Case Report – Federal Court considers accuracy principle, orders damages under PIPEDA

The Federal Court issued a PIPEDA judgment today in which it considered an organization’s duty to maintain accurate records of personal information and ordered damages under PIPEDA, both for the first time.

The judgment is about an inaccurate credit report given by a credit reporting agency to a bank. The agency wrongly associated negative credit information with the applicant based on the similarity between his identifiers and the identifiers of the individual to whom the negative information related. The applicant made some inquiries and diagnosed the error in early January 2008. It took the agency about 20 days to confirm the error, amend the applicant’s credit record and send a notice of correction to the bank. The applicant took issue with how forthright the agency was in dealing with the matter, both in its willingness to accept responsibility for the error (as opposed to blaming the collection agency that had supplied it with the negative information) and in notifying the bank.

The Court held that the credit reporting agency:

  • failed to keep the applicant’s personal information “as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used” as required by PIPEDA principle 4.6;
  • failed to keep the applicant’s personal information “sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about the individual” as required by PIPEDA principle 4.6.1; and
  • failed to provide amended information as required by PIPEDA principle 4.9.5 because it simply advised the bank that the applicant’s credit record had been amended without providing a copy of the amended credit record or otherwise indicating that the amendment was in the applicant’s favor.

In upholding the accuracy complaint, the Court rejected the agency’s argument that its use of industry standard matching practices (which contemplate some margin of identification error) and its correction effort rendered it in compliance. The Court was very clear that neither compliance with industry standards nor complying with the duty to correct are valid defences to an accuracy complaint, but did suggest that liability for keeping inaccurate personal information is not absolute. It stated:

PIPEDA does not require that personal information be completely accurate, complete, and up- to-date; rather, it requires that personal information be as accurate, complete, and up-to-date “as is necessary for the purposes for which it is to be used.” Thus, it is the use that the information is put to that dictates the degree of accuracy, completeness, and currency the information must have.

It then suggested that the agency failed to take the reasonable precaution of conducting a manual check prior to issuing its credit report.

The Court awarded the applicant $5,000 in damages for humiliation suffered. While it recognized its recent statement in Randall v. Nubodys Fitness Centres that damages ought to be awarded in “egregious situations” only, it held that damages should be ordered to “uphold the general objects of PIPEDA and uphold the values it embodies,” including by deterring future breaches. In awarding damages in the circumstances, the Court noted the evidence of humiliation, the credit reporting agency’s profit motive and the credit reporting agency’s “failure to take prompt, reasonable steps to correct the record and reverse the situation it had caused.”

There are other aspects of the Court’s judgment of significance, including aspects related to the scope of the Federal Court’s jurisdiction under section 14 and its jurisdiction to make compliance orders under section 16(a).

Mirza Nammo v. Transunion of Canada Inc., 2010 FC 1284.

Case Report – Personal e-mails not subject to FOI legislation

On December 13th, the Ontario Superior Court of Justice – Divisional Court held that employee personal e-mails stored on government e-mail servers are not subject to provincial FOI legislation.

The Court read “custody or control” purposely and narrowly. It held that providing access to personal e-mails does not advance the purpose of FOI legislation – advancing public participation in the democratic process.

The Court’s reasoning is very broad. The only atypical fact that it relied upon was that the e-mails in question were stored in a separate folder rather than intermingled with e-mails related to governmental affairs. The Court minimized the significant of this fact as follows:

That said, it does not follow that personal emails not filed in a separate folder (as was the case here) are necessarily subject to the operation of the Act. Much will depend on the individual circumstances of each case, but generally speaking, I would expect very few employee emails that are personal in nature and unrelated to government affairs to be subject to legislation merely because they were sent or received on the email server of an institution subject to the Act.

Importantly, the decision does not recognize a privacy right in personal e-mails or preclude institutions from auditing or inspecting personal e-mails. The Court makes relatively clear that its decision does not rest on employees’ privacy interest in the content of their e-mails.

