Ontario data breach class action settlement approved

Canadian data breach litigation is still in its early phase. On July 3rd, the Ontario Superior Court of Justice approved a settlement in a significant class action that was brought after a public health nurse lost a USB key containing the personal information of about 85,000 individuals who had been immunized during the 2009 H1N1 scare.

The settlement involved the creation of a claims period open until August 1, 2016 to allow class members to claim for economic loss but no damages payment otherwise. As Justice Lauwers explained, the defendant and its insurer agreed to accept the risk of economic harm over the six and a half year claim period, after which, he held, “the risk will be virtually eliminated.”

In approving the settlement, Justice Lauwers stressed that the plaintiff faced a difficult case given, as time passed, his ability to prove compensable damages worsened. He said:

It is important to consider the context in which this case developed. The USB key was lost on or about December 16, 2009. In the midst of the anxiety created by that loss, the action was started on April 26, 2010. The certification motion was heard on December 16, 2010 with the decision rendered on February 4, 2011, and the certification order signed on April 26, 2011. Over the course of this action, anxiety about the abuse of private information has given way to the realization that it is now probable that no one has the missing USB key. This inference comes from the fact that no class member has claimed that information on the key has been used to financially damage his or her interests. This case, it bears emphasizing, would look far different if information from the lost USB key had been abused by a wrongdoer…

As a matter of law, in my view, the chances of success, in the circumstances as they have unfolded since the USB key was lost, are quite low.

Justice Lauwers approved an agreement to pay $500,000 in costs (including taxes and disbursements) to class counsel plus an amount equal to 25% of any claims paid. Though loss to individuals was not the basis for this amount, it equals about $5.99 per affected individual for a suspected breach involving the loss of name, address, telephone number, gender, date of birth, Ontario health number, health card expiration date, name of primary care provider and “some additional personal health information.”

Rowlands v Durham Region Health, 2012 ONSC 3948 (CanLII).

Arbitrator says demand for personal cell phone records not justified

In a recently published award, arbitrator Michel Picher held that an employer was not justified in demanding production of an employee’s personal cell phone records.

The employee – an apprentice diesel mechanic who worked in a safety sensitive environment – was observed holding his Blackberry device contrary to company policy. He said his shift was almost over and he was just checking the time. In its investigation, the employer asked for copies of his cell phone records.

Arbitrator Picher inferred that the request was made for the purpose of checking whether the employee had used his phone earlier in the shift, an improper purpose (not supported by reasonable grounds, I note) and a significantly different purpose than following up on a significant accident or near miss. Arbitrator Picher has previously endorsed limited requests for personal cell phone records for the latter purpose.

The Canadian Pacific Railway and CAW-Canada, Local 101 (M. Picher, 22 November 2011).

IPC/Ontario says institution facing data breach should not have protected employee

The IPC/Ontario issued a privacy complaint report on July 3rd that illustrates the downside of protecting an employee who has gained unauthorized access to personal information.

The IPC likes institutions and health information custodians to hold employees accountable for gaining unauthorized access to personal information by imposing discipline and (controversially) sharing the details of the disciplinary response with affected individuals. It made this position clear in 2010 in HO-010. In this most recent report, it even suggested that institutions should have a policy that calls for disclosing the details of its disciplinary response barring exceptional circumstances.

The report is about an OPP clerk who gave access to an occurrence report about the complainant to an acquaintance who was the complainant’s landlord. The OPP admitted the breach but also shouldered the blame. It counseled the clerk and provided remedial training to all clerks. In its representations to the IPC the OPP said “The clerk appeared to have acted alone, and made a single error on one occasion resulting in the disclosure of a single record. We believe that this mistake was due to a lack of training, rather than as a result of malice or intent.”

The IPC quoted this representation twice before rejecting it and reiterating the principles from HO-010. It was a very problematic position to take given HO-010 and the sensitivity of the personal information in a police occurrence report. It is also hard to frame actions like the clerk’s as merely negligent.

The IPC then, as invited by the OPP’s position, engaged in a detailed analysis of the OPP privacy governance framework before making a number of negative findings about the OPP’s policies, procedures and training. One wonders whether the OPP’s privacy governance framework would have been questioned at all if it had simply assigned fault to the clerk.

Ontario institutions and health information custodians who are faced with a privacy breach need to conduct thorough investigation with good causal analysis before the IPC gets involved. If fault lies with one or more employees, assigning fault and imposing appropriate consequences appears to be a relatively simple way to meet the IPC’s expectations. Taking such steps may even dissuade the IPC from asking broader and potentially more painful questions about organizational privacy governance.

Ontario (Community Safety and Correctional Services) (Re), 2012 CanLII 37748 (ON IPC).

