Information About Landlords not Personal Information

On September 30th the Ontario Superior Court of Justice held that certain information about residential landlords was not their personal information in the circumstances.

The issue arose in an application that challenged a municipal by-law requiring landlords to obtain licenses for residential rental units. The by-law required landlords to submit information in support of a license (including name, telephone number and address information). The by-law also required a copy of an issued license (which included similar information) to be posted. The applicants argued that the by-law conflicted with the Municipal Freedom of Information and Protection of Privacy Act.

The Court held that MFIPPA’s privacy protection part was not engaged because the information at issue was information that identifies an individual in a business capacity rather than personal information. Justice Leitch explained:

In my view, landlords who lease Rental Units are engaged in business whether or not the landlord is an individual leasing a Rental Unit in his own home or a corporate landlord leasing units in a large apartment building. Both landlords are operating a business. As a result, I am satisfied that the Licensing By-law does not conflict with the provisions of the MFIPPA which protects personal information because the information requested comes within the exclusion set out in s. 2(2.1) of MFIPPA. It is contact information that identifies the individual in a business capacity.

It appears this was the same finding reached by the Information and Privacy Commissioner/Ontario in a previously decided privacy investigation report that dealt with the by-law. The IPC intervened and argued that the Court should not re-decide the issue or, alternatively, adopt the IPC’s finding. The Court rejected the IPC’s argument because of the IPC’s limited jurisdiction to hear and decide privacy complaints.

London Property Management Association v. City of London, 2011 ONSC 4710 (CanLII).

Well-Litigated Background Check Dispute Sent Back to the B.C. OIPC

On September 6th, the British Columbia Supreme Court allowed a judicial review application of a finding that the British Columbia Ministry of Children and Family Development breached British Columbia FIPPA by failing to make every reasonable effort to ensure the accuracy of personal information before using it to answer an background check inquiry.

This is a very well-litigated dispute about a communication made by the Ministry to a social services employer who contacted the Ministry, with consent, to check into the background of a new employee. The Ministry disclosed the existence of a complaint made against the employee. It also noticed some irregularities in its file, did a full review of the file (without going behind the file to make inquires) and rendered an opinion to the employer that the employee needed to be supervised when in contact with children.

The employee was terminated and has since been on a long campaign to seek redress. In May 2010, the British Columbia Court of Appeal dismissed the employee’s $520 million action against the Ministry and others as disclosing no reasonable cause of action. About a year earlier, the Court of Appeal heard an appeal of the employee’s privacy complaint and sent it back to the B.C. OIPC so the OIPC could consider whether the Ministry breached section 28 of B.C. FIPPA. Section 28 imposes a duty to make every reasonable effort to ensure the accuracy of personal information that is used to make a decision that directly affects an individual.

In reconsideration, the OPIC affirmed the employee’s complaint. It held that the Ministry had made a “decision” that engaged the section 28 duty and held that the Ministry had failed to make every reasonable effort to ensure the accuracy of the employee’s personal information. The OIPC explained:

In this matter, the evidence is clear that the social worker made no effort, let alone every reasonable effort, to ensure the accuracy and completeness of the information she relied upon to come to her interim decision recommending Mr. Harrison not be left alone with youth in his workplace. Her opinion was based in part on her belief that the matter had not been “properly” investigated. Yet she did not make a single inquiry of any one of the several Ministry employees who had had dealings with Mr. Harrison over the previous decade. To compound matters, she admitted that, when she made her recommendation concerning Mr. Harrison, it had been more than twenty-four years since she had worked in the field of child protection. This decision, based on allegations determined at the time to be without substance and warranting no further investigation, has led to consequences that cannot be remedied. …

In addition, it is not clear to me whether the Ministry has a strategy, policy or process dealing with the management of files concerning unsubstantiated or worse, uninvestigated, allegations of sexual (or other) abuse. It is however clear that those who have been subjected to the latter are in an unenviable situation in which there can be no successful outcome. Since no investigation ever takes place, the veracity of the allegation is not conclusively resolved. Yet no further investigation will ever take place, frustrating closure to the matter and leading to the possible loss of reputation or other harm.

