In Canada, the main foray into protecting privacy in the commercial sphere was the introduction of the Personal Information Protection and Electronic Documents Act (PIPEDA) by the Federal government in 2000.[1] The federal government relied on its trade and commerce power to enact this legislation. The Act governs the collection, use, and disclosure of information for “commercial activity”.[2] This legislation applies to all intra-provincial information and all information crossing provincial boundaries. [3]
However, since collection, use, and disclosure of information also falls under the provincial heads of power of property and civil rights and matters of local nature, the provinces have also delved into the field.[4] In consequence, the provinces are able to set in place intra-provincial provincial legislation that occupies the field if the provincial legislation is deemed “substantially similar”.[5]
PIPEDA provides a statutory path for an applicant to receive damages. An applicant must first take his/her privacy complaint to the Privacy Commissioner, who then has up to one year to file a report.[6] Once the commissioner makes a report, or discontinues the complaint, the applicant vis s. 14(2) within 45 days, or longer by relief from the court, can apply to the court for a remedy one being damages under s 16(c): “award damages to the complainant, including damages for any humiliation that the complainant has suffered”.[7] The analysis by the court is considered a de novo hearing, thus the commissioner’s findings are not binding.[8]
Damages in this context are intended serve the three main functions: (1) compensation; (2) deterrence; and (3) vindication.[9] On its face, the explicit addition of “humiliation” to s. 16(c) seems promising for providing a lower threshold for damages due wrongful disclosure or access to personal information, however, as we will shall see the small amount of existing case law has narrowed and limited these awards. Overall, from my canvass of the case law, damages have been applied for in seventeen cases with eight of those cases being successful.[10] [11] Damage awards ranged from $0 to $5,000, with one exceptional case being awarded $20,000.[12] [13]
Principles, Thresholds, and Caps to Damages under PIPEDA
The court when looking to award damages under PIPEDA has created a non-exhaustive list of principles that guides it:[14]
| Should Damages be Awarded: | Assessing the Seriousness: | Other relevant factors: |
|
|
|
Additionally, the court has instituted a minimum threshold for damages for s 16. In Randall v Nubody’s Fitness Centres (Randall) the court stated “an award of damages is not to be made lightly… [s]uch an award should only be made in the egregious situations.”[15] In Randall, an employer provided a free gym membership for its employees, however, the gym was disclosing the number of visits to the employer who subsequently disclosed this in a staff meeting. The court characterized this breach as an “unfortunate misunderstanding” and therefore did not meet the threshold for damages.[16] [17] The court generally s seems hesitant to allow awards for minor humiliation or mental anguish without a demonstrable loss or unless humiliation can be found on an objective standard.[18]
Unsurprisingly the courts have taken on a tort approach to causation and mitigation. It must be proven that there is causal connection between the breach of PIPEDA and the damages suffered. [19] The plaintiff must mitigate his/her losses.[20]
In regards to a cap on damage, the court in Girao v Zarek Taylor Grossman, Harahan LLP held that mental anguish under s 16 should be capped at $10,000 as it is explicitly under the damages provision s 65 of Ontario’s Personal Health Information Act. [21]
Conclusion: Why not just go Tort?
When looking at s 16 holistically, this process is long and likely expensive with a low award of damages. As a result, it is not surprising that many of the plaintiff’s in the case law were self-represented. This process seems to be complicated and time consuming especially when a plaintiff can likely just sue a PIPEDA regulated actor for intrusion upon seclusion in tort from the first instance.[22] Noteworthy, if pursued via intrusion upon seclusion, at least on the common law form, the general damages would likely be limited to $20,000, which is still a potential gain compared to the $10,000 cap above.[23]
This is not to say a privacy complaint would not be worthwhile. As the privacy complaint may help help fix systemic issues and the the Privacy Commissioner’s report may be used as evidence for the civil action claim.
Tort, Privacy & Damages 