Source: http://teresascassa.ca/index.php?option=com_k2&amp;view=itemlist&amp;task=tag&amp;tag=Privacy&amp;Itemid=65&amp;limitstart=60
Timestamp: 2019-04-20 17:24:10+00:00

Document:
Canada’s Information Commissioner has tabled a report in Parliament that has deeply troubling implications.
The scandal-in-the-making is a product of three pretty well-known characteristics of the current government – first, they have been utterly committed to dismantling and destroying every trace of the Long-Gun Registry established under the former Liberal government; second, their commitment to transparency and accountability is situational at best; and third, they have a tendency to bury important and sometimes controversial amendments in omnibus budget implementation bills.
Here’s what happened: The Conservative government was determined to do away with the long gun registry. It introduced a bill on October 25, 2011 which was eventually passed into law as the Ending the Long-Gun Registry Act (ELGRA) . This statute came into effect on April 5, 2012. However, no doubt anticipating the demise of the registry, an unnamed individual filed an access to information request on March 27, 2012. This applicant sought an electronic copy of all records in the Canadian Fire Arms Registry relating to firearms that were neither prohibited nor restricted. These were the specific records slated to be destroyed under s. 29 of the ELGRA.
The applicant eventually received a response to his request for records, but he was not satisfied with the response. He was of the opinion that the information provided was incomplete and was also concerned that the RCMP had gone ahead and destroyed responsive records. The Information Commissioner investigated and agreed that the response was incomplete. She also concluded that responsive records had been destroyed by the RCMP, notwithstanding the fact that they knew that the records were subject to a right of access. The destruction by government entities of records subject to a right of access is an offence under 67.1 of the Access to Information Act.
On March 26, 2015, the Information Commissioner informed the Attorney General of Canada, the Hon. Peter MacKay, of the possible commission of this offence. She also notified the Minister of Public Safety that in her view the complaint was well-founded. She recommended that any responsive records still in the possession of the RCMP be provided to the applicant. The Minister responded, indicating that he had no intention of following this recommendation.
It is clear that the access request slipped through the cracks between the introduction of the bill in October 2011 and its passage into law. It is also clear that granting access to the records would go against the intent expressed in the legislation to destroy the registry. The merits or demerits of the long-gun registry have already been the subject of much heated debate, but the battle over its continued existence is at an end. What is troubling is that the “loophole” existed, that a perfectly legitimate access to information request was filed, that the Minister of Public Safety committed to preserve records until outstanding access requests had been dealt with, and that the information was nonetheless destroyed.
What the government should have done was to address the access issue in the ELGRA in the first place. The wisdom of backdating the law to suspend access to information requests retroactively to the date the Bill was introduced in Parliament could have been debated as part of the legislation to put an end to the long-gun registry. Having omitted to do this, what the government has done instead is add to its budget implementation bill (Bill C-59) a series of provisions that retroactively remove the right of access to the long-gun registry data. The right of access is terminated on the date the long-gun Bill was introduced into Parliament (October 25, 2011). It effectively also removes any obligation to retain records, and makes their destruction legitimate. It also removes any liability of the Crown or its agents or employees with respect to the destruction of records.
It is true that these provisions will “fix” the oversight in the original long-gun Bill. However, as the Information Commissioner points out, they also retroactively absolve the RCMP of having destroyed records when it was clearly illegal to do so, and when the Minister of Public Safety had committed to the preservation of the records pending the resolution of outstanding access requests. The actions appear to have been illegal under the law as it stood at the time. Any pot smoker with a conviction for possession will tell you that it doesn’t matter what you think the law SHOULD be; what matters is what the law actually says when you carry out the transgressive act. Unless, of course, you have a legislative time machine that you can use to change the law at the time of your transgression. The Conservative government has such a legislative time machine. It is yet another one of those distasteful omnibus bills that offer a convenient sidestep to democratic debate and accountability.
