On August 21st, the Ontario Superior Court of justice declined to strike a defamation claim as barred by absolute privilege because the manner in which the defendants delivered the draft claim to the plaintiff’s employer suggests, as alleged, it was sent to harm the plaintiff and not for the purposes of forwarding the defendants’ litigation.

The defendants, the plaintiff alleges, served the draft claim on his employer with a warning that “‘We didn’t know’ will not be an adequate explanation in this case.” Regardless, the plaintiff also alleges, after the employer sent a brief e-mail to the defendants saying there was no basis for a claim against it, the defendants promptly withdrew their allegations and proceeded against the plaintiff alone. The Court held that these allegations cast sufficient doubts on the defendants’ motives to let the plaintiff’s (counter)claim proceed.

Nuvius Bankcard Services v Dowty, 2012 ONSC 4835 (CanLII).

The New York Times published a story yesterday on the Aurora, Colorado shootings entitled, “Before Gunfire, Hints of ‘Bad News’.” We’re a long way from fully understanding the significance of the shootings, but the Times’ piece is a reasonable consolidation of facts, so I’ll use it here to make the point that discharging a duty to prevent violence rests heavily on the processing of information to understand the nature of a potential threat.

The Times on the Aurora shootings

The Times follows the classic line of inquiry that follows incidents of violence. Who knew what about suspected shooter James Holmes? When? And why didn’t they act?

The Times goes over facts raised very soon after the shootings about concerns held by Holmes’ psychiatrist, also the director of student mental health services at the University of Colorado Denver. Holmes attended UC Denver until he voluntarily withdrew from study about a month before the shooting. The Times also adds new facts garnered from interviews with people who had recent contact with Holmes. Most notably, in May, Holmes told another student that he had purchased a Glock semiautomatic pistol. Holmes also had some puzzling interactions with a different student about his mental condition, warning her to stay away “because I’m bad news.”

We should not be surprised by these findings. As the forensic psychiatrist quoted by the Times notes, “almost without exception, [mass killers’] crimes represent the endpoint of a long and troubled highway that in hindsight was dotted with signs missed or misinterpreted.”

This widely-accepted view is why violence prevention rests so heavily on processing information or, more specifically, on “threat assessment.” Whether a duty to prevent violence is based on workplace health and safety legislation, occupiers liability legislation or common law duties, implementing reasonable employment screening, reasonable physical security controls and a reasonable emergency response plan is not enough. Implementing a reasonable threat assessment system is an important part of violence prevention, and is necessary to manage the risk of violence that is perpetrated by individuals who are “knowable” to an organization (e.g., customers, patients, students, current and former employees and domestic partners of current employees).

What is threat assessment?

Threat assessment is a structured process of identifying, assessing and managing the threat that certain persons may pose to others. It is depicted in this slide I have prepared for an upcoming presentation (details and registration here):

The element of the process that is highlighted by the Times’ article is on the very left of the slide. A duty to employ reasonable threat assessment procedures requires organizations to build and maintain a system for picking up on and evaluating available or knowable information that might indicate a risk of violence. The duty to “know what is reasonable to know” supports the reporting of threats and mere behaviors of concern, supports the imposition of reporting duties on employees and supports the use of communication and training to encourage others (such as students and customers) to report.

Yes, threat assessment systems invite a kind of surveillance. However:

• their use is supported by a very strong and consistent body of authority;
• they have become a regularly utilized part of the health and safety programs at all Canadian universities and colleges (who are particularly open to the risk of violence from “knowable” individuals); and
• they are a key part of a workplace violence prevention and intervention standard approved by the American National Standard Institute in 2011.

Though threat assessment has an impact on personal privacy, it is a justifiable impact. The British Columbia and Ontario privacy commissioners have published a guideline on violence prevention that declares “life trumps privacy.” Though the guideline focuses on the disclosure of personal information post-assessment and as part of threat management, the principle it supports applies equally to justify the collection of personal information for threat assessment purposes. In fact, one may question whether a disclosure of personal information for threat management purposes can be made responsibility if it is not based on sound fact-based analysis that can only be achieved with through collection of personal information that helps an organization understand the threat.

Hard questions about the Aurora shootings

Though the Times has compiled some facts that, in hindsight, paint a “disturbing portrait of a young man struggling with a severe mental illness who more than once hinted to others that he was losing his footing,” this does not establish that Holmes’ university failed in assessing the threat that he posed. In fact, at this early stage the Aurora shootings raise some very difficult questions about UC Colorado’s responsibility.