Arbitrator suggests that discipline undermines grounds for referral to psychiatric assessment

Here is another case in which an arbitrator held that an employer did not have grounds to order an employee to attend a psychiatric assessment. Ontario Arbitrator Nimal Dissanyake issued his order on April 3, 2012. He was driven by a number of factors:

  • the employee had demonstrated a pattern of angry behavior, but had not made an express or implied threat;
  • the employer did not base its assessment direction on input from a company physician/advisor;
  • the employer’s decision-maker admitted that he (simply) had doubts about the employee’s mental health; and
  • the employer disciplined the employee for the same behavior that caused it to issue its assessment direction.

While Arbitrator Dissanyake rejects “a technical rule that conduct that had been the subject of discipline in the past may not be relied upon in requiring an IME,” his reasoning suggests that basing a discipline charge and an order to attend an IME on the same behavior is problematic. While employers should be careful about picking their means of managing aggressive or angry behavior in the workplace, question whether an employee can have the mental capacity to commit a workplace offence and, at the same time, have a mental condition that (on reasonable grounds) requires assessment.

IBEW, Local 636 and Niagara Peninsula Energy Inc. (Dissanyake, 3 April 2012).

Outburst does not justify employer’s direction to attend psychiatric assessment

An award from June 29th of last year was just published in which Arbitrator Michel Picher held that an employer was not justified in directing an employee who had made a concerning outburst to a psychiatric assessment.

The employee was a 26-year mechanic who became frustrated about the theft of his tools. The company alleged he told a manager that he, “was bringing in a knife, and that the next time someone touches anything of his he will cut their hand or head off.” He later said he would pray that the manager and his family would answer to God. The company referred the employee to its OHS physician, who  recommended that the employee attend an IME. This led to a lengthy dispute that came before Arbitrator Picher five years later, after the parties agreed the employee would be reinstated; they argued only about the terms of reinstatement, including whether an IME would be a condition of return.

Employers faced with concerning behavior are in a dilemma, and should never be too confident in their own ability to assess an employee’s disposition to commit an act of violence. This case is notable as highlighting the requirement to have a reasonable basis for requiring a psychiatric assessment, but the finding is very qualified. Arbitrator Picher noted that the employee had supported his rejection of the IME direction by submitting medical evidence from his own physician, evidence that the company appeared not to answer in the arbitration. He also noted that the precise statement made by the employee was in dispute, and the employer did not bring the manager to the hearing. Finally, Arbitrator Picher ordered the employee to be reinstated without compensation. In a way, the employer got what it wanted: an independent review of the circumstances prior to reinstatement.

The Canadian Pacific Railway and CAW-Canada, Local 101 (M. Picher, 29 June 2011).

Information about business subsidies received not personal information

On June 15th the Alberta Court of Queen’s Bench affirmed an Alberta OIPC finding that amounts of financial assistance received by livestock farmers under two government programs were not the farmers’ personal information. The OIPC held that even if the information could be linked indirectly to individuals (e.g., owners of sole proprietorships or closely held corporations) there was no proof that it had a “personal dimension” sufficient to qualify. The Court held the OIPC’s order was transparent and detailed, “made sense” and was consistent with the purpose of Alberta FIPPA.

Agriculture Financial Services Corporation v Alberta (Information and Privacy Commissioner), 2012 ABQB 397 (CanLII).

Majority of BCCA says accuracy duty applies broadly

Yesterday the Court of Appeal for British Columbia restored a finding that the British Columbia Ministry of Children and Family Development breached British Columbia FIPPA by failing to make every reasonable effort to ensure the accuracy of personal information before using it to answer a background check inquiry.

This is a very well-litigated dispute about a communication made by the Ministry to a social services employer who contacted the Ministry, with consent, to check into the background of a new employee. The Ministry disclosed the existence of a complaint made against the employee. It also noticed some irregularities in its file, did a full review of the file (without going behind the file to make inquires) and said to the employer, “to be on the safe side, I would prefer that he may be supervised, if you can do this.”

The employee was terminated and has since been on a long campaign to seek redress. In May 2010, the British Columbia Court of Appeal dismissed the employee’s $520 million action against the Ministry and others as disclosing no reasonable cause of action. About a year earlier, the Court of Appeal heard an appeal of the employee’s privacy complaint and sent it back to the B.C. OIPC so the OIPC could consider whether the Ministry breached section 28 of B.C. FIPPA. Section 28 imposes a duty to make every reasonable effort to ensure the accuracy of personal information that is used to make a “decision that directly affects [an] individual.”

In yesterday’s decision, a 2-1 majority of the Court held that the OIPC was reasonable to conclude that the Ministry’s act of issuing a caution to the employer entailed a use of personal information in making a “decision that directly affects [an] individual.” Madam Justice Bennet wrote for the majority. Most significantly, she affirmed the OIPC’s broad reading of “decision” – to encompass formal and informal decisions – as reasonable. Mr. Justice Hinkson did not take issue with this finding in his dissent. He held that Ministry’s highly qualified advice could not even be elevated to the status of an informal decision.

The public sector access and privacy statutes in Nova Scotia, Newfoundland, Prince Edward Island, Alberta and the three territories contain provisions with similar or identical language to section 28.