Copy below circulated by Heenan Blaikie. Congratulations to Priscilla Platt and Brad Elberg, who acted for the City. As the Court (remarkably) says, its decision has implications for public sector employees that are “staggering.” Look for an appeal.

City of Ottawa v. Ontario (Information and Privacy Commissioner) (13 December 2010, Ont Div. Ct.).

Case Report – Pre-action discovery denied as unlikely to identify wrongdoer

On November 24th, the Ontario Superior Court of Justice dismissed an application for pre-action discovery because the requested order was not certain to identify the alleged tortfeasor.

The applicant wished to identify a young, female snowboarder who ran into him and injured his ankle. He sought an order allowing him to review records belonging to the ski hill at which the accident happened, including photos of female members between the ages of 12 and 20 years of age who may have been at the hill on the date of the accident.

Madam Justice Warkentin dismissed the application, primarily because the requested order was not likely to lead to the reliable identification of the alleged tortfeasor. She said:

In this motion, there is nothing in the evidence before me to suggest the snowboarder in question was a season ticket holder or a snowboard rental user on the date in question. The applicant is seeking disclosure of a large number of personal records in the hopes that he may be able to identify the same young female skier that he saw only briefly during a collision where he was injured. It was his contention that he has sufficient recollection of the young skier in question to be able to reasonably identify her from membership or other photographs retained by the ski resort, notwithstanding that the applicant admits the snowboarder who collided with him was wearing ski clothing, including goggles, (albeit she may have removed them after the collision), a toque and other winter clothing.

Warkentin J. held that the chance of identifying the correct individual was “remote,” far below the relatively high degree of certainty she said courts should demand. The applicant relied on gender, age and attendance at the hill on the date of the accident as identifiers. The degree to which these data points narrowed the breadth of the proposed inspection is not clear from the record, but Warkentin J. clearly perceived that the order would affect a fair sized group of individuals.

Warkentin J. also held that (1) the age of the individuals who would be affected by the order was a relevant, though not determining, factor weighing against disclosure and (2) that the enactment of PIPEDA is evidence of public policy favoring the confidentiality of customer information.

Douglas. v. Loch Lomond Ski Area, 2010 ONSC 6483 (CanLII).

Information Roundup – 12 December 2010

Here are some good info and privacy links:

As for my regular non-law media share, I spent some good time today trying to decide my favorite album purchase of the year. I gave both Tom Petty and the Heartbreakers’ Mojo and Robert Plant’s Band of Joy a good listen this afternoon and narrowly give the call to Plant. Here he is talking about the album. He’s very thoughtful, which shows in an album that’s dignified, polished and darn good.

And just to remind you that Plant has contributed so much beyond what he contributed as part of Led Zeppelin, here’s a classic contribution to the 80s.

Later!

Dan

My CLawBie Nominations

Here are my nominations for the 2010 CLawBie awards.

I’m going to spend my nominations on law firm blogs this year. Many law firm blogs miss the mark because because they fail to capture the essence of a blog. Law firm blogs are getting better though, and I’d like to nominate three that are worthy of recognition:

  1. Entertainment & Media Law Signal. This a blog published by Heenan Blaikie’s Entertainment Law Practice, and proves that even large firms can create a genuine legal blog. Editors Bob Tarantino and Paul Chodirker link to lots of timely and relevant content, are not beholden to any particular structure of post and even employ humour! Most significantly, however, they are very willing to give props to lawyers who are not from Heenan Blaikie. This reflects well on them and breaks new ground for Canadian law firm blogs.
  2. Human Resources Legislative Update. Law firms don’t have to emulate independent legal blogs to blog well. Human Resources Legislative Update is a blog published by Hicks Morley (my own firm) that is as conservative as a law firm blog can be, but is excellent because of the way it addresses a relevant and very targeted niche. Human Resources Legislative Update covers legislative developments in human resources law that are likely to affect the firm’s clients. Coverage is timely and comprehensive. Posts are well written and easy to digest because Human Resources Legislative Update is written by knowledge management lawyers (Tierney Read Grieve and Pamela Hillen) who know how the legislative process works and can distill the significance of a legislative change.
  3. Ontario Rules of Civil Procedure Blog. I like this FMC blog for the same reason I like the Hicks Morley blog. It provides current information on very relevant and niche subject matter – the interpretation of the 2010 landmark amendments to the Ontario Rules of Civil Procedure. Unfortunately, posting frequency has tailed off of late, and I hope editors Jeremy Millard and Tiffany Soucy can find the time to keep going in 2011 (perhaps with more descriptive headlines). They’ve put out a quality blog that is likely more widely appreciated than they know.

I’d also like to give thanks to my most regular reads, all of whom have given me significant thoughts to ponder this year. These include Antonin Pribetic, Garry Wise, Erik Magraken, Omar Ha-Redeye, Michael Fitzgibbon and David Fraser.

Case Report – Master denies relief, says parties should have engaged in discovery planning

On November 2nd, Master McLeod of the Ontario Superior Court of justice dismissed a motion that sought an order to deal with alleged over-production because the parties did not collaborate in developing a discovery plan. He said the following about discovery planning:

Discovery planning is intended to permit the parties to map out the most efficient and effective way to organize the production and discovery needs of the particular action having regard to the complexity of the records, the issues in dispute and the amounts at stake. It cannot be an adversarial exercise. Planning is also intended to minimize the need for court intervention but obviously there will be situations in which there are legitimate disagreements. In a case managed environment a case conference may resolve this and in other cases the same end may be achieved by a motion for directions. Specific direction could have been sought on any of the occasions that this matter was previously before the court.

A case conference or a motion for directions may well involve competing discovery plans but establishing efficient and effective procedures for these matters must not itself become an occasion for adversarial advocacy. If that occurs the whole point of the exercise will be defeated. Certainly obtaining direction from the court should not normally require lengthy affidavits, voluminous documents, factums and briefs of authorities. A contested motion is a poor planning forum.

The parties were engaged in a construction lien action, but agreed to exchange production. Master McLeod stressed that an exchange of production in accordance with the Rules can be very wasteful in construction lien actions, but nonetheless denied relief. He said, “It is not appropriate to proceed without a plan and then to launch a motion that implies the other party is in breach of the rules or is doing its production wrong.”

Hat tip to Peg Duncan.

Lecompte v. Doran, 2010 ONSC 6290 (CanLII).

Case Report – Federal Court of Appeal clarifies jurisdiction to hear deemed refusal ATIP applications

On November 22nd, the Federal Court of Appeal clarified the circumstances in which the Federal Court has jurisdiction to hear an application for review of a deemed refusal under the Access to Information Act. The Court held that the Information Commissioner does not “cure” a deemed refusal by issuing a report that recommends a time frame in which an institution should respond to a request. A requester may therefore apply to Federal Court within 45 days of such a report, subject to a potential mootness argument that may be raised based on an answer that is delivered by the institution prior the hearing of the application.

Statham v. Canadian Broadcasting Corporation, 2010 FCA 315.

Case Report – SCC deals with the disclosure of customer information to law enforcement

On Wednesday, the Supreme Court of Canada held that an accused person had no reasonable expectation of privacy in detailed information about his residential power consumption over a period of time. The decision contains a significant dialog about the disclosure of customer information to law enforcement and, in such circumstances, the effect of terms governing the customer relationship.

Background

An digital recording ammeter (or “DRA”) is a device that is installed on a power line to measure electrical consumption. In this case, the police asked an electrical service provider to install one to measure electrical consumption at a residence they suspected of housing a grow-op. The service provider agreed, and later produced a graphical representation of showing power consumption over five days. The graph showed a pattern of 18-hour cycles of high consumption, which is consistent with the presence of a marijuana grow-op. Partly on the strength of this evidence, the police obtained a warrant that led them to lay charges.