First, what does the reasonable educational institution do to encourage student reports? One student received a warning from Holmes and another knew he had a firearm. UC Denver’s website indicates that faculty and staff have a duty to report threatening and concerning behaviors, but it does not appear that the university imposed such a duty on students. Is this approach reasonable? Would such a duty be meaningful or enforceable in any practical way? What did the university do to encourage or facilitate reporting by students? Was that reasonable?

Second, when should health care providers employed by an educational institution report behaviors for threat assessment? Mental health professionals hear about all kinds of concerning behaviors in the course of providing health care. They are duty-bound to keep such information confidential subject to, under our law in Ontario, a belief that disclosure of information is necessary to eliminate or reduce a significant risk of serious bodily harm. Such disclosures will ordinarily invite an immediate (emergency) response by law enforcement and not threat assessment, so the media’s early focus on what Holmes’ psychiatrist knew and disclosed for threat assessment purposes is puzzling.

Third, what duty does an educational institution have to the public at large? UC Denver is a public institution with an educational mandate. It has no public safety mandate and no relationship with the shooting victims. Does its mere engagement in assessing the threat posed by Holmes to its community justify the imposition of a duty of care to others? This is questionable.

For more information on threat assessment

Here are the resources I’ve used in preparing this article and in preparing for my upcoming presentation.

• The Final Report and Findings of the Safe School Initiative (US Secret Service and US Department of Education, 2004)
• Workplace Violence: Issues in Response (U.S. Department of Justice, 2004)
• Workplace Violence Prevention and Intervention (ASIS/SHRM, 2011)
• A Handbook for Police and Crown Prosecutors on Criminal Harassment (Department of Justice Canada, 2004)

I’d also encourage you to follow David Hyde, who regularly shares insightful information on threat assessment. For David’s recent post on the role of threat assessment in a workplace violence program, click here.

I spent a long day today studying some fairly wacky e-mails on a file and, coincidentally, also had someone ask me to pull together a list of good e-mail practices with a focus on risk management benefits. This got me onto a creative project, and I have produced the following list.

1. Pick up the phone. For many subjects, a telephone discussion can quickly generate a level of understanding that might take numerous e-mails to achieve. Even simple subjects can generate significant back-and-forth.
2. Have a meeting. Don’t use e-mail to think aloud. Deliberations can be very sensitive because they often lead to decisions that do not reflect initial thoughts. E-mail is an extremely poor medium through which to deliberate. Deliberation is best suited to meetings.
3. Write meaningful subject lines. Your recipient should be able to understand what your e-mail is about by reading the subject line. For example, “Project Alpha report attached for your review.” If action is required, indicate so in the subject line. Don’t leave the subject line blank. Don’t use “important,” or “Hi” or the like.
4. Keep to one subject per e-mail. By sending business e-mail you are creating a record of correspondence that likely has some value to the business. That record is difficult to manage when it has more than one subject. It may seem strange, but send two e-mails in sequence rather than one. Similarly, don’t (lazily) reply to an old e-mail to start a new subject.
5. Ask, “Does this person really need to be copied?” Routine use of the CC field can annoy and burden recipients. Use it for a purpose and be critical about your purpose. Ask yourself if copying someone is really a necessary courtesy. In other words, if they won’t complain, don’t copy them.
6. Be concise. Start with your point or request. Provide a brief rationale or explanation. End with an invitation to action (either yours or the recipient’s). If your e-mail requires much more than this, e-mail might not be the appropriate means of communication.
7. Pause. Pause again. Send. Never e-mail when you are upset or angry. If it is appropriate to respond in writing at all, wait until you have calmed down. Remember that your response will be permanently recorded. Even in less intense circumstances, you’ll benefit by reflecting on your e-mails rather than responding immediately.
8. Don’t forward an e-mail that will provoke a harmful response. If you receive an e-mail that is alarming or obnoxious, resist the urge to forward it to your colleagues. Yes, you’ll need to talk it through, but if you forward the provocative e-mail to four others, you’ll cause at least one to react without thought, in writing.
9. Check your spelling and grammar. It may seem unimportant, but if the substance of your e-mail is later scrutinized, poor spelling and grammar might cause people to perceive you as sloppy or uncaring and discount your substantive position.
10. Check the clarity of your message. Have I been too loose in conveying a complicated idea? Have I used humor that is too risky? Ask these questions and, remember, your e-mail will create a permanent record.

We’ve published an edition of our Information and Privacy Post. As our lead editorial below says, it contains 61 case summaries (mostly from the last 12 months) relating to the protection of confidential business information, electronic evidence, freedom of information, privacy, privilege and production. Please download the full document here.