This, ultimately, is the real problem and central matter for concern. The long-gun registry is – well – long gone. There was indeed a legislative loophole that created a problematic gap for a government that had committed to the total destruction of the registry records. But the ability to use omnibus bills to rewrite history and to absolve conduct that was both illegal and contrary to government assurances is ugly. And, as the Information Commissioner suggests, it is perhaps also a very dangerous precedent.
The Ontario Court of Appeal recently allowed a proposed class action proceeding for breach of privacy. This on its own is not unusual – such proceedings are increasingly common in Canada. (See earlier post on this subject here). What is particularly interesting about this decision is that the Court of Appeal ruled that Ontario’s Personal Health Information Protection Act (PHIPA) did not pose a barrier to tort proceedings. It had been argued that the provincial legislation created a “complete code” for dealing with breaches of personal information protection in the health care context in Ontario, and that tort law recourse was therefore not possible. This is an important decision for health care consumers, as class action litigation is emerging as an important means of redress and accountability for failures to adequately protect personal information. The decision should also send a wakeup call to hospitals and other health information custodians in the province.
In Hopkins v. Kay the representative plaintiff alleged that her medical records – along with those of 280 other patients at the Peterborough Regional Health Centre – had been improperly accessed by a hospital employee. The legal claim was based on the tort of intrusion upon seclusion, and the key issue was whether such recourse was precluded by the existence of PHIPA.
Writing for the unanimous Court, Justice Sharpe framed his analysis around two issues: first, whether there was a legislative intent to create a complete code when PHIPA was enacted; and second, whether the case law supported a conclusion that in the circumstances the jurisdiction of the Superior Court to consider a tort claim was ousted.
The relevance of the “complete code” issue is that if the legislature intended to create a complete code to deal with personal health information protection, then, by implication, it intended to preclude any separate tort recourse. In considering whether the intent was to create a complete code, Justice Sharpe drew on three criteria articulated by the Nova Scotia Court of Appeal in Pleau v. Canada: 1) is the dispute resolution process established by the legislation consistent with exclusive jurisdiction?; 2) what is the essential character of the dispute, and is it regulated by the legislation such that the intervention of the court would be inconsistent with the scheme; and 3) is the scheme capable of affording “effective redress”.
Justice Sharpe noted that PHIPA laid out an elaborate scheme governing the protection of personal health information. However, although he found that the statute “does contain a very exhaustive set of rules and standards for custodians of personal health information, details regarding the procedure or mechanism for the resolution of disputes are sparse.” (at para 37) He observed that oral hearings were not at all typical – in most cases, complaints were dealt with through written submissions. Further, apart from the right to make representations, there were no procedural guarantees in the statute. Justice Sharpe observed that the statute also allowed the Commissioner to refuse to consider a complaint where there was another more appropriate recourse. He found that this suggested that PHIPA was not meant to be an exclusive and comprehensive code.
The second factor in the analysis required the court to consider the essential character of the claim, in order to determine whether a decision to assume jurisdiction would be consistent with the legislative scheme. The appellants argued that the claim was for nothing more than a breach of the PHIPA obligations, and that allowing the claim in tort to proceed would allow PHIPA to be circumvented. Justice Sharpe disagreed, noting that much more was required to make out the tort claim than to establish a breach of obligations under PHIPA. For example, the tort required a demonstration of intentional or reckless conduct, carried out without lawful justification, and in circumstances that a reasonable person would regard as highly offensive. On the whole, Justice Sharpe found that allowing the tort action to proceed in court would not undermine the scheme created under PHIPA.
The third consideration was whether the statute provided effective redress. The Court found that PHIPA gave the Commissioner a great deal of discretion when it came to the resolution of complaints, including the authority to decide not to proceed with a complaint. He also found that the complaints investigation process in PHIPA was generally meant to address systemic issues rather than to provide an effective recourse for individuals harmed by improper care of their personal information. Justice Sharpe noted that “Even if the Commissioner investigates a complaint, his primary objective in achieving an appropriate resolution will not be to provide an individual remedy to the complainant, but rather to address systemic issues.” (at para 59) Because of the broad discretion given to the Commissioner, any complainant whose complaint was not investigated would face “an expensive and uphill fight” to seek judicial review of the decision not to proceed. Justice Sharpe therefore concluded that the legislature had not intended to create a comprehensive code to deal with the consequences of misuse of personal health information.