Whether the police violated the accused person’s reasonable expectation of privacy by conducting a warantless “DRA search” was the key issue in the case. It turned on (1) the effect of a regulatory provision promulgated under the Alberta Electrical Utilities Act that expressly permits Alberta service providers to disclose customer information to the police without consent unless contrary to their express wishes and (2) the quality of the electricity consumption information (and whether it went to the accused person’s “biographical core of personal information”). Note that the statutory permission, in the circumstances, was also backed by a contractual provision that warned the accused person that his information could be provided to law enforcement “for drug investigations.”

The Effect of Terms Governing Customer Information

A seven judge majority recognized the statutory permission as a relevant factor that weighed against a reasonable expectation of privacy.

For Deschamps J. (joined by Charron, Rothstein and Cromwell JJ.) the permission was a relevant factor. For Abella J. (joined by Binnie and LeBel JJ.) it was the dominant factor in the circumstances. In principle, the two majority judgments are similar.

Not so for the dissenting judges – McLachlin C.J. and Fish J. Here is a passage from their jointly written dissent:

Every day, we allow access to information about the activities taking place inside our homes by a number of people, including those who deliver our mail, or repair things when they break, or supply us with fuel and electricity, or provide television, Internet, and telephone services. Our consent to these “intrusions” into our privacy, and into our homes, is both necessary and conditional: necessary, because we would otherwise deprive ourselves of services nowadays considered essential; and conditional, because we permit access to our private information for the sole, specific, and limited purpose of receiving those services.

A necessary and conditional consent of this sort does not trump our reasonable expectation of privacy in the information to which access is afforded for such a limited and well-understood purpose. When we subscribe for cable services, we do not surrender our expectation of privacy in respect of what we access on the Internet, what we watch on our television sets, what we listen to on our radios, or what we send and receive by e-mail on our computers.

Likewise, when we subscribe for public services, we do not authorize the police to conscript the utilities concerned to enter our homes, physically or electronically, for the purpose of pursuing their criminal investigations without prior judicial authorization. We authorize neither undercover officers nor utility employees acting as their proxies to do so.

The response to this argument by the majority is remarkably subtle. Deschamps J. agrees that the reasonable expectation of privacy standard is normative, suggests that she is not prepared to make a general pronouncement about the constitutional effect of “disclosure clauses,” but says that terms governing a customer relationship are nonetheless one relevant factor of many in assessing the reasonableness of a privacy expectation. Significantly, however, Deschamps J. does argue that a service provider’s equal interest in information about the services it provides to its customers weighs against section 8 protection:

A final factor affecting the informational privacy analysis and diminishing Mr. Gomboc’s expectation of privacy in the information disclosed by the DRA is the fact that his interest in the electricity use data was not exclusive. His electricity consumption history was not confidential or private information which he had entrusted to Enmax. As the supplier of electricity, Enmax had a legitimate interest of its own in the quantity of electricity its customers consumed.

Abella J.’s judgment on this issue is similar. Like Deschamps J., she deflects the strong minority argument: “There can be no examination of the totality of the relevant circumstances without including the fact that the Regulation exists. It cannot, therefore, be seen as neutral or irrelevant.”

Biographical Core and Personal Information

Five of the nine judges held that information about residential power consumption over a period of time reveals an individual’s “biographical core” of personal information.

Deschamps J., in the minority on this issue, held that police use of DRA technology reveals only “information about electricity use” and not about the intimate and personal choices of the occupants of a residence. She holds that DRA data can support a very strong inference that a residence is being used as a grow operation, but not much else. Though information about criminal activity is protected by section 8, Deschamps J. suggests that DRA’s focus on information about criminal activity minimizes its impact and, remarkably, favours its use as a privacy protective surveillance technique.

