Date: 20100623
Docket: T-1100-09
Citation: 2010 FC 681
Ottawa, Ontario, June 23,
2010
PRESENT: The Honourable Mr. Justice Mosley
BETWEEN:
KEVIN
RANDALL
Applicant
And
NUBODYS
FITNESS CENTRES
Respondent
REASONS FOR JUDGMENT AND JUDGMENT
[1]
This
is an application by Kevin Randall pursuant to section 14 of the Personal
Information and Protection of Electronic Documents Act, S.C. 2000, c.5
(PIPEDA) in respect to the alleged failure of Nubody’s Fitness Centres, the
respondent, to exercise their duties and responsibilities under the PIPEDA.
[2]
This
application follows a complaint made by Mr. Randall, to the Privacy
Commissioner of Canada, whose office published a report dated May 26,
2009, concluding that the complaint against the respondent was well-founded.
It was found that the respondent disclosed the applicant’s personal information
without his knowledge or consent.
[3]
Pursuant
to section 16 of the PIPEDA, this Court may, in addition to any other remedies
it may give, (a) order an organization to correct its practices in order to
comply with sections 5 to 10 of the Act; (b) order an organization to publish a
notice of any action taken or proposed to be taken to correct its practices,
whether or not ordered to correct them under (a); and (c) award damages to the
complainant, including damages for any humiliation that the complainant has
suffered.
[4]
These
are my reasons for dismissing the application.
Background
[5]
At
the time of his original complaint, Mr. Randall was a salaried employee of Feed
Nova Scotia where he worked as a research analyst and policy advisor. Feed Nova Scotia is a
registered charity in the Province of Nova Scotia and
primarily supplies food to food banks across the Province.
[6]
In
July 2007, Mr. Randall, became a member of one of the respondent’s Nubody’s Fitness
Centres through a corporate gym membership program available through his
employer, Feed Nova Scotia. Under the program, membership was available at a
discounted rate and the employer paid half of the monthly subscription cost.
[7]
At
the relevant dates, Nubody’s Fitness Centres was a chain of fitness clubs with several
locations in Atlantic Canada. In the early stages of this case, there was a
change in the ownership and management structure of the club when it was sold
to GoodLife Fitness Centres, a national chain.
[8]
Mr.
Randall entered into a one-year contract with Nubody’s by filing out a
membership agreement form and a payroll deduction form.
[9]
In
August 2007, in the course of a staff meeting at the applicant’s workplace, his
supervisor (the Executive Director) discussed the corporate membership program that
Feed Nova Scotia had arranged with Nubody’s. The supervisor mentioned that some
staff members, including her, had already taken advantage of the program. In
doing so, the supervisor revealed the number of times each of those employees,
including Mr. Randall, had visited the respondent’s facilities over the
previous weeks.
[10]
The
applicant became upset that this information had been disclosed by the respondent
to his employer. He did not, however, raise this concern with his supervisor.
[11]
On
August 9, 2007, the applicant emailed a representative of the respondent
requesting that the respondent stop disclosing his personal information without
his consent. He received an automated reply which indicated that the
representative would be away for a few days and providing the name and contact
particulars of the owner should more immediate attention be required. Mr.
Randall did not contact the owner about his concern. Nor was he contacted when
the representative presumably returned to her office on the date indicated.
[12]
Mr.
Randall believes that his e-mail was forwarded by the respondent to his
employer as he was called in to his supervisor’s office on August 14, 2007 to
discuss the matter. He was advised then that his employer needed to know the
frequency with which employees with a corporate membership used the fitness
centre. Mr. Randall says that he then agreed to the disclosure of this information
to his employer under duress because he feared for his job. He says that he
subsequently called the respondent’s head office, without disclosing his
identity, to inquire about their privacy policy respecting corporate
memberships. He believes that this inquiry was also relayed to his employer as
he was the only person to have complained about disclosure of the information.