Hat tip to Eileen Vanderburgh from the ABHL Information + Privacy Law Blog.

British Columbia (Ministry of Children and Family Development) v. Harrison, 2012 BCCA 277.

Life trumps privacy

“Life trumps privacy.”

These are not my words. It’s a line from a 2007 practice tool published by the British Columbia and Ontario privacy commissioners entitled “Emergency Disclosure of Personal Information by Universities, Colleges and other Educational Institutions.” The tool focuses on the disclosure of personal information to prevent safety-related harm, an issue that privacy commissioners are sensitive to because privacy regulation often comes under attack as causing or contributing to a violent incident. Commissioner Cavoukian also wrote an editorial in the Washington Post following the 2007 Virginia Tech shootings and spoke to the CBC’s The Fifth Estate in 2009 after the Nadia Kajouji suicide at Carleton University – both times arguing that privacy legislation does not impede threat management.

This is relevant today because privacy and safety is back in the news. The National Post published an article yesterday about Travis Baumgartner’s Facebook posting. About two weeks before the multiple murder in which he is implicated occurred, Baumgartner posted, ““I wonder if I’d make the six o’clock news if I just starting popping people off.”

Employers do not have a duty to routinely monitor the internet for signs of concerning employee behavior.To assert such a duty is to take an employer’s duty to provide a safe work environment too far. Monitoring would be costly, difficult to do effectively and, as noted in the article, raise privacy issues.

Employers do, however, have a duty to “know what they know” about troubled employees and others who frequent the workplace. There are too many stories about concerning behaviors that were observed by other employees in the workplace and that were not assessed except in hindsight of a catastrophe. Employers must have means by which troubling behaviors exhibited by employees and others are reported and properly assessed. This has become the clear best practice, one that developed out of the landmark 2002 report of the U.S. Secret Service and U.S. Department of Education.

And what if an employee simply reports another employee’s Facebook posting as being of concern? It should be assessed. And once there is a legitimate reason to assess, employers must be thorough and gather relevant information from all available sources, including the Internet. Employers can’t afford to draw artificial lines between behavior inside and outside of the workplace in assessing a legitimate concern.

I’d like to say that privacy laws do not stand in the way of collecting personal information in the course of a threat assessment, but that’s not necessarily the case. Ontario’s provincial public sector privacy legislation, in particular, contains a very restrictive “indirect collection” prohibition. Law enforcement can collect personal information from third-parties without consent in order to assess a threat, but institutions acting in a “civilian” capacity cannot. There are ways to manage the prohibition through policy but, nonetheless, the legislation should be changed. After all, life trumps privacy.

Employer has duty to protect employee’s reputation in circumstances surrounding termination

An employer has a duty to provide a safe and harassment free workplace, but this is different than a duty to protect an employee’s reputation. The assertion of a duty to protect reputation is of great concern to employers given how often employees who are targeted on the internet by “outsiders” turn to their employers for help. On May 29th the Federal Court of Appeal held that an employer breached a duty to protect its employee’s reputation, but also made clear that the duty arose only out of the well-established duty to exercise good faith in terminating employment – the “Wallace duty.” Justice Sharlow explained:

As I understand the adjudicator’s reasons, he did not conclude that PWGSC as Mr. Tipple’s employer had a free-standing duty to protect his reputation. Rather, he found that the law imposed on PWGSC a duty of good faith when terminating Mr. Tipple’s employment. When PWGSC decided to terminate Mr. Tipple’s employment in the midst of press reports impugning his integrity on the basis of information leaked from PWGSC which senior officials of PWGSC knew to be false, the duty of good faith included the duty to take reasonable steps to ensure that the termination did not cause undue and unjustified harm to Mr. Tipple’s reputation. In my view, the adjudicator’s conclusion is well within the scope of the Wallace principle, and is reasonable. I conclude that the judge erred in setting aside the award of $250,000 for loss of reputation.

The facts are worth a close read and detailed analysis, but I’ll simplify here and say that employers who terminate an employee who is embroiled in public controversy without asserting cause for reasons related to the controversy ought to beware of a positive duty to protect the employee’s reputation.

Tipple v. Canada (Attorney General), 2012 FCA 158 (CanLII).

“Meaningful on call duties” mean position has safety-sensitive status

In a March 30th decision, Arbitrator Michel Picher said, “An employee who is trained and remains meaningfully on call to perform safety sensitive functions must be recognized as having safety sensitive status, regardless of the frequency of the functions.” In applying this principle, he held that qualified Diesel Mechanics at a rail yard were in a safety sensitive position even though they only were required to operate locomotives on a very occasional basis – some as little as a few times a year. Arbitrator Picher’s finding means that the mechanics are subject to special medical assessment and drug and alcohol testing requirements.

Canadian Pacific Railway Company and CAW-Canada, Local 101 (30 March 2012, M. Picher).