The second issue considered by the Court was whether case law prevented the pursuit of the tort claim. Other courts had found that there was no right of action at common law where a statute provided a comprehensive scheme for redress. The leading case in this area is Seneca College v. Bhadauria, in which the Supreme Court of Canada ruled that the Ontario Human Rights Code precluded a separate common law tort of discrimination.
Justice Sharpe distinguished the Human Rights Code from PHIPA. He noted that the recourse under the Human Rights Code provided for awards of damages, whereas the Commissioner under PHIPA had no authority to award damages. Further, under PHIPA the Commissioner had a great deal of discretion to decide to proceed or not with a complaint, and chose to exercise that discretion so as to focus on systemic issues. By contrast, the Human Rights Code created a mechanism which focussed on the hearing of individual complaints. The two statutes were thus quite different. Justice Sharpe also distinguished two other cases involving labour relations legislation in which the courts refused to consider disputes that in their view should properly have been dealt with through arbitration or grievance mechanisms. Justice Sharpe noted that such proceedings provided an “accessible mechanism for comprehensive and efficient dispute resolution, and consequently form an important cornerstone of labour relations.” (at para 69) This was in contrast to PHIPA, where the Commissioner had given clear priority to the resolution of complaints raising systemic issues.
The Court concluded that there was nothing in PHIPA to support the view that the legislature intended to create an exhaustive code providing recourse for failures in the protection of personal health information. He found that permitting individuals to pursue claims at common law would not undermine PHIPA. He also found that the PHIPA scheme was such that in some cases individuals would not have effective redress under that statute. In the result, Ontarians now have the option of bringing tort claims for the mishandling of their personal health information. The case will also be of interest in other jurisdictions with personal information protection legislation.
In the fall of 2014, Quebec’s Commission d’accès à l’information, which is responsible for overseeing Quebec’s private sector data protection legislation, ruled that the province’s law applied to Rogers Communications Inc., a federally regulated company. The company had been the subject of a complaint that it had violated Quebec’s data protection law when it required new cellular phone subscribers to provide two pieces of identification, and then recorded the identification numbers on the furnished ID documents. Administrative Judge Lina Desbiens ruled that the complaint was well-founded. In her view, while it was legitimate to ask to see identification for the purposes of establishing the identity of the client, it was not necessary to record the identification numbers. Further, she found that the document ID numbers were not necessary for the purposes of carrying out a credit check – other information would suffice for this purpose.
s. 81 of the Act Respecting the Protection of Personal Information in the Private Sector gave the Commission jurisdiction over “any matter relating to the protection of personal information as well as into the practices of a person who carries on an enterprise and who collects, holds, uses or communicates such information to third persons.” She read this to mean that the Commission’s jurisdiction extended to the collection, use or disclosure of personal information by any business operating in Quebec. Since Rogers operated its business in Quebec, it was thus subject to the provincial law. Although the federal law might also apply to Rogers, Judge Desbiens found that it would only apply to the exclusion of the provincial law where the application of the provincial law would affect, in some significant way, the exercise of federal jurisdiction. In this case, she observed, Rogers was a telecommunications company, but the decision as to what pieces of identification it could require from new customers and what information it could record was not something that would affect in any way federal jurisdiction over telecommunications.
Judge Desbiens cited in support of her position several other decisions of the Commission d’accès à l’information in which the Quebec legislation was applied to companies in federally regulated industries. Notably, however, the facts addressed in these decisions predated the coming into effect of PIPEDA. Judge Desbiens also cited the more recent case of Nadler c. Rogers Communications Inc.. This case involved a civil suit for breach of privacy, and while the court considers the Quebec private sector data protection statute in its reasons, no argument appears to have been made regarding jurisdictional issues.
