Recent Court Activity

In overseeing compliance with PIPEDA and the Privacy Act, the OPC is sometimes involved in judicial proceedings as a party, as an added party, or as an intervener, to seek enforcement of the Acts, and/or to assist courts in advancing the legal interpretation and application of the Acts. The OPC sometimes intervenes in foreign judicial proceedings, where appropriate, in order to influence the evolution of decisions that have the potential of affecting the privacy rights of Canadians, particularly where trans-border data flows are involved.

This section provides an update of recent judicial proceedings in which the OPC has played a role.

State Farm v. Privacy Commissioner and AG of Can.

In this case, the State Farm Mutual Automobile Insurance Company (“State Farm”) questioned the Privacy Commissioner’s jurisdiction to investigate a refusal to provide access to personal information and her power to compel the production of documents during the course of an investigation. On July 9, 2007, State Farm initiated an application in the Court of Queen’s Bench of New Brunswick for a declaration that:

• PIPEDA did not apply as State Farm was not engaged in “commercial activities” when it collects, uses or discloses personal information in the course of defending its insured against litigation initiated by the complainant;
• If PIPEDA does apply, PIPEDA was enacted outside the powers allotted to Parliament;
• The Privacy Commissioner lacked the authority to investigate the complaint; and
• The Privacy Commissioner has no right to request or compel from State Farm information necessary to conduct an investigation.

The Privacy Commissioner filed a preliminary motion to have State Farm’s application dismissed or stayed on the ground that the Federal Court was the more appropriate forum. The motion was granted in January 2008. The Court of Queen’s Bench determined that the Federal Court was the more appropriate forum to determine State Farm’s application, which involved questions of both constitutional validity and a judicial review of the Privacy Commissioner’s authority. Because the Federal Courts have exclusive jurisdiction over applications for judicial review of the Privacy Commissioner, the Federal Court was found to be the most appropriate forum.

State Farm appealed to the New Brunswick Court of Appeal and a hearing was held on September 10, 2008. On January 22, 2009, the New Brunswick Court of Appeal dismissed State Farm’s appeal and affirmed our position that State Farm’s application is, for all intents and purposes, an application for judicial review that falls within the exclusive jurisdiction of the Federal Court. The Court noted that regardless of how State Farm identifies its claim, it is in substance a challenge to the actions and decisions of the Office that should be heard by the Federal Court.

State Farm sought leave from the Federal Court for an extension of time to file a similar application before the Federal Court in February 2009, which was granted April 8, 2009.

Decisions:

New Brunswick Court of Queen’s Bench:

State Farm v. Privacy Commissioner and AG of Can., 2008 NBBR 33 (CanLII);

New Brunswick Court of Appeal:

State Farm Mutual Automobile Insurance Company v. Privacy Commissioner of Canada, 2009 NBCA 5 (CanLII)

Blood Tribe Department of Health v. Privacy Commissioner of Canada

At issue in this case was whether the Privacy Commissioner of Canada has the power to compel the production of documents over which a claim of solicitor-client privilege is asserted in the context of an investigation under the Personal Information Protection and Electronic Documents Act (PIPEDA). An individual had filed a complaint with the Office of the Privacy Commissioner against her former employer. In the course of the investigation that followed, the complainant’s former employer, the Blood Tribe Department of Health (“Blood Tribe”), refused to provide the Office with access to solicitor-client privileged documents. The Assistant Privacy Commissioner exercised her formal powers of compulsion for the first time because of Blood Tribe’s position that it would not disclose solicitor-client documents to any third party. Blood Tribe subsequently filed an application for judicial review in the Federal Court of Canada of the Assistant Commissioner’s decision to issue an order for the production of records pursuant to paragraphs 12(1)(a) and (c) of PIPEDA.

The application for judicial review was dismissed by Mosley J. of the Federal Court, but reversed by the Federal Court of Appeal. The case proceeded to the Supreme Court of Canada. This was the first opportunity for the Supreme Court to pronounce itself on PIPEDA, and in particular, on the Commissioner’s powers under that Act to view solicitor-client privileged documents in the course of her investigations into access to personal information complaints. Given the importance of this case, several interveners joined in, including:

• The Information Commissioner of Canada
• The Information and Privacy Commissioner of British Columbia
• The Information and Privacy Commissioner of Alberta
• The Information and Privacy Commissioner of Ontario
• The New Brunswick Office of the Ombudsman
• The Attorney General of Canada
• The Federation of Law Societies
• The Advocates’ Society, and
• The Canadian Bar Association

In a decision rendered July 17, 2008, the Supreme Court of Canada confirmed that the right of individuals to access information about themselves in order to verify its accuracy is an important corollary to the protection of privacy. While all parties agreed with the fundamental importance of the solicitor-client privilege, the Court confirmed that organizations' claims of solicitor-client privilege must be independently verified in order to give proper meaning to the fundamental right of access to one's personal information.