[13]
Over
the course of the next few months Mr. Randall remained at Feed Nova Scotia and continued
to use the respondent’s fitness facilities. He says, however, that this made
him uncomfortable as he felt as if his employer was constantly monitoring his
usage. He also believes that changes in his work environment were attributable to
his communications with Nubody’s. He was moved from one set of offices to
another set closer to his supervisor. He believes that area was reserved for
problem employees requiring closer supervision. Further, on one occasion he was
asked to work a double shift (i.e., an additional half-day) at a supermarket to
solicit donations of food from customers. Employees were asked to do this on a
voluntary basis. Mr. Randall believes he was the only employee ever asked to
put in more than a half day on such duties.
[14]
Mr.
Randall terminated his employment with Feed Nova Scotia in February 2008 for
reasons unrelated to this application. At that time he cancelled his membership
with Nubody’s as his employer was no longer paying half the cost. Later he reactivated
the membership as he had learned that he could do so at the discounted price so
long as he paid the full amount including the employer’s share. Mr. Randall
says that while he enjoyed the facilities, he continued to be dissatisfied with
how Nubody’s had dealt with his August request not to disclose the frequency of
his usage to his employer.
[15]
On
May 26, 2008, Mr. Randall wrote to another representative of the respondent
outlining his concerns. The applicant stated that he had not consented to the
disclosure of the frequency of his usage and that neither the application form
nor the payroll deduction form he filled out to become a member of the fitness
centre contained information about the collection, use or disclosure of his
personal information.
[16]
Mr.
Randall indicated in the letter that he was prepared to pursue remedies with
other agencies if Nubody’s did not address his concerns and suggested the
company would prefer that his complaint not be made public. The respondent
characterizes this as a veiled threat. Mr. Randall says that he wasn’t looking
for compensation and that he would have been satisfied with an apology.
[17]
In
a reply dated May 27, 2008, the representative wrote that under the corporate
membership program, the applicant’s employer agreed to subsidize his membership
as a benefit of employment provided that he used the fitness centre a certain
number of times per month and that the applicant had consented to disclosure of
his usage information when he applied for membership.
[18]
Dissatisfied
with this response, Mr. Randall filed his complaint with the Office of the
Privacy Commissioner stating that he had never provided oral or written consent
for the disclosure of information on his fitness centre usage and was not aware
that such information was being tracked or was required by his employer until
he learned of it as set out above. He wrote that the disclosure of
information on his fitness centre usage caused him embarrassment and created an
atmosphere of competition amongst co-workers that he was unwillingly forced
into. The applicant also stated that he believes that he was reprimanded by
his superiors for his communications with the respondent.
[19]
An
investigator was appointed and an inquiry was conducted. The investigator found
that neither of the forms completed by Mr. Randall in applying for the
corporate membership program requested consent to the disclosure of information
about an individual’s use of the fitness center to the employer.
Report of the Privacy
Commissioner – May 26, 2009
[20]
The
report of findings prepared by the Office of the Privacy Commissioner of Canada with regard
to the complaint that the applicant filed against Nubody’s Fitness Centres
Inc., concluded that the matter was well-founded.
[21]
In
determining this matter, the Assistant Privacy Commissioner relied upon
Principle 4.3 of Schedule 1 of the PIPEDA – Principle 3: Consent.
[22]
Principle
4.3 states that the knowledge and consent of the individual are required for
the collection, use or disclosure of personal information, except where
inappropriate. Also, Principle 4.3.6 states that an organization should generally
seek express consent when the information is likely to be considered sensitive,
and that implied consent would generally be appropriate when the information is
less sensitive.
Findings
of the Privacy Commissioner
[23]
The
Privacy Commissioner found that information about an individual’s use of the
respondent’s fitness centre facilities constitutes personal information, as it
is information about an identifiable individual, in this case, the
complainant/applicant.
