Damages Through PIPEDA

In Canada, the main foray into protecting privacy in the commercial sphere was the introduction of the Personal Information Protection and Electronic Documents Act (PIPEDA) by the Federal government in 2000.[1] The federal government relied on its trade and commerce power to enact this legislation. The Act governs the collection, use, and disclosure of information for “commercial activity”.[2] This legislation applies to all intra-provincial information and all information crossing provincial boundaries. [3]

However, since collection, use, and disclosure of information also falls under the provincial heads of power of property and civil rights and matters of local nature, the provinces have also delved into the field.[4] In consequence, the provinces are able to set in place intra-provincial provincial legislation that occupies the field if the provincial legislation is deemed “substantially similar”.[5]

PIPEDA provides a statutory path for an applicant to receive damages. An applicant must first take his/her privacy complaint to the Privacy Commissioner, who then has up to one year to file a report.[6] Once the commissioner makes a report, or discontinues the complaint, the applicant vis s. 14(2) within 45 days, or longer by relief from the court, can apply to the court for a remedy one being damages under s 16(c): “award damages to the complainant, including damages for any humiliation that the complainant has suffered”.[7] The analysis by the court is considered a de novo hearing, thus the commissioner’s findings are not binding.[8]

Damages in this context are intended serve the three main functions: (1) compensation; (2) deterrence; and (3) vindication.[9] On its face, the explicit addition of “humiliation” to s. 16(c) seems promising for providing a lower threshold for damages due wrongful disclosure or access to personal information, however, as we will shall see the small amount of existing case law has narrowed and limited these awards. Overall, from my canvass of the case law, damages have been applied for in seventeen cases with eight of those cases being successful.[10] [11] Damage awards ranged from $0 to $5,000, with one exceptional case being awarded $20,000.[12] [13]

Principles, Thresholds, and Caps to Damages under PIPEDA

The court when looking to award damages under PIPEDA has created a non-exhaustive list of principles that guides it:[14]

Should Damages be Awarded: Assessing the Seriousness: Other relevant factors:
  • Whether awarding damages would further the general objects of PIPEDA and uphold the values it embodies
  • Whether damages should be awarded to deter future breaches; and
  • The seriousness or egregious of the breach
  • The impact of the breach on the health, welfare, social, business or financial position of the applicant;
  • The conduct of the respondent before and after the breach;
  • Whether the respondent benefited from the breach.
  • The nature of the information at stake;
  • The nature of the relationship between the parties;
  • Prior breaches by the respondent indicating a lack of respect for privacy interests.

Additionally, the court has instituted a minimum threshold for damages for s 16. In Randall v Nubody’s Fitness Centres (Randall) the court stated “an award of damages is not to be made lightly… [s]uch an award should only be made in the egregious situations.”[15] In Randall, an employer provided a free gym membership for its employees, however, the gym was disclosing the number of visits to the employer who subsequently disclosed this in a staff meeting. The court characterized this breach as an “unfortunate misunderstanding” and therefore did not meet the threshold for damages.[16] [17] The court generally s seems hesitant to allow awards for minor humiliation or mental anguish without a demonstrable loss or unless humiliation can be found on an objective standard.[18]

Unsurprisingly the courts have taken on a tort approach to causation and mitigation. It must be proven that there is causal connection between the breach of PIPEDA and the damages suffered. [19] The plaintiff must mitigate his/her losses.[20]

In regards to a cap on damage, the court in Girao v Zarek Taylor Grossman, Harahan LLP held that mental anguish under s 16 should be capped at $10,000 as it is explicitly under the damages provision s 65 of Ontario’s Personal Health Information Act. [21]

Conclusion: Why not just go Tort?

When looking at s 16 holistically, this process is long and likely expensive with a low award of damages. As a result, it is not surprising that many of the plaintiff’s in the case law were self-represented. This process seems to be complicated and time consuming especially when a plaintiff can likely just sue a PIPEDA regulated actor for intrusion upon seclusion in tort from the first instance.[22] Noteworthy, if pursued via intrusion upon seclusion, at least on the common law form, the general damages would likely be limited to $20,000, which is still a potential gain compared to the $10,000 cap above.[23]

This is not to say a privacy complaint would not be worthwhile. As the privacy complaint may help help fix systemic issues  and the the Privacy Commissioner’s report may be used as evidence for the civil action claim.