The Court disagreed with the Privacy Commissioner's position on the question of who is legally able to independently verify organizations' claims of privilege at first instance. The Court concluded that the statutory language of paragraphs 12(1)(a) and (c) of PIPEDA does not give the Commissioner the authority to compel an organization to produce documents over which a claim of solicitor-client privilege has been made, in order for her to review the document in the course of her investigation into an access to personal information complaint. Rather, this role of verification should be reserved for the courts.

The Court did helpfully clarify the procedural means by which the Commissioner may, from now on, refer issues of solicitor-client privilege to the Federal Court for adjudication. She may do so during the course of an investigation (via section 18.3(1) of the Federal Courts Act) or at the conclusion of an investigation (under s. 15 of PIPEDA).

We invite you to read the Supreme Court of Canada decision:

Canada (Privacy Commissioner) v. Blood Tribe Department of Health, 2008 SCC 44

Decisions:

Federal Court:

Blood Tribe (Dept. of Health) v. Canada (Privacy Commissioner), 2005 FC 328

Federal Court of Appeal:

Blood Tribe Department of Health v. Privacy Commissioner of Canada, 2006 FCA 334

Accusearch, Inc. d/b/a Abika.com v. Federal Trade Commission

In June 2004, an individual complained to our Office that Accusearch, Inc., in the course of private commercial activities, routinely collected, used and disclosed personal information about Canadians for inappropriate purposes and without their knowledge or consent, and that, notwithstanding the fact that it was based in the United States, Accusearch, Inc. violated PIPEDA in a number of respects. The Assistant Privacy Commissioner initially declined to investigate the complaint for lack of jurisdiction. On judicial review, however, the Federal Court of Canada confirmed that the OPC had jurisdiction to investigate the individual’s complaint regarding Accusearch, Inc., even though the company was based in the U.S. and notwithstanding any difficulty in effectively being able to carry out an investigation. The individual also complained to the Federal Trade Commission (“FTC”) with respect to possible violations of U.S. legislation.

In May 2006, the FTC charged AccuSearch, Inc. (Abika.com) and its principal with violating federal U.S. law by selling consumers’ telephone records to third parties without the consumers’ knowledge or authorization. According to the FTC complaint, the defendants advertised on their Web site that they could obtain the confidential phone records of any individual – including details of outgoing and incoming calls – and make that information available to their clients for a fee. To obtain such information, the FTC alleged that the defendants caused others to use “false pretenses, fraudulent statements, fraudulent or stolen documents or other misrepresentations, including posing as a customer of a telecommunications carrier,” to induce the telecommunications carriers to disclose the confidential records. As such, the FTC charged that the defendants’ practices were unfair in violation of the FTC Act.

On January 28, 2008, Judge Downes of the United States District Court for the District Of Wyoming found that the defendants’ obtaining and selling of confidential phone records without consumers’ knowledge or consent was “necessarily accomplished through illegal means,” and that defendants knew that the phone records were being obtained surreptitiously. The Court further found that this practice caused substantial injury to consumers who had no way of avoiding these harms. Judge Downes permanently barred the defendants from, among other things, obtaining, purchasing, marketing, or selling consumer personal information unless the information was lawfully obtained, and ordered the defendants to give up the $199,692.71 they earned through obtaining and selling the records. Accusearch, Inc. appealed from this decision to the United States Tenth Circuit Court of Appeals.

Considering our Office’s involvement with Accusearch, Inc., and considering the trans-border nature of the issues at stake, the OPC prepared and was granted leave to file an amicus curiae brief in the appellate proceedings initiated by Accusearch. The case before the U.S. Tenth Circuit Court of Appeals relates to trans-border data flows between the US and Canada, how data-brokers collect, use and disclose personal information without the knowledge or consent of the individual concerned, and how online trade in personal information impacts privacy rights. The OPC brief outlined how the Court’s decision would have a direct impact on the privacy rights of Canadians and the business reputation of Canadian organizations affected by the actions of data-brokers. Recognition that Accusearch Inc.’s practices and the resulting harms are illegal under U.S. law would support international cooperation between Canadian and United States regulators by enhancing the consistency in approach between the two jurisdictions. This, in turn, would provide the necessary assurance to organizations that contemplate outsourcing data processing functions in the US, and help boost the confidence that individuals need in conducting business over the Internet. The OPC brief particularly highlighted the fact that the unauthorized collection, use and disclosure of personal information over the Internet by data-brokers can cause harm and has extra-territorial effects.

