Federal Court dismisses awkward solicitor-client privilege claim

Earlier this year, the Federal Court dismissed a claim that a column in a spreadsheet was subject to solicitor-client privilege because disclosure would reveal legal advice obtained prior to its development.

Solicitor-client privilege (literally) protects advisory communications between a solicitor and its client, and it can protect such communications if they find their way into other documents. For example, if two employees of a lawyer’s client discuss the (corporate) lawyer’s advice confidentially via e-mail, their description of the advice may be redacted in response to a production requirement because its disclosure would reveal the solicitor-client communication.

In this case, a corporate taxpayer argued that a column in a spreadsheet was protected by solicitor-client privilege based on the same rationale. It relied on an affidavit that explained that it received legal advice prior to the development of the column and that disclosure of the column would reveal it “by what is being computed, how the computation is done,” and “by associated text in the reacted column.” The Court exercised its discretion to review the prior legal advice and held that the column was simply the “operational outcome or end product of legal advice” and not protected.

This is a fact specific, though illustrative outcome. Even the fact of obtaining legal advice on a particular matter is sensitive and ought normally be kept secret because, once disclosed, inferences can be drawn about advice taken based on the “operational outcome” or “end product” of the advice. Of course, a lawyer’s legal advice can be either be accepted or rejected or followed precisely or loosely, but clients are often drawn to back the legitimacy of their actions by reference to their careful adherence to legal advice. That’s plainly a risk.

In this case, it is unclear whether something precipitated the (more basic) disclosure of an advisory relationship, but one can see how arguing the resulting inference can be very awkward and risky. The only way to do it is to “double down” and disclose more about the advisory relationship and the resulting inference. If not it inviting of waiver in the underlying advice (which the Court did not find here), it seems to be one step down a slippery slope to that outcome.

Canada (National Revenue) v. BMO Nesbitt Burns Inc., 2022 FC 157.

No Charter-protected expectation of privacy in vehicle operation data

On July 20th, the Court of Appeal for Saskatchewan held that an accused person who drove his pickup truck through a highway intersection and stuck a semi-truck did not have a reasonable expectation of privacy that precluded the police from seizing a control module and its data from his vehicle before it was towed away.

The accident was horrible. There were six people in the truck with the accused, three of whom died, two of whom were children. The police charged the accused with dangerous driving and criminal negligence, and the prosecution relied on evidence retrieved from the wrecked pickup truck at the scene of the accident. Specifically, the police seized the truck’s Airbag Control Module (ACM) from under the driver’s seat. The ACM contained an Event Data Recorder (EDR) with data about the vehicle’s operation during the five seconds before impact in tenth of a second intervals – specifically, speed, accelerator pedal (% full), manifold pressure and service brake (on/off), seatbelt pretensioner readings, airbag deployment readings.

There are competing lines of Canadian jurisprudence regarding the warrantless seizure of on board vehicle computers and their data. The leading Ontario case is Hamilton, a Ontario Superior Court of Justice case that recognizes a reasonable expectation of (informational) privacy. In Yogeswaran, though, the Ontario Superior Court of Justice held that the territorial privacy interest in one’s vehicle is enough to preclude police search and seizure without prior judicial authorization.

Conversely, in Fedan, the Court of Appeal for British Columbia held that one’s territorial privacy interest in their vehicle is extinguished when the vehicle is seized and that EDR data is not associated with a strong enough informational privacy interest to warrant Charter protection.

The Court of Appeal for Saskatchewan followed Fedan. It reasoned that the accused’s truck, being totally destroyed on the side of a public roadway, was in the total control of the police whether or not it was yet to be formally seized based on section 489(2) of the Criminal Code. It concluded:

…the claim to a territorial privacy interest by Mr. Major in that component of his vehicle is weak. While a warrant could have been obtained, that does not mean one was required. I find that the state of the vehicle, Mr. Major’s loss of control over it, the nature of the ACM as a mechanical safety component installed by the manufacturer, and the focused task by Cpl. Green in locating and removing only it, do not support the continued existence of an objectively reasonable territorial privacy interest at the point when the vehicle was entered

Regarding informational privacy, the Court made the point that not all digital evidence is equally sensitive or revealing of one’s “biographical core.” EDR data of the kind at issue is limited to data about the operation of a vehicle immediately before an accident, and provides no “longer-term information about the driving habits of the owner or operator of a vehicle.” The Court concluded:

After considering the two lines of cases regarding EDR data, I find myself in substantial agreement with the reasoning from Fedan for the characterization of the data stored in the EDR. As in Fedan, the data here “contained no intimate details of the driver’s biographical core, lifestyle or personal choices, or information that could be said to directly compromise his ‘dignity, integrity and autonomy’” (at para 82, quoting Plant at 293). It revealed no personal identifiers or details at all. It was not invasive of Mr. Major’s personal life. The anonymous driving data disclosed virtually nothing about the lifestyle or private decisions of the operator of the Dodge Ram pickup. It is hard to conceive that Mr. Major intended to keep his manner of driving private, given that the other occupants of the vehicle – which included an adult employee – and complete strangers, who were contemporaneously using the public roadways or adjacent to it, could readily observe him. His highly regulated driving behaviour was “exposed to the public” (Tessling at para 47), although not to the precise degree with which the limited EDR data, as interpreted by the Bosch CDR software, purports to do. While it is only a small point, I further observe that a police officer on traffic patrol would have been entitled to capture Mr. Major’s precise speed on their speed detection equipment without raising any privacy concerns.