The Court held that the OIPC erred by rendering its decision without considering the public interest in disclosure about potential threats to children and the Ministry’s duty to protect children under the CFSCA. It referred the matter back to the OPIC for resolution.

Harrison v. British Columbia (Information and Privacy Commissioner), 2011 BCSC 1204 (CanLII).

Alberta Court Lends Constitutional Protection to the “Cyber-Picket Line”

The Alberta Court of Queen’s Bench issued a remarkable privacy decision on June 30th that didn’t get much attention until David Fraser posted about it last week. (Thank you David.) Madam Justice Goss of the Court held that Alberta PIPA violates section 2(b) of the Charter because it doesn’t give organizations wide enough latitude to record and disseminate images of people at public social or political events.

Picketers often employ video cameras and still cameras, a practice thought by some to be a form of intimidation. In this case, there was evidence of a union communication that stated it would post images on a website called “www.casinoscabs.ca” and evidence that the union had used images to attack individuals in a manner described in the Alberta OPIC order under review as follows:

As well, exhibits were entered showing that images of this Complainant’s face were included (which he stated was without his consent) in issues of the Union’s newsletter or strike leaflets, in one case superimposed over the head of a person driving a miniature train, associated with text which began “There goes [the Complainant] with his train full of scabs”, and in another case, superimposed onto a turkey. In a third image, in which Complainant C is seen leaning over a railing gazing down at the floor below, the associated text begins: “What is [the Complainant] thinking? Is it jumping? …” and continues with other comments related to the strike and the Complainant’s possible thoughts.

Madam Justice Goss suggests that this activity – and “ridicule” and “mockery” in general – does not warrant constitutional protection. She nonetheless holds that PIPA is too restrictive of expression in a free and democratic society because it restricts unions from engaging in “union journalism” relating to labour disputes and picket lines. While significant, Madam Justice Goss’s finding does preserve a rather fundamental limit on the “cyber picket line” (a term used by the union’s expert): the dissemination of images to ridicule, mock and intimidate can and should be restrained by applicable privacy legislation.

Of course, the decision has implications that go beyond the picket line. At its broadest, the matter raises a rather gargantuan issue about how much government can restrict the expression of information about things people do in public as a means of promoting and protecting personal privacy.

United Food and Commercial Workers, Local 401 v. Alberta (Information and Privacy Commissioner), 2011 ABQB 415 (CanLII).

HRTO Orders Applicant to Consent to Use and Disclosure of Student Record for Proceeding

On August 5th, the Human Rights Tribunal of Ontario held than an applicant implicitly consented to the use and disclosure of information in his Ontario Student Record by putting the information into issue in his application.

Section 266 of the Ontario Education Act deems the OSR to be privileged subject to student or guardian consent. The applicant (through his next friend) referred to information in his OSR in his application and expressed an intention to use information in his OSR in pursuing his application. The applicant was not, however, forthcoming with consent to allow the responding school board to use the OSR in it’s defence.

The Tribunal did not entertain the board’s argument for a finding that the section 266 privilege is waived in whole upon the filing of an application by a student in respect of educational services. It did articulate a principle that supports implicit consent to use and disclose relevant information in an OSR in support of a defence:

Based on the particulars in the Application, as well as the applicant’s own expressed intention to rely on parts of the OSR, the applicant has implicitly consented to at least some use and disclosure of the OSR by the respondent in order to defend itself. However, in subsequent correspondence and submissions the applicant’s next friend explicitly seeks to place a number of conditions on her consent. I am not satisfied that the restrictions she seeks to place are necessary to protect the privacy of the OSR documents and information. The respondent is not receiving documents, through a disclosure process, in which it otherwise has no interest or responsibilities. It is still subject to its obligations under the Education Act. To the extent that it may use or disclose documents or information from the OSR for the purposes of the proceeding before the Tribunal, it is also subject to the Tribunal’s Rules on the confidentiality of documents. The applicant cannot rely on documents and information from the OSR in the Application, while seeking to prevent the respondent from using the same in order to present its case. I find it necessary, for a fair and just proceeding, for the respondent to be able to use and disclose documents and information from the OSR, subject to the time limitation addressed below.