We invite you to read the OPC’s amicus curiae brief as filed with the U.S. Tenth Circuit Court of Appeals.

Decision:

Legal Update: Court affirms penalties against U.S.-based search services web site

OPC update: Complaint under PIPEDA against Accusearch Inc., doing business as Abika.com

• Summary
• Report of Findings

Dr. Wyndowe v. Rousseau

At issue in this case was whether the handwritten notes of a doctor performing an independent medical examination (“IME”) of an insured person at the request of an insurance company are personal information under the Personal Information Protection and Electronic Documents Act (“PIPEDA”), and whether such notes are collected in the course of commercial activities.

The respondent was asked to submit to an IME at the request of his insurer, Maritime Life, in the context of receiving long-term disability benefits. Maritime Life engaged the services of Dr. Wyndowe through his corporation, Psychiatric Assessment Services Inc., to perform the IME. Following the IME, Dr. Wyndowe sent a report to Maritime Life, and on the basis of Dr. Wyndowe’s report, the respondent’s benefits were terminated. The respondent requested a copy of Dr. Wyndowe’s report as well as a complete copy of Dr. Wyndowe’s file, which consisted of notes taken during the IME. While the respondent was given a copy of the report, Dr. Wyndowe refused to grant the respondent access to his notes and the respondent complained to the Office of the Privacy Commissioner (the “OPC”). The OPC determined that the complaint was well-founded and recommended that Dr. Wyndowe grant access to his notes. Dr. Wyndowe refused, and the respondent filed an application in the Federal Court pursuant to section 14 of PIPEDA for an order that Dr. Wyndowe provide the respondent access to the notes containing his personal information, which the Federal Court allowed.

Dr. Wyndowe appealed from the Federal Court’s decision. The Federal Court of Appeal allowed the appeal in part and remitted the matter to the OPC to determine alongside counsel for Dr. Wyndowe which portions of the medical notes sought by the respondent contained his “personal information”, and accordingly, which parts of the notes could be disclosed to the respondent.

Décary J., writing for the Court, noted from the outset that he was not persuaded that an insured at common law has no right of access to his medical records outside the fiduciary doctor-patient relationship. In any event, PIPEDA provided new privacy protections to Canadians, including in respect of personal health information, and therefore effectively overrides the common law on this issue.

With respect to whether Dr. Wyndowe’s notes were collected during the course of a commercial activity, Décary J. concluded that notes taken by a doctor in the course of an IME made at the request of an insurance company are taken in the “course of a commercial activity”. For Décary J., it was hard to believe that the relationship between the respondent and Dr. Wyndowe could effectively defeat the commercial nature of the relationship between Maritime Life and the respondent, and the relationship between Maritime Life and Wyndowe. As such, the overall transaction retained its “commercial nature”. Décary J. further held that just because Dr. Wyndowe was an independent consultant hired by Maritime Life to examine the respondent as merely a step for the respondent to begin collecting benefits, this did not change the commercial nature of the overall transaction. For Décary J., it was clear from the debates of the Senate that Parliament intended that the notes taken by a doctor in the course of an IME made at the request of an insurance company are taken “in the course of a commercial activity”.

With respect to the issue of whether Dr. Wyndowe’s notes constituted “personal information”, Décary J. took the view that “personal health information” was clearly a subset of “personal information” under PIPEDA. Décary J. further held that the notes taken by a doctor in the course of an IME form part of the medical records of the individual examined and that “personal health information” clearly includes the medical records of a person. However, Décary J. stated that the notes of Dr. Wyndowe contained both information which was personal to the respondent and information which was not. Accordingly, the respondent had a right of access to information he gave Dr. Wyndowe as well as to Dr. Wyndowe’s report, and had a right to correct any mistakes in the information he gave the doctor or that the doctor noted. However, the process of getting to the final opinion from the initial personal information of the respondent belonged to Dr. Wyndowe and did not have to be disclosed. Finally, Décary J. recognized that the information in the notes could be personal to both the respondent and Dr. Wyndowe, and that a balancing exercise similar to that proposed by the Federal Court of Appeal in Canada (Information Commissioner) v. Canada (Minister of Citizenship and Immigration), 2002 FCA 270 would then need to be performed.