[24]
The
documentation (membership agreement, payroll deduction form and web page)
pertaining to corporate memberships at the respondent did not at the relevant
times state that the membership is contingent on an individual making a minimum
number of visits per month, nor did it mention that information pertaining to
the frequency of visits would be tracked and disclosed to the member’s
employer.
[25]
Despite
the respondent’s position that the applicant provided consent to the disclosure
of information about his fitness centre usage when he agreed to become a
corporate member, the respondent could not show that it obtained the
applicant’s consent.
[26]
If
the respondent was relying on the applicant’s employer to obtain his consent to
the disclosure of information about his usage of the fitness centre to the
employer, it should have documented that understanding, the Commissioner found.
The respondent only appeared to have asked the employer about whether it had
obtained employee consent to the disclosure in the context of a discussion
about this complaint.
[27]
Had
the applicant receive notice that his employer’s sponsorship of his corporate
membership was conditional upon a certain frequency of use, it could be argued
that the respondent had the implied consent of the applicant to disclose the
applicable information to his employer. The evidence provided does not lead to
such a conclusion. The Commissioner therefore found the respondent in
contravention of Principle 4.3.
Conclusion
[28]
Given
the foregoing, the report concluded that the complaint that the respondent
disclosed the applicant’s personal information without his knowledge or consent
is well-founded.
Recommendations
[29]
The
report recommended that the respondent modify its procedures and documentation
so as to ensure that it obtains its members’ consent to the collection, use and
disclosure of their personal information, which will include giving members
notice of the purposes for which their personal information is collected, used
and disclosed. If consent is to be obtained by a third party, such as members’
employers, the respondent should document that arrangement with the employers
and in its information on corporate memberships.
[30]
On
or about June 23, 2009, the respondent wrote to the Assistant Privacy
Commissioner advising that a new application form specifically disclosing that
information regarding an individual’s use of the Nubodys’ facilities would be
disclosed to employers participating in the corporate partnership program was
being implemented and provided to all participating individuals.
Issues
[31]
The
issues raised by the parties in their written submissions are the following:
a. Did the respondent, Nubody’s
Fitness Centres, breach provisions of the PIPEDA?
b. If the respondent breached
provisions of the PIEPEDA, did the applicant suffer any damages?
c. If the applicant has suffered
damages, what would be an appropriate damages award given all of the
circumstances?
Analysis
[32]
The
hearing of an application made after receipt of a report of the Privacy
Commissioner under subsection 14(1) of the PIPEDA is not a judicial review of
the Commissioner's findings and recommendations. Section 14 in effect provides
for de novo review in court of "any matter in respect of which the
complaint was made": Waxer v. McCarthy, 2009 FC 169, [2009] F.C.J.
No. 252, at para. 25.
[33]
In Englander
v. Telus Communications Inc., 2004 FCA 387, [2004] F.C.J. No. 1935, at
paras. 47 and 48, Justice Décary of the Federal Court of Appeal stated that:
What
is at issue in both proceedings is not the Commissioner's report, but the conduct
of the party against whom the complaint is filed.
....
...
the hearing under subsection 14(1) of the Act is a proceeding de novo
akin to an action and the report of the Commissioner, if put into evidence, may
be challenged or contradicted like any other document adduced in evidence.
[34]
Accordingly,
the proceedings before this Court consist of a fact finding process to
determine whether the respondent, Nubody’s Fitness Centres, disclosed the personal
information relating to the applicant’s fitness centre usage without his consent.
If it is found that there was indeed disclosure of personal information by the
respondent, this Court must decide, as a matter of law, whether the alleged
disclosure constitutes a “violation of the complainant’s privacy” as
contemplated by PIPEDA: Waxer, above, at para. 25.
[35]
If
a violation of PIPEDA is found, the Court must consider the remedies that are
available to the applicant/complainant: Johnson v. Bell Canada, 2008 FC
1086, [2008] F.C.J. No. 1368, at para. 54. The applicant agrees that the
respondent has implemented the Commissioner’s recommendations. He seeks damages
as a remedy should the Court find that there was a violation of the Act.