Judge Desbiens’ ultimate conclusion was that it was possible for a company to comply with both federal and provincial statutes by satisfying the stricter of the two sets of norms. In any event, she expressed the view her decision on the merits and the position of the federal Privacy Commissioner on similar issues did not diverge.
The decision that both federal and provincial data protection statutes apply to federally regulated companies doing business in Quebec seems problematic. On the one hand, federally regulated companies are frequently subject to provincial laws in some of their day-to-day business activities. This is why, for example, some banking products or services are not available in all provinces. Arguably, therefore, it should not matter that a federally-regulated company be required to comply with provincial data protection norms. However, the situations are not equivalent. In the case of personal information, the federal government has provided a national scheme that specifically applies to federally regulated businesses. While Judge Desbiens is most likely correct that there would be little difference in the outcome of this case under PIPEDA, it should not necessarily be assumed that this would be the so on a different set of facts. And, while it is true that the data protection decision in this case does not interfere with federal jurisdiction over telecommunications, it does seem clearly to trench upon federal jurisdiction over data protection in the federally regulated private sector.
 For just a few examples, see: Kollar v. Rogers Communications Inc., 2011 FC 452, http://www.canlii.org/en/ca/fct/doc/2011/2011fc452/2011fc452.pdf; Buschau v. Rogers Communications Inc., 2011 FC 911, http://www.canlii.org/en/ca/fct/doc/2011/2011fc911/2011fc911.pdf; Johnson v. Bell Canada,  3 FCR 67, 2008 FC 1086; Henry v. Bell Mobility, 2014 FC 555.
 The Commission cited several documents published on the website of the Office of the Privacy Commissioner of Canada. These include: Collection of Drivers’ Licence Numbers Under Private Sector Privacy Legislation, https://www.priv.gc.ca/information/pub/guide_edl_e.asp; Best Practices for the Use of Social Insurance Numbers in the Private Sector, https://www.priv.gc.ca/resource/fs-fi/02_05_d_21_e.asp; and Photo Identification Guidance, https://www.priv.gc.ca/resource/fs-fi/02_05_d_34_tips_e.asp.
Class Action Law Suits for Privacy Breaches in Canada: A Useful Tool in a Half-Full Toolbox?
Class action law suits for breach of privacy are becoming increasingly common in Canada. For example, the B.C. Supreme Court, the Ontario Superior Court, and Newfoundland and Labrador Supreme Court have all recently certified class action law suits in relation to alleged privacy breaches.
1) The lack of any other meaningful and effective recourse for a large scale privacy breach. Complaints regarding a large-scale privacy breach by a private sector corporation can be made to the Privacy Commissioner of Canada under the Personal Information Protection and Electronic Documents Act (PIPEDA) (or to his provincial counterparts in B.C., Quebec or Alberta, depending upon the nature of the corporation and its activities). However, the federal privacy commissioner can only investigate and issue a report with non-binding recommendations. He has no order-making powers. Further, there is no power to award damages. An individual who feels they have been harmed by a privacy breach must, after receiving the Commissioner’s report, make an application to Federal Court for compensation. Damage awards in Federal Court under PIPEDA have been very low, ranging from about $0 to $5000 (with a couple of outlier exceptions). This amount of damages will not likely compensate for the time and effort required to bring the legal action, let alone the harm from the privacy breach. Perhaps more importantly, a few thousand dollars may not be a significant deterrent for companies whose practices have led to the privacy breach. The Privacy Commissioner’s Office has called for reform of PIPEDA to include order making powers, and to give the Commissioner the authority to impose significant fines on companies whose conduct leads to significant privacy harms. Yet legislative reform in this area does not seem to be on the current government’s agenda.