Decision:

Wyndowe v. Rousseau, 2008 FCA 39

Gordon v. Canada (Health)

A producer for the CBC sought access to and a copy of Health Canada’s Canadian Adverse Drug Reaction Information System (“CADRIS”) under the Access to Information Act (the “AIA”). The CADRIS is a database containing information relating to suspected adverse reactions to health products marketed in Canada. The information is collected by Health Canada on a voluntary basis from health professionals and consumers, and on a mandatory basis from drug manufacturers. In response to the producer’s request, Health Canada disclosed approximately 82 of a total of 100 used data fields, but refused to disclose the data field entitled “province” under subsection 19(1) of the AIA on the grounds that, if disclosed, the “province” field, when combined with the other data elements already release, could possibly identify the affected individuals and therefore constituted their personal information which is exempt from disclosure.

The producer complained to the Information Commissioner of Canada (the “Information Commissioner”) regarding Health Canada’s refusal. After investigating the matter, the Information Commissioner agreed with Health Canada.

On February 24, 2006, the producer filed an application in the Federal Court under section 41 of the AIA for an order requiring Health Canada, among other things, to release the “province” field of the CADRIS database. On November 14, 2006, the Privacy Commissioner of Canada (the “OPC”) was granted leave to intervene in the application given the central concept of “personal information” which is essentially the same under the Access to Information Act, the Privacy Act and even the Personal Information Protection and Electronic Documents Act (PIPEDA).

At issue was: (i) whether the “province” field was personal information as defined under section 3 of the Privacy Act, and therefore, fell under the mandatory exemption from disclosure under subsection 19(1) of the AIA; and (ii) whether the Minister of Health should have exercised his discretion under subsection 19(2) of the AIA to nonetheless release the “province” field on the basis that the public interest in such disclosure clearly outweighed the invasion of privacy that might result as per the exception under subparagraph 8(2)(m)(i) of the Privacy Act.

With respect to the first issue of whether the “province” field was personal information and was exempt from disclosure under subsection 19(1) of the AIA, Gibson J. adopted the test urged by the OPC in determining when information is about an identifiable individual: “[i]nformation will be about an identifiable individual where there is a serious possibility that an individual could be identified through use of that information, alone or in combination with other available information.” Health Canada submitted evidence regarding the risk of identifying personal information if the “province” field was disclosed, including the smaller size of the pool of information in smaller provinces and territories and the ease with which publicly available information can be combined with the “province” field to identify an individual. Gibson J. was satisfied that the evidence submitted by Health Canada represented substantial evidence that the disclosure of the “province” field would substantially increase the possibility that information about an identifiable individual would fall into the hands of persons seeking to use the totality of information disclosed from the CADRIS database, along with other publicly available information, to identify particular individuals. Accordingly, Gibson J. upheld Health Canada's refusal to disclose the “province” field of the CADRIS database.

With respect to the second issue, namely, the Minister of Health’s refusal to exercise his discretion under subsection 19(2) of the AIA, the producer argued that access to the “province” field was for the purpose of enhancing public health and safety, without affecting Canadians’ privacy rights. However, Gibson J. noted that the producer had failed to submit any evidence showing how public health and safety would be enhanced by the disclosure of the “province” field without impinging on privacy rights, or showing that the Minister had failed to examine the evidence properly. Gibson J. applied the reasoning of Justice LaForest in Dagg v. Canada (Minister of Finance), [1997] 2 S.C.R. 403 in determining that disclosure of the “province” field in the public interest did not clearly outweigh the invasion of privacy that could result from disclosure; for the Court to overturn the Minister of Health’s decision would amount to substituting the Court’s view to the Minister of Health’s, and would undermine the purpose of the underlying legislation and usurp the Minister’s statutory role.

Decision:

Gordon v. Canada (Health), 2008 FC 258

Damages Cases

A number of recent litigation cases have raised the issue of damages under section 16 of PIPEDA. However, most of these cases are settled before they even get to Court. Therefore, the important question of damages for breach of privacy, and how the scope of damages should be interpreted under PIPEDA remains an open question of law.

While the OPC does not typically take a position on the facts of these cases, we have sought to be added as a party to the proceedings in several of these cases, where we have deemed it so appropriate, in order to offer guidance to the Court on how the concept of damages under section 16 of PIPEDA should be interpreted in law. For those of you interested in the nature of these legal issues, please click here for an excerpt of OPC's factum in some of these past cases that sets out our own views and legal arguments. It is important to note, once again, however, that this issue remains open at law until the Federal Court squarely pronounces itself on the question.

Here is an excerpt of OPC's legal arguments.