R v Major, 2022 SKCA 80 (CanLII).

IPC/Ontario issues basic cyber hygiene decision

On July 5th, the IPC/Ontario held that an Ontario medical clinic breached its PHIPA safeguarding duties by:

  • Allowing staff to use personal e-mail accounts to send patient information provided staff referred to patients only by by initials, medical reference numbers or accession numbers
  • Allowing the posting of login credentials (on sticky notes or the equivalent) to enable shared access to two computers
  • Failing to abide by the IPCs model for agent information and instruction, which requires annual privacy training and the re-signing of confidentiality agreements on an annual basis

The clinic self-corrected upon receiving the complaint, but not without defending its posting of login credentials by explaining that the two computers were physically secure and did not contain patient information. It shouldn’t have bothered. Its information and instruction failure aside, the clinic committed plain and basic network security wrongs. The IPC’s decision is notable for calling them out.

A Medical Clinic (Re), 2022 CanLII 61410 (ON IPC).

Location awareness technology on construction job site okay, says arbitrator

On January 14th, a British Columbia labour arbitrator dismissed an allegation that an employer breached British Columbia PIPA and the terms of a collective agreement by employing location awareness technology to manage employees on its construction job sites.

The employer used phone based technology to “manage and track […] employee attendance, including administering attendance requirements and payroll, and identifying and investigating inaccurate time keeping.” It adduced evidence problems with incidents of inaccurate logging of work and other attendance problems that it had discovered “by happenstance” through supervisors who managed crews across multiple work sites.

The employer installed the technology on work phones for use on job sites. The technology gathered data about whether an employee was within a work zone (along with distance away from the zone) once every three minutes. This data could not be reviewed until 24 hours later except for a “roll call” function that supervisors could use to check on employee location at any given time.

There is a line of British Columbia location tracking jurisprudence favourable to employers marked by a leading case decided by former Commissioner Elizabeth Denham – Schindler Elevator. The Schindler case, though, involved GPS technology installed in mobile workforce vehicles, partly for safety-related purposes – not phone based technology used on a job site to improve productivity. The union also argued that Schindler should no longer be followed because it pre-dated the Supreme Court of Canada’s alcohol testing decision in Irving Pulp & Paper.

The Board disagreed, and affirmed and applied Schindler. It held:

  • the information was not sensitive;
  • the collection was “reasonably likely” to be effective in satisfying its purposes;
  • the manner of collection was reasonable, in particular because the collection of data was minimized to what was necessary (not precise location and not continuous monitoring); and
  • the employer was entitled to collect the information even though there were other means of addressing its attendance problems, and is not required to exhaust all available alternatives.

This is a helpful decision for employers. While continuing to signal an aversion to “continuous monitoring” and highlighting the need for data minimization, the decision allows for the use of location awareness technology on a job site, which I believe is a Canadian first. It was also quite clear that this employer was motivated by distrust, which unions have argued aggravates the impact of monitoring. The employer did a good job of adducing evidence to prove it had legitimate concerns, but the Board also endorsed the proposition made in Schindler that there is “nothing remarkable” about an employer checking on compliance with work rules.

Kone Inc. v International Union of Elevator Constructors, Local 82, 2022 CanLII 1018 (BC LA).

Appellate court’s decision on teachers’ privacy rights in Ontario

I’ve stuck my neck out in the BLG Insights article linked below in saying that the Court of Appeal for Ontario got a recent school search case wrong. Privacy claims are unpredictable, and can hook on ideas held by decision-makers in a way that impedes common sense outcomes. This is one of those cases in my view, and does harm to security and safety on a number of levels.

Practically, Ontario organizations ought to be addressing the very subject matter of this case in preparation for an October legislative change that will require workplace monitoring policies. The new legislation doesn’t change the right to “monitor,” but organizations shouldn’t view their policies as neutral. Rather, advocacy in support of several essential organizational interests should be embedded in that policy so clear need for balance is established from the start.

https://www.blg.com/en/insights/2022/07/appellate-courts-decision-on-teachers-privacy-rights-in-ontario

Intrusion upon seclusion is an intentional tort – Ont CA

The Court of Appeal for Ontario has addressed an important point about the intentionality element in the intrusion upon seclusion tort.

The Court dismissed an appeal by a nurse who claimed her employer’s liability insurer had a duty to defend her from claims that arose out of her unauthorized access to patient information. The issue was whether policy language limiting coverage for “expected” or “intended” injury applied, which required the Court to analyze whether an allegation that one has committed the intrusion tort is an allegation of intentional conduct.