Dear Friends:

It’s late August 2012, and here’s what’s on our minds.

Our Information and Privacy Post is back. This edition contains 61 case summaries relating to the protection of confidential business information, electronic evidence, freedom of information, privacy, privilege and production.

It has been a remarkable year. Canadian privacy law, in particular, has made a significant shift. With its decision in Jones v Tsige (page 23), the Court of Appeal for Ontario recognized a new common law privacy right. This new tort applies narrowly – to intentional “intrusions” into private affairs – and includes a “highly offensive” standard that defendants can rightly view as prophylactic. Jones v Tsige, however, opens a door. “What’s next?” is the right question to ask.

Will Canadian courts, for example, recognize a cause of action for public disclosure of private facts? Will damage be presumed and, if so, what kind of damage? If liability flows from mere disclosure, will due diligence be a defence? How will the standard of care be calibrated?

Some clarity would be nice given data breach litigation in Canada is now a reality. In the Rowlands case (page 17), the Ontario Superior Court of Justice approved a settlement that was structured on an assumption that the compensable damages suffered by class members would be minimal to non-existent. Justice Lauwers followed a Québec decision from earlier in the year called Mazzona (page 16), in which the Québec Superior Court dismissed a motion for certification because a data breach class action could not be founded on “potential damage” and the petitioner failed to establish she suffered compensable psychological damage. While positive, the real prospect of data breach class action claims that, even with a reasonable defence, might expose an organization to the kind of counsel fees agreed to be paid in Rowlands is certainly a call to data security “behavior modification.”

That kind of behavior modification certainly hasn’t flown from our federal commercial sector privacy statue – the Personal Information Protection and Electronic Documents Act. This statute, which governs the collection, use and disclosure of personal activity in the course of commercial activity in seven out of ten provinces and the three territories, has produced a trail of cases in which applicants have established liability but received very moderate damages or no damages at all (see the cases we’ve indexed under “PIPEDA damages judgments”). While the Office of the Privacy Commissioner of Canada has used PIPEDA to achieve some high-profile successes in dealing with Facebook, it seems the statute is most notorious for causing the frustration of provincial superior court judges, who don’t quite know what to make of it (see the cases we’ve indexed under “Awkward privacy cases”). With amendments that arose from a parliamentary review that commenced way back in 2006 languishing, one might question whether the statute will hold its relevance. The OPC is aware of this issue, and has begun lobbying for the power to impose administrative monetary penalties and make orders, a development for organizations to watch.

So what if privacy protection becomes the responsibility of our judges? Ontario Commissioner Anne Cavoukian made the news this year when she said she’s lost faith in the inclination of judges to protect individual privacy. I don’t agree. Judges are rightly conservative in making new policy. Their effective stewardship of rights under section 8 of the Canadian Charter of Rights and Freedoms shows they are not out of touch with privacy, though judges from Alberta deserve note for routinely trouncing upon the Office of the Information and Privacy Commissioner of Alberta. The most recent trouncing, in United Food and Commercial Workers (page 13), rivals Jones v Tsige for privacy decision of the year and raises some fundamental questions about the permissible scope of privacy legislation under the Charter. The Alberta OIPC has filed leave to appeal to the Supreme Court of Canada.

So these are very interesting times. The change is real and significant. We hope this document helps you get up to date and equipped for the information management and privacy issues coming your way. Of course, if we can help, please get in touch.

Dan Michaluk
Information and Privacy Practice Group Leader

We hope you enjoy. We’d also like to remind you of our upcoming complementary session for in-house counsel (in which we’ll use “The Post” as a reference). It’s called “An Information Management Update for In-House Counsel and will be held on September 19th at our offices in Toronto. Please click here for details and to register.

The Supreme Court of Nova Scotia issued judgement in an internet disparagement case on August 7th that has made the media for resulting in the largest damages award for defamation in Nova Scotia history. Notably, the Court also entertained but did not decide upon a novel claim for breach of privacy.

The self-represented plaintiffs obtained default judgement last December and moved for an assessment of damages. The motion was unopposed by the defendant, a resident of Mississippi.

The plaintiffs’ privacy claim seemingly overlapped significantly with their defamation claim, though the Court described the privacy claim as resting at least partly on the publication of private facts. It noted, for example, that the defendant published a home address and a location one of the plaintiffs visited in Europe.