…

Where an application is filed which claims discrimination in educational services and it is apparent that a respondent school board must use and disclose information from an OSR in order to defend itself, including to file a full response, the Tribunal will consider, on request from such a respondent, whether the application should proceed unless an applicant provides explicit consent to use and disclose information that information.

The Tribunal ordered the applicant to provide explicit consent for the use and disclosure of information falling within a relevant time period, failing which it would consider dismissing the action as an abuse of process.

T.S. v. Toronto District School Board, 2011 HRTO 1471 (CanLII).

Ontario Court Requires Notice to Non-Parties Whose Privacy Interests at Stake in Production Dispute

On August 15th, the Ontario Superior Court of Justice deferred a motion for production of medical records so two non-parties could be given notice of the production motion.

The action was by a patient of a psychiatric facility who was allegedly assaulted by two other patients. The facility resisted production of records in its custody based on a concern for the privacy of the non-parties, but also did not dispute the records’ relevance.

Mr. Justice Ricchetti ordered production of occurrence reports that recorded facts pertaining to the alleged assaults without requiring notice. Ricchetti J. suggested that the records contained information that was as much about the plaintiff as the two non-parties. He also recognized the occurrence reports were not about the provision of care though they were placed in both of the non-parties’ patient records. Though these factors led him to order production without notice to the non-parties, Ricchetti J. did order the non-parties’ attending physicians to be given notice and an opportunity to object based on criteria for doing so set out in the Mental Health Act, ordered redaction of names and identifying information and ordered receiving counsel to safeguard copies of all information received.

Regarding production of other medical records, Ricchetti J. ordered that notice be given to the affected non-parties. He said:

Rule 30.10 of the Rules of Civil Procedure requires that any motion seeking third party disclosure be on notice to the third party. The real third party in this case are the patients. The purpose of this rule is to ensure that the party whose documentation is to be disclosed has an opportunity to object or consent or request some limitation on the disclosure. This purpose, in my view, is defeated if the “real” owner or person with the “real” interest in the disclosure of the documentation or information is not given notice.

I cannot imagine why a request for disclosure of the patient’s medical records containing PHI should not be on notice to the patient. It is the patient’s PHI, protected by the PHIPA, that disclosure is sought.

…

In my view, where an order is sought under s.41(1)(d) of the PHIPA or s.35(5) of the MHA, such an order should be obtained, if at all possible, on notice to the patient whose record is sought and not just the custodian of the patient’s medical records containing the PHI.

This is a sensible application of the power over procedure. Note, however, that health information custodians are authorized under PHIPA to disclose personal health information for the purpose of providing production without any notification requirement. Is notification “if at all possible” in the event of dispute too conservative and too costly? Should courts require health information custodians (who are accountable to privacy regulators under statute) to attempt to negotiate a reasonable scope of production and reasonable protective terms before stepping in? These are important questions that are yet to be answered.

M.L. v. Homewood Health Centre Inc. et al, 2011 ONSC 4790 (CanLII).

Ontario Court of Appeal Relieves Media of Elevated Costs Order in Privacy Dispute

The Ontario Court of Appeal reduced a full indemnity costs award made against the Toronto Star on Tuesday. The motion judge made the extraordinary costs award against the Star because it was a “media giant” that had unsuccessfully taken on an individual who was trying to protect his personal privacy. The Court of Appeal held that the Star’s action in seeking to publish potentially embarrassing personal information about the individual was not conduct worthy of sanction even though it affirmed a finding that the the Star was motivated, in part, by its private interests. Though notable to readers of this blog, given how it was handled this case is arguably more about the exceptional character of elevated costs orders than about media rights and privacy.