The Court said “yes,” and made clear that recklessness is a form of intentional conduct:

Although the Jones decision does not contain a definition of “reckless,” it places reckless conduct side-by-side with intentional or deliberate conduct. Jones adopted the Restatement’s formulation of the tort as involving an intentional intrusion. As well, the decision limited claims for intrusion upon seclusion only to “deliberate and significant intrusions of personal privacy”: Jones, at para. 72. One cannot tease from the discussion in Jones any support for the proposition advanced by Ms. Demme that Jones’ inclusion of a reckless act within the tort of intrusion upon seclusion could involve unintentional conduct.

The Court also articulated the precise state of mind that meets the intentionality element:

For that tort, the relevant intention is the defendant’s intention to access private patient records. If that is demonstrated, the nature of the tort is such that the intention to access the records amounts to an intention to cause injury. 

The appellant had argued that she lacked the intent to cause injury and therefore ought to have been covered.

Demme v. Healthcare Insurance Reciprocal of Canada, 2022 ONCA 503 (CanLII).

Application for non-profit investigation as open as any court proceeding, SKCA

On June 20th, the Court of Appeal for Saskatchewan affirmed the lifting of a sealing order and publication ban over arguments made by a non-profit corporation that its mandate warranted an exception to the general rule of court openness.

The corporation was subject to an application for an inspection under section 214 of The Non-Profit Corporations Act of Saskatchewan based on alleged misuse of funds by its Executive Director. The corporation provides shelter and sustenance to impoverished and at-risk clientele, and argued its ability to provide these services would be impeded by the conduct of an open hearing, in particular before its holiday fundraising drive. It further argued that an application for inspection under section 214 was an “investigatory proceeding” in which it was more likely that “incomplete and misleading” subject matter would be aired.

The Court disagreed with the corporation. Although harm to the corporation’s vulnerable clientele could constitute a “serious risk to an important public interest” (as required for a discretionary order that limits openness), the corporation’s case for harm was too speculative, lacking particulars as to when and what clients would likely be affected. In rejecting the corporation’s broader argument about investigatory proceedings, the Court said, “The open courtprinciple applies to all manner of proceedings, absent valid legislation which limits its application.”

Windels v Canadian Broadcasting Corporation, 2022 SKCA 72 (CanLII)https://canlii.ca/t/jpw4q.

ABCA says no reasonable expectation of privacy in IP addresses

On June 13th, a majority of the Court of Appeal of Alberta held that an IP address alone is not subject to a reasonable expectation of privacy such that it is protected by section 8 of the Charter.

The police had identified a series of fraudulent online transactions and asked a credit card processor for the matching IP addresses. The processor provided the police with two IP addresses, and the police then obtained a production order to require Telus to identify the two Telus subscribers. Unlike in the leading Supreme Court of Canada case R v Spencer, the police sought prior judicial authorization to identify the subscribers. Did they do wrong, however, by obtaining the IP addresses first?

The majority said “no,” and relied on the protection granted by Spencer in finding that there was no reasonable expectation of privacy in the IP addresses alone.

In Spencer, police obtained, without judicial authorization, the IP address and its subscriber data. Thus, without a court order, the police believed the following: Matthew Spencer was using the internet to download child pornography at a specifically named address. By contrast, the police here obtained, without judicial authorization, only IP addresses. Based on this abstract information, police believed a person who committed fraud used the IP addresses. They did not know who. They only knew the IP addresses belonged to TELUS and they ascertained this information through a publicly available internet lookup site. To get the name and address of the subscriber, they lawfully served TELUS with a production order. Thus, without a court order, they believed only this: an unknown person using a known IP address was committing fraud from an unknown address.

An IP address does not tell police where the IP address is being used or, for that matter, who is using it. Nor is there a publicly available resource from which the police can learn this or other subscriber data. To get the core biographical information such as an address, name, and phone number of the user, the police must obtain and serve a production order on the ISP in accordance with Spencer. That is what the police did here.

The dissenting judge held that, notwithstanding Spencer, IP addresses have investigative value as “digital breadcrumbs” and could be used to discover the identity of an unknown internet user. She held that – from a normative perspective – the Charter ought to apply to the police process of gathering electronic evidence right from the beginning.

R v Bykovets, 2022 ABCA 208 (CanLII).

Recent cyber presentations

Teaching is the best way of learning for some, including me. Here are two recent cyber security presentations that may be of interest:

  • A presentation from last month on “the law of information” that I delivered to participants in the the Osgoode PDP program on cyber security
  • Last week’s presentation for school boards – Critical Issues in School Board Cyber Security

If you have questions please get in touch!

ABCA decision on defending allegations about privileged communication

On April 12th, the Court of Appeal of Alberta held that a defendant waived solicitor-client privilege by affirmatively pleading that its counsel had no instructions to agree to a time extension for filing a prospectus.

The defendant faced a lawsuit that alleged its counsel gave a time extension and had the actual authority to do so. The majority judges explained that a party faced with such an allegation about a privileged communication can make a bald denial and safely rest on its privilege. The defendant went further, thereby putting its privileged communications in issue.

PetroFrontier Corp v Macquarie Capital Markets Canada Ltd, 2022 ABCA 136 (CanLII).