The Court began by stating, “I am satisfied that in an appropriate case in Nova Scotia there can be an award for invasion of privacy or as the Ontario Court of Appeal [in Jones v Tsige] called it, “the intrusion upon seclusion.” This is a significant finding.

The Court questioned, however, whether the facts deemed to be admitted in the case before it fit the elements of the intrusion privacy tort, which is about the gaining of access to private facts and not publication. It also questioned the effect of the overlapping defamation claim. In the end, the Court decided to “leave the issue of a cause of action for intrusion upon section for another day in another proceeding” based on the lack of argument and the overlapping defamation claim. Had the plaintiffs had not been so successful otherwise , they might take issue with this skirting of their privacy claim.

This is not to suggest the plaintiffs’ privacy claim was a good one. It does seem mainly embodied by their defamation claim, with some independent elements about the publication of facts that are too innocuous to warrant a damages award. The Court might have dealt with the claim in the same manner as the Ontario Superior Court of Justice in Warman v Grosvenor, in which the Court held that the damages for breach of privacy only flow from harm that is not subsumed by the torts of defamation (which addresses harm to reputation) and assault (which the Court said addresses the interest in freedom from fear of being physically interfered with).

Trout Point Lodge Ltd v Handshoe, 2012 NSSC 245 (CanLII).

On July 27th the Supreme Court of Yukon ruled that a surreptitiously recorded telephone conversation was inadmissible in a family law proceeding.

The issue arose in an application to formalize a child support and access arrangement relating to a five year old child. The father was concerned about negative comments made by the mother to the child during phone calls she made during his period of access. The father recorded one such call. The mother was on speaker phone and knew that he “was in the room” while she spoke with her child. The father sought to adduce a transcript of the recording.

Despite commenting that the evidence was “highly probative to the extent that it confirms the mother’s blatant attempt to manipulate the child,” the Court excluded the evidence. It held that it would bring the administration of justice into disrepute to admit evidence obtained in breach of section 184(1) of the Criminal Code (intercepting a private communication) and that admitting the evidence would encourage a practice that was not in the best interests of the child.

There’s a section in The Law of Evidence in Canada that suggests a judge hearing a civil matter does not have a discretion to exclude relevant and reliable evidence even though it was obtained through unlawful means, though the Court cites to some British Columbia judgements that suggest otherwise. (I have not yet reviewed these judgements, but will.) The Court also does not explain the basis for finding that the father breached section 184(1) by making the recording, a finding that is debatable given the mother was on speaker with the father in the room and given the Criminal Code definitions of “private communication” and “intercept.”

BDC v BJB, 2012 YKSC 64 (CanLII).

On Tuesday, the Information and Privacy Commissioner/Ontario issued her report on the Elections Ontario data breach – a breach involving the loss of two USB keys containing unencrypted personal information of between 1.4 to 2.4 million electors. There are a number of relevant technical findings in the report, but overall the Commissioner used the occasion to send a message about the need for a well-functioning internal responsibility system.

The internal responsibility system concept is well known to health and safety practitioners. An IRS is a system of accountability within an organization in which all individuals – from executives, to middle management, to supervisors, to workers – have an assigned responsibility for addressing occupational hazards. Ryerson University Professor Peter Strahlendorf illustrates how an IRS works by reference to the causal analysis that is conducted after a workplace accident:

If a worker makes a mistake and causes an accident, we can see how very often there was a prior failure of a supervisor to train, coach, observe, job plan, motivate, and so on. So, if the supervisor can be said to have caused the accident in part, then we can see that frequently the manager did not properly select and train the supervisor, or did not develop programs needed by the supervisor, or did not properly allocate resources or staff the workplace.

Where the direct causes of an accident involve unsafe conditions, tools, machines, processes and structures, we can often bypass the worker and supervisor in our causal analysis and see the failure of the mid-level to senior manager to properly apply design standards or allocate resources.

Managers cause accidents; they just cause them in different ways than workers and supervisors. However many layers there are in an organization we can see a causal connection back to the accident. Presidents cause accidents. They can fail to lead, to set policy, to ensure a proper delegation of authority, to inspire a proper safety culture, to design a workable organizational structure or to allocate resources.

The striking feature of most Canadian privacy statues is that they do not assign duties throughout an organizational hierarchy. Unlike health and safety statutes, privacy statutes typically impose duties on organizations themselves or “heads” of organizations but do not impose legal duties on employees and others who handle personal information. The imposition of statutory legal duties on employees and agents is more common in Canadian health privacy legislation, but the duties imposed are very general.