2) The problem of establishing damages in privacy cases. It can be very difficult to establish damages in cases where privacy rights have been breached. For example, although a company’s data breach might affect tens or even hundreds of thousands of individuals, it may be very difficult for any of those individuals to show that the data breach has caused them any actual harm. Even if one or more of these individuals suffers identity theft, it may be impossible to link this back to that particular data breach. While all of the affected individuals may suffer some level of anxiety over the security of their personal information, it is hard to put a dollar value on this kind of anxiety – and courts have tended to take a rather conservative view in evaluating such harm. It simply might not be worth it for any individual to bring legal action in such circumstances – even if they were to succeed, their damages would likely not even come close to making the litigation worth their while.
3) The inaccessibility of justice on an individual scale. Frankly, the majority of Canadians are not in a financial position to take anyone to court for breach of privacy. (Those in province of Quebec might be slightly better off in this regard, as privacy rights are much clearer and better established in private law in that province than they are elsewhere in Canada). It should be noted that those few individuals who have sought damages in Federal Court for PIPEDA breaches have been self-represented – legal representation would simply be too costly given the stakes. A suit for the tort of invasion of privacy or for breach of a statutory privacy tort would be considerably more complex than an application for damages under PIPEDA. Damage awards in privacy cases are so low that litigation is not a realistic solution for most.
In this context it is not surprising that the class action law suit for breach of privacy is catching on in Canada. Such law suits allow large numbers of affected individuals to seek collective recourse. As mentioned earlier, the British Columbia Supreme Court recently certified a class action law suit against Facebook for breach of privacy rights protected under British Columbia’s Privacy Act. The claim in Douez v. Facebook, Inc. related to Facebook’s Sponsored Stories “product”. Advertisers who paid to make use of this product could use the names and likenesses of Facebook users in “sponsored stories” about their products or services. These “sponsored stories” would then be sent to the contacts of the person featured in the story. The court found that between September 9, 2012 and March 10, 2013, 1.8 million B.C. residents were featured in Sponsored Stories. The plaintiffs argued that this practice violated their privacy. Although the issues have not yet been litigated on their merits, the certification of the class action law suit allows the privacy claims to proceed on behalf of the significant number of affected individuals.
In Evans v. Bank of Nova Scotia, Justice Smith of the Ontario Superior Court of Justice certified a class action law suit against the Bank of Nova Scotia. In that case, an employee of the bank had, over almost a five year period, accessed highly confidential personal banking information of 643 customers. In June of 2012, the Bank notified these customers that there may have been unauthorized access to their banking information; 138 of these individuals later informed the bank that they were victims of identity theft or fraud. The bank employee subsequently admitted that he had channelled the banking information through his girlfriend to individuals who sought to use the information for illegal purposes. The lawsuit claims damages for invasion of privacy and negligence, among other things, and argues that the bank should be held vicariously liable for the actions of its employee.
Most recently, in Hynes v. Western Regional Integrated Health Authority, the Newfoundland and Labrador Supreme Court certified a class action law suit against the Health Authority after it was discovered that an employee had improperly accessed 1,043 medical records without authorization. The information accessed included name and address information, as well as information about diagnostic and medical procedures at the hospital. This case is an example of where it may be difficult to assess or quantify the harm suffered by the particular individuals as a result of the breach, as it is not known how the information may have been used. The plaintiffs argued that both the statutory privacy tort in Newfoundland and the common law tort of intrusion upon seclusion were applicable, and that the Health Authority should be held vicariously liable for the acts of its employee. The also argued that the Health Authority had been negligent in its care of their personal information. The court found that the arguments raised met the necessary threshold at the class action certification stage – the merits remain to be determined once the case ultimately proceeds to trial.
What these three cases demonstrate is that class action law suits may give individuals a useful recourse in cases where data breaches have exposed their personal information and perhaps left them vulnerable to identify theft or other privacy harms. Such law suits may also act as a real incentive for companies to take privacy protection seriously. The cost of defending a class action law suit, combined with the possibility of a very substantial damages award (or settlement), and the potential reputational harm from high profile litigation, all provide financial incentives to properly safeguard personal information.