Did
Nubody’s Fitness Centres breach provisions of the PIPEDA?
[36]
I
find that the respondent Nubody’s
Fitness
Centres
disclosed personal information relating to the applicant’s fitness
centre usage
without his consent and thereby violated his privacy.
[37]
I
agree with the applicant that the documentation (membership agreement, payroll
deduction form and web page) pertaining to the respondent’s corporate
memberships program at the relevant times did not mention that the membership
is contingent on an individual making a minimum number of visits per month, nor
did it indicate that the information pertaining to the frequency of visits
would be tracked and disclosed to the member’s employer.
[38]
The
respondent has filed an affidavit from a Nubody’s employee that states that
Feed Nova Scotia expressly informed the applicant when he applied for the
corporate membership program that his usage of the facilities would be
disclosed to his employer. According to counsel for the respondent, the source
of this information was the applicant’s former supervisor, the Executive
Director of Feed Nova Scotia. That is not clear on the face of the affidavit.
[39]
In
any event, the averments in the affidavit relating to what Feed Nova Scotia
personnel may have told the applicant are hearsay and do not constitute
information within the personal knowledge of the deponent, as required by Rule
81(1) of the Federal Courts Rules. An adverse inference may be drawn by
the Court from the failure of a party to provide evidence of persons having
personal knowledge of material facts (Rule 81(2)). In this case, that would
have been the Executive Director of Feed Nova Scotia, the applicant’s former
supervisor.
[40]
As
there was no attempt made by the respondent to demonstrate that the information
was reliable and that it was necessary to admit it in the form of hearsay, I
draw an adverse inference from the failure to submit an affidavit from the
supervisor. Accordingly, I have not relied on the averments in the respondent’s
affidavit that assert that the applicant was informed that his fitness centre
usage would be disclosed to his employer prior to applying for membership.
[41]
Principle
4.3 to Schedule I of the PIPEDA states that the knowledge and consent of the
individual are required for the collection, use or disclosure of personal
information, except where inappropriate. Principle 4.3.6 states that an
organization should generally seek express consent when the information is
likely to be considered sensitive, and that implied consent would generally be
appropriate when the information is less sensitive.
[42]
I
adopt the views in the Commissioner’s Report of findings that information about
the usage of the respondent fitness centre constitutes personal information, as
it is information about an identifiable individual. I agree with the respondent
that the type of information collected and disclosed is at the lower end of the
scale of sensitivity, viewed objectively. The content was limited to the number
of times per week that the applicant attended one of the respondent’s fitness
centres. The information disclosed said nothing about what he did at the
fitness centres, how long he remained, the nature of his training regime, level
of fitness or any other personal information. In other circumstances, implied
consent for the disclosure of information at such a low level of sensitivity
may be found.
[43]
I
accept the applicant’s submission that in the circumstances of this case the information
was sensitive particularly as it was being disclosed to his work colleagues at
a staff meeting and encouraged rivalry with colleagues that made him
uncomfortable. The employer should have been aware that some employees might
not be comfortable with disclosure of the information to their colleagues in a
public forum. In these circumstances, the level of sensitivity of the
information was not so low that I would consider that consent to its disclosure
could be implied.
[44]
This
is not to say that I consider the collection and dissemination of such
information to the employer unreasonable, where it involves a program which the
employer has offered as a discretionary benefit to staff and pays the cost or a
significant proportion of the cost. It is reasonable, in my view, for the
employer to be provided with the usage information in these circumstances but
the employee must be informed that this will be done and given the option to
decline the benefit. The respondent also bore responsibility to ensure that
employees participating in their corporate membership program were expressly
made aware that such information would be disclosed to their employers.