McLachlin C.J. and Fish J. take great exception to Deschamps J.’s suggestion that the use of DRA can be justified by its focus on the collection of information about criminal activity: “First, the constitutionality of a search does not hinge on whether there are even more intrusive search methods the police could have improperly used.” Aside from making this rebuttal, McLachlin C.J. and Fish J. cite to a law review article for the proposition that hourly electricity data can reveal “personal sleep, work, and travel habits, and likely identify the use of medical equipment and other specialized devices.”

Like McLachlin C.J. and Fish J., Abella J. finds that DRA information reveals information of the kind protected by section 8. She doesn’t reach quite as far though, relying more on the DRA’s efficacy in revealing information about criminal activity itself and the more basic proposition that section 8 protects such information.

Conclusion

Whether in the name of corporate social responsibility or something else, most businesses do not wish their services to be used for criminal activity. There is a relatively indisputable public interest in allowing businesses to report crimes that they discover in dealing with customers, but the legality of asking business to hand over their customer information has been less certain. Accused persons have recently made arguments (similar to that made by McLachlin C.J.C. and Fish J.) that suggest the normative rule embodied in section 8 of the Charter makes businesses’ own interest in records of customer information and any privacy-reducing terms of contract irrelevant. Though somewhat qualified, this judgment suggests that customer information, in particular when governed by terms that permit disclosure to law enforcement, is less likely to be protected by section 8 of the Charter.

R. v. Gomboc, 2010 SCC 55.


Case Report – Federal Court dismisses application, articulates what damages are compensable under PIPEDA

On November 12th, the Federal Court dismissed a PIPEDA application for damages for a loss of employment that arguably flowed from a wrongful disclosure.

The applicant sold the respondent scrap metal for his employer. He began to sell scrap metal to the respondent on the side and apparently sold some of his employer’s scrap metal to his own credit. The employer spoke with the respondent after it noticed a decline in sales. The respondent disclosed the fact that the applicant had opened a supplier’s account in his own name and provided the employer with the applicant’s account statements. The employer terminated the applicant, who filed and then withdrew a wrongful dismissal suit in favour of a PIPEDA application targeted at the respondent.

The Court held that the respondent breached PIPEDA by disclosing the applicant’s personal information without consent. Notably, it suggested that information about the improper sales of the employer’s own scrap metal was “about the employer’s money” and not the applicant’s personal information. This reasoning did not justify the whole of the disclosure, however, as the applicant apparently sourced some of his scrap from means other than his employer.

Despite finding a breach, the Court dismissed the application because the applicant had proven no compensable damages. While acknowledging that the applicant might not have been terminated had the wrongful disclosure not been made, it held that PIPEDA only grants a right to damages intrinsic to the breach of privacy. It explained:

The Court must examine the real nature of the remedy claimed. Such claims as humiliation, loss of community support, diminution of standings and loss of income flowing therefrom (to name but a few) caused by breach of the Act fall within the statutory cause of action created by the Act. Claims for loss of income and similar loss due to termination of employment not caused by breach of the Act, do not.

The source of the Applicant’s complaint is the loss of his employment. He even claims for loss due to loss of a second job. But all of his loss claimed is tied directly to his termination for cause. While the termination might not have occurred if there had not been disclosure, the nexus to the claimed loss is termination of employment for which Stevens had, but gave up, the right to claim was unlawful.

Stevens v. SNF Maritime Metal Inc., 2010 FC 1137.

Case Report – BCSC awards damages for breach of privacy

On November 15th, the British Columbia Supreme Court awarded $40,000 in damages for defamation and breach of privacy.

The award was based partly on a number of publications made by an ex-husband about his ex-wife that the Court held were defamatory and unjustified. The Court also upheld a privacy claim based on the ex-husband’s use of e-mail communications he obtained from an old home computer and distributed for the purpose of scandalizing his ex-wife.

Nesbitt v. Neufeld, 2010 BCSC 1605.