[1] Personal Information Protection and Electronic Documents Act, SC 2000, c 5.
[2] Personal Information Protection and Electronic Documents Act, SC 2000, c 5, s 4(1), 2(1).
[3] Elaine Gibson, “Public Health Information Privacy and Confidentiality”, in Nolas M Ries & Tracey M Bailey & Timothy Caulfield, eds, Public Health and Policy in Canada Third Edition (Canada: LexisNexis Inc., 2013) at 138.
[4] Personal Information Protection and Electronic Documents Act, SC 2000, c 5, s 92(13), 92(16).
[5] Personal Information Protection and Electronic Documents Act, SC 2000, c 5, s 26(2)(b).
[6] Personal Information Protection and Electronic Documents Act, SC 2000, c 5, s 11(1), 13(1).
[7] Personal Information Protection and Electronic Documents Act, SC 2000, c 5, s 14(1)-(2); 16(c) (emphasis added).
[8] Nammo v TransUnion of Canada Inc., 2010 FC 1284 at para 28, 379 FTR 130.
[9] T. (A.) v. Globe24.com, 2017 FC 114, at para 95.
[10] Unsuccessful damage applications: Townsend v Sun Life Financial, 2012 FC 550, [2012] FCJ No. 77; Stevens v SNF Martime Metal INC., 2010 FF 1137, 2010 FC 1137 (CanLII); Arcand v Abiwyn Co-Operatives Inc., 2010 FC 529, [2010] FCJ No 630; Randall v Nubodys Fitness Centres, 2010 FC 681, 2010 CarswellNat 1865; Johnson v Bell, 2008 FC 1068, [2008] 3 FCR 67; Turner v Telus Communications Inc., 2005 FC 1601, 2005 CarswellNat 2954; Bertucci v. Royal Bank of Canada, 2016 FC 332; Blum v Mortgage Architects Inc., 2015 FC 323 at para 17-18; Canada (Privacy Commissioner) v. Air Canada, 2010 FC 429.
[11] Successful damage applications: Henry v Bell Mobility, 2014 FC 555, 2014 FC 555 (CanLII); Chitrakar v Bell TV, 2013 FC 1103 at para 29, [2013] DCJ No 1196; Biron v RBC Royal Bank, 2012 FC 1095 at para 44, [2012] FCJ No 1183; Landry v Royal Bank of Canada, 2011 FC 687 at para 32, [2011] FCJ No. 880; Girao v Zarek Taylor Grossman Hanrahan LLP, 2001 FC 1070 at para 61, 397 FTR 108; Nammo v TransUnion of Canada Inc., 2010 FC 1284 at para 79, 379 FTR 130; T. (A.) v. Globe24.com, 2017 FC 114; Cote v Day & Ross Inc., 2015 CF 1283.
[12] Henry v Bell Mobility, 2014 FC 555 at para 20, 2014 FC 555 (CanLII); Chitrakar v Bell TV, 2013 FC 1103 at para 29, [2013] DCJ No 1196.
[13] Chitrakar v Bell TV, 2013 FC 1103 at para 29, [2013] DCJ No 1196, was the case where the plaintiff was awarded $10,000 in general damages and $10,000 in exemplary damages.
[14] Henry v Bell Mobility, 2014 FC 555 at para 18, 2014 FC 555 (CanLII); Girao v Zarek Taylor Grossman Hanrahan LLP, 2001 FC 1070 at para 46-49, 397 FTR 108.
[15] Randall v Nubodys Fitness Centres, 2010 FC 681 at 55, 2010 CarswellNat 1865.
[16] Randall v Nubodys Fitness Centres, 2010 FC 681 at 58, 2010 CarswellNat 1865.
[17] Blum v Mortgage Architects Inc., 2015 FC 323 at para 17-18.
[18] Girao v Zarek Taylor Grossman Hanrahan LLP, 2001 FC 1070 at para 44, 397 FTR 108; Nammo v TransUnion of Canada Inc., 2010 FC 1284 at para 67 FTR 130.
[19] Blum v Mortgage Architects Inc., 2015 FC 323 at para 17-18.
[20] Blum v Mortgage Architects Inc., 2015 FC 323 at para 17-18.
[21]Girao v Zarek Taylor Grossman Hanrahan LLP, 2001 FC 1070 at para 54, 397 FTR 108; Personal Health Information Protection Act, 2004, SO 2004, c 3, s 65.
[22] Jones v Tsige, 2012 ONCA 34, para 50. Chandara v. Canadian Broadcasting Corp, 2016 ONSC 5303, para 33;
[23] Jones v Tsige, 2012 ONCA 32 at para 86, 108 OR (3d).

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s