The Commissioner measured Elections Ontario against Ontario’s provincial public sector privacy statute – the Freedom of Information and Protection of Privacy Act. FIPPA features a data security provision typical of Canadian privacy legislation: “Every head shall ensure that reasonable measures to prevent unauthorized access to records in his or her institution are defined, documented and put in place, taking into account the nature of the records to be protected.” It’s up to the head – most often a cabinet minister or board chair – to determine what duties to assign to whom, to assign the duties and to enforce the duties, all without the backing of statute. As Elections Ontario might illustrate, this is a difficult task that should not be taken lightly.

The Commissioner’s Elections Ontario report describes a total failure of internal responsibility. Workers failed to follow the identified protocol for data handling. The two supervisors on the privacy-sensitive project regularly worked at a different building than the workers handling the data. Middle management appointed two supervisors who were not competent to deal with data protection; one apparently thought encryption involved zipping and password protecting files. Senior management put in place a policy framework that the Commissioner said included significant flaws. She also suggested that senior management, after the matter was escalated, failed in providing the leadership necessary to muster an appropriate breach response and remedial plan. There were enough problems in the Commissioner’s eyes to justify a bottom-to-top flogging.

The problem with privacy legislation is that it seems to suggest that data protection is too easy. If data protection were easy enough to be handled by a single accountable person we would never have data breaches. In reality, data protection is complex. It involves risks that need to be managed through a coordinated bottom-to-top effort, especially involving the competent supervision of individuals.

The consequences of failure are frightening. The Commissioner’s report must be terribly painful to Elections Ontario and its management, and will serve as a handy road map for prosecution in the now-commenced class proceeding.

Elections Ontario’s Unprecedented Privacy Breach: A Special Investigation Report (31 July 2012).

We try not to use this blog for too much direct promotion but are genuinely excited about our recently-announced September 19th information management and privacy session for in house counsel.

Here’s a program description.

This session is an update for in house legal counsel on critical information management issues. We will focus on current developments and their practical implications. Topics will include:

• Things you must do now to maintain access to business system information
• Recent privilege cases and what they mean for in house counsel
• Data security, breach response and privacy class actions – implications for you and your organization
• Employee medical information management – essentials and developments

­

The session will be held at:

Hicks Morley Toronto Office
77 King Street West, 39th Floor
Toronto
8:30 a.m. – 10:30 a.m.

View Map ­­

Your presenters will be Daniel J. Michaluk, ­Frank J. Cesario and Amy R. Tibble.

We’ve planned the 1.5 hour session to have 30 minutes of professional content that is accredited by the Law Society of Upper Canada. Accreditation is pending.

If you are in-house counsel who follows this blog, even if not a Hicks Morley client, we would be happy for you to attend on a complementary basis. Please register here.

On July 25th the Information and Privacy Commissioner for British Columbia  issued a significant report on public sector criminal background checks, pushing the government of British Columbia to further tailor the scope of its program.

The report was about the province’s screening program and not vulnerable sector checks governed expressly by British Columbia criminal record check legislation. The program seems to be a top notch program. For example, it applies based on a job classification scheme developed based on a risk assessment, it limits police checks in favor of CPIC checks and it features adjudication of positive results by a body at arms length from the hiring department.

Nonetheless, the Commissioner conducted a very close review and took issue with a number of aspects of the program, especially its breadth. For example:

• She held that four out of the ten job classifications to which a background check requirement applies are redundant or drafted too broadly. According to the Commissioner, for example, a mere responsibility for handling personal information should not attract a background check requirement given there are other means of controlling for misuse of personal information (like access control and access logging, she mentioned).
• She held that requiring a check when dictated by third-parties was “fundamentally flawed”: “Government should determine when it will conduct criminal record checks on its employees and it should ensure that it only conducts record checks when it is authorized by FIPPA to do so.”
• She held that post-employment checks should not be a routine requirement except for “particularly sensitive functions” and when someone is hired into a new position with a significantly different risk profile.

The third-party finding is aggressive, but might have been conceived by the Commissioner as a means of giving the British Columbia government bargaining power over the third-parties with whom it deals. The post-employment check limitation is also a significant constraint. In making this finding the Commissioner drew from Arbitrator Michel Picher’s finding in a case involving  firefighters at the City of Ottawa. The Commissioner’s finding in this report and her adoption of Mr. Picher’s principled statements are likely to be taken together as quite authoritative.

The Commissioner also addresses issues related to the identification of candidates, notification and record retention.

Investigation Report F12-03 (25 July 2012, Information and Privacy Commissioner for British Columbia).