Toronto Star Newspapers Ltd. v. Fraleigh, 2011 ONCA 555 (CanLII).

IPC/Ontario says personal information received on an unsolicited basis is not “collected”

The Information and Privacy Commissioner/Ontario issued a notable privacy investigation report on July 8th. It held that a municipality did not “collect” personal information under MFIPPA by receiving unsolicited correspondence. Investigator Ratner said:

I have considered the City’s position. Sections 31 and 32 of the Act both make reference to personal information having been “obtained or compiled” by an institution. In my view, in drafting the Act, the legislature intended the meaning of the term “obtained or compiled” to be different from the term “collect,” which is employed in section 28. Had the legislature intended sections 31 and 32 to only apply to personal information that is collected, it would have used that terminology in those sections.

I note that personal information may come into the custody or control of an institution in a variety of circumstances: it may be actively solicited, it may be passively received, or it may be created by the institution. In my view, the term “obtained or compiled” is intentionally broad, and is intended to accommodate the various ways in which an institution may acquire personal information. This analysis supports the notion that the term “collect” is intended to be interpreted narrowly so as not to apply to situations such as this where correspondence is sent to institutions voluntarily and without solicitation.

Vaughan (City) (Re), 2011 CanLII 47522 (ON IPC).

City Councillor Fined for Leaking Harassment Report

I hadn’t heard about the unprecedented conviction of a city counsellor under the British Columbia Freedom of Information and Protection of Privacy Act until stumbling upon the British Columbia Provincial Court’s May 24th judgement. Councillor Brian Skakun was convicted and fined $750 for disclosing information in contravention of FIPPA. The Court found Skakun leaked a harassment report to a CBC reporter. Notably, it rejected an argument that Skakun’s actions were justified based on a common law whistleblower defence.

R. v. Skakun, 2011 BCPC 98. (conviction)

R. v. Skakun, 2011 BCPC 108. (sentence)

Order to Identify Anonymous Message Board Users Granted (Ontario)

On May 30th, the Ontario Superior Court of Justice granted an order to defamation plaintiff Richard Warman to help him identify two individuals he alleges defamed him by posting comments on the “Freedominion” message board.

Mr. Warman’s process of identifying eight “John Doe” defendants has taken some time. He first obtained an order in March 2009, but it was quashed in May 2010 by the Divisional Court – see “Court says suing message board operator not an easy means to identify anonymous internet users.” Following the Divisional Court order, Mr. Warman discovered six of the John Does’ identities without the aide of a court order. He then came back to the Court to identify the unidentified two.

Justice Blishen issued an order requiring the operators of the Freedominion site to provide identifying information over their objection and based on the four-part test articulated last May by the Divisional Court. She rejected an argument that the use of pseudonyms gave the unidentified John Does a reasonable expecation of privacy. She also rejected an argument that the common use of “hyperbole” and “exaggeration” on the Freedominion site rendered the impugned publications incapable of having a defamatory meaning.

Hat tip to Peg Duncan!

Warman v. Wilkins-Fournier, 2011 ONSC 3023 (CanLII).

Unauthorized Secondary Use Claim To Proceed, Unauthorized Retention Claim Dismissed

On May 12th, the British Columbia Supreme Court allowed a novel privacy class action to proceed.

While most civil privacy claims relate to claims of improper disclosure, the plaintiffs here objected to the unauthorized retention and use of personal information – specifically, the retention of newborn blood samples for medical purposes and (secondary) research purposes that were not disclosed at the time of collection. The Court held that liability for the secondary use was a genuine issue for trial.

The Court rejected the plaintiffs’ claim that rested on the alleged unauthorized long term retention of samples for medical purposes, a practice the plaintiffs claimed created a “fully functional DNA database.” The Court held that authorization to retain for medical purposes was not in doubt given the plaintiffs consented to collection for medical purposes and, at the time, did not raise any concerns about retention for the same purposes.

D. (L.) (Guardian ad litem of) v. Provincial Health Services Authority, 2011 BCSC 628 (CanLII).