprehensible' for violating man's privacy - Nova Scotia - CBC News.

Once I've gotten my hands on the court decision, I'll post and link and provide comments.

Update: I don't have the decision yet, but from the Court's docket it is clear that the $21,000 is split between $10,000 in compensatory damages, "exemplary damages of $10,000 for Bell's conduct at the time of breach of the privacy rights and thereafter" and $1000 for disbursements and costs. Not a lot of cash for Bell Canada, but exemplary damages against a big telco is not common at all.

Update 2.0: Here is a copy of the decision Chitrakar v. Bell TV 2013 FC 1103[Google Doc].

[18] Bell’s conduct in this matter is reprehensible in respect to Chitraker’s privacy rights. Not only did Bell violate those rights, it has shown no interest in compensation or apparently any interest in addressing the CSR’s actions nor in following the Privacy Commissioner’s remedial recommendations. Its failure to appear in this Court is consistent with its disregard of Chitraker’s privacy rights.

In calculating damages, the Court had this to say:

[24] The fixing of damages for privacy rights’ violations is a difficult matter absent evidence of direct loss. However, there is no reason to require that the violation be egregious before damages will be awarded. To do so would undermine the legislative intent of paragraph 16(c) which provides that damages be awarded for privacy violations including but not limited to damages for humiliation.

[25] Privacy rights are being more broadly recognized as important rights in an era where information on an individual is so readily available even without consent. It is important that violations of those rights be recognized as properly compensable.

[26] The Court must bear in mind such factors as meaningful compensation, deterrence and vindication (see Vancouver (City) v Ward, 2010 SCC 27, [2010] 2 SCR 28).

[27] In this case, Chitraker had his rights violated in a real sense with potentially adverse consequences. Bell is a large company for whom a small damages award would have little material impact. Chitraker spent a considerable period dealing with the Bell bureaucracy and in pursuing his claim. These factors suggest that a damages award should not be minimalistic.

IV. CONCLUSION

[28] Therefore, I would award Chitraker damages of $10,000. I would also award exemplary damages of $10,000 for Bell’s conduct at the time of the breach of the privacy rights and thereafter. I take account of Bell’s dealings with Chitraker as well as its reactions to the Privacy Commissioner and her recommendations and its failure to take these proceedings seriously.

[29] I would also award $1,000 for disbursements and other costs.

Update: My more detailed commentary about the case is here: Canadian Privacy Law Blog: Some thoughts on Chitrakar v. Bell TV and damage awards under Canadian privacy law.

Privacy Commissioner tables her last annual report on government privacy

Jennifer Stoddart, the federal Privacy Commissioner, has tabled her final annual report on the Privacy Act prior to her retirement from office in December.

It, along with an audit of the Canada Revenue Agency, does not paint a favourable portrait of how the federal government collects, uses, discloses -- and importantly -- protects personal information.

Here's the media release: News Release: Privacy Commissioner’s final report calls for greater care in government handling Canadians’ personal information - October 29, 2013.