This may be welcome news for those who are concerned about what seems to be a proliferation of data breaches. It should not, however, let the federal government off the hook in terms of strengthening Canada’s private sector data protection legislation and giving the Privacy Commissioner more effective tools to act in the public interest to protect privacy by ensuring compliance with the legislation.
Do you have a reasonable expectation of privacy in the data recorded by your car’s airbag sensing diagnostic module (SDM)? Did you even know your car has an SDM? Two recent court cases highlight important privacy issues related to this technology – and by extension to technology embedded into other consumer products that is capable of recording user information.
Both R. v. Hamilton from the Ontario Supreme Court and R. v. Fedan from the BC Supreme Court are cases involving automobile accidents where police extracted, without a warrant, data recorded on the “black box” associated with vehicle airbag systems. These little ‘black boxes’ are referred to alternatively as sensing diagnostic modules (SDMs) or airbag control modules (ACMs). The devices are installed in cars along with the airbag system. Their recording function is triggered by the sudden deceleration that precedes the deployment of the airbags, and they typically record only a few seconds of data leading up to impact.
It is a violation of s. 8 of the Canadian Charter of Rights and Freedoms for police to conduct a search without a warrant in circumstances where there is a reasonable expectation of privacy. Thus, a key issue in these airbag cases was whether there was a reasonable expectation of privacy in the SDM data, and, in consequence, whether the police should have obtained warrants prior to seizing the devices and extracting the data.
The two courts reached opposite conclusions on this issue. Justice MacDougall of the Ontario Supreme Court found that the accused had a reasonable expectation of privacy in the data, and that his Charter rights were violated when the data was extracted without a warrant. This court found that the SDM was similar to a computer that recorded information about its user. By contrast, Justice Kloegman of the British Columbia Supreme Court found that there was no reasonable expectation of privacy in the SDM data.
The BC Court found that the driver had no reasonable expectation of privacy in the recorded data largely because he did not know that his car was equipped to record such data. As Justice Kloegman explained: “SDMs are a relatively new feature of motor vehicles and it is unlikely that the majority of drivers even know their vehicle is equipped with one or what it does.” (at para 22). In fact, the judge was prepared to distinguish Hamilton on this point – in Hamilton, the accused was an off-duty police officer who knew about such devices, and therefore could be found to have a reasonable expectation of privacy. However, for the court to base a reasonable expectation of privacy on whether or not a consumer realizes that the product they have purchased is recording data about their use of it is hugely problematic, particularly as we move into an era where more and more of our consumer items are “smart”. A reasonable expectation of privacy in recorded data should not depend upon whether the individual knew that their car, fridge, phone, thermostat, or any other consumer item was programmed to record data about their use of the device. One might even argue that the lack of awareness that one’s use of consumer devices leaves a data trail should result in an enhanced expectation of privacy.
The court in Fedan also criticized the finding of the court in Hamilton that the SDM was a kind of onboard computer, thus aligning it with other computing devices in which a reasonable expectation of privacy has been found by the courts. In rejecting the analogy to a computer, Justice Kloegman observed that when there was a triggering event, the SDM would “capture five seconds of data regarding speed, brakes, and seatbelts.” (para 23) She then stated that this was “information generated by the vehicle, not the driver.”(para 23) This too is reasoning about which ordinary individuals should be concerned. This is not data about the vehicle in the abstract (grey, Volvo, 2010); rather, it is data that reveals how the driver was interacting with the vehicle at the time of the accident. The information is clearly information about the driver – as the court in Hamilton found.
The starkly different decisions in Hamilton and Fedan illustrate that there are privacy issues here that have yet to been conclusively resolved. The issue of the reasonable expectation of privacy in SDM data is one that is worth following as cases from other provinces in Canada start to emerge. The implications of judicial approaches go well beyond on-board vehicle data recorders and may extend to a wide range of consumer devices equipped with devices that can record even small snippets of data.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.