[45]
The
Commissioner’s Report recommended that the respondent modify its procedures and
documentation so as to ensure that it obtains its members’ consent to the
collection, use and disclosure of their personal information, which will
include giving members notice of the purposes for which their personal
information is collected, used and disclosed. If consent is to be obtained by a
third party, such as members’ employers, the respondent should document that
arrangement with the employers and in its information on corporate memberships.
[46]
I
note that the respondent took steps to implement the Commissioner’s
recommendation. The respondent wrote to the Office of the Privacy Commissioner
advising that a new form expressly stating that information regarding an
individual’s use of the Nubody’s facilities would be disclosed to employers
participating in the corporate partnership program was being implemented and
provided to all participating individuals.
[47]
In
my view, the breach of the PIPEDA by the respondent has been adequately
remedied by the Commissioner’s recommendation which was implemented by the
respondent.
Did
the applicant suffer any damages?
[48]
The
applicant claims a total of $85,000.00 in general, aggravated and punitive
damages. In my view, this claim is grossly disproportional to the violation of
privacy interests that occurred.
[49]
There
is little jurisprudence available to guide the Court in determining the
question of damages for breach of a privacy interest. Applying the analysis
developed in Poirier v. Wal-Mart Canada Corp., 2006 BCSC 1138, [2006]
B.C.J. No. 1725, I am of the view that the impugned disclosure of personal
information was minimal and that there has been no injury to the applicant
justifying an award of damages. This after consideration of (1) the alleged injury
to the applicant; and (2) the nature of the respondent’s conduct.
[50]
I
agree with the respondent that at the root of this application is Mr. Randall’s
displeasure with what he perceives to be his former employer’s retaliation for
his emailing the respondent to complain about disclosure of the frequency of
his visits to the fitness centre. I note that the former employer is a non-profit
organization and the respondent is a corporate entity now owned by a national
chain with presumably deeper pockets.
[51]
The
evidence does not clearly establish that the employer did in fact retaliate
against the applicant for this complaint. The evidence amounts, at best, to the
applicant’s perception that he was implicitly reprimanded and treated
differently from his co-workers for having made the complaint.
[52]
The
applicant has not provided sufficient evidence for the Court to draw an
inference that the former employer’s alleged actions were in any way connected
to his communications with the respondent. Indeed, the applicant freely acknowledged
this during the hearing.
[53]
In
any event, this is not an application against the former employer. The
respondent could not have anticipated that the employer would “retaliate” as
the applicant alleges. Further, even if a minimal injury occurred to the
applicant, which I do not accept, the respondent did not behave in a flagrant
and callous manner, nor did the respondent benefit commercially from its breach
of the applicant’s privacy interest. There is no evidence, in my view, that the
respondent acted in bad faith towards the applicant.
[54]
The
applicant says that he would have been satisfied with an apology from Nubody’s
when he first communicated his concerns about disclosure of his fitness centre
usage. It is clear from his letter of May 26, 2008 that he was by that time
seeking something more tangible by way of compensation. I see nothing in the
respondent’s conduct between August 2007 and May 2008 which would justify the
damages he is now seeking.
[55]
Pursuant
to section 16 of the PIPEDA, an award of damages is not be made lightly. Such
an award should only be made in the most egregious situations. I do not find
the instant case to be an egregious situation.
[56]
Damages
are awarded where the breach has been one of a very serious and violating nature
such as video-taping and phone-line tapping, for example, which are not
comparable to the breach in the case at bar: Malcolm v. Fleming
(B.C.S.C.), Nanaimo Registry No. S17603, [2000] B.C.J. No. 2400; Srivastava
c. Hindu Mission of Canada (Québec)
Inc.
(Q.C.A.), [2001] R.J.Q. 1111, [2001] J.Q. no 1913.
[57]
While
the applicant asserts that he suffered damages in “retaliation” by his employer
in the form of being subject to commentary in the workplace regarding his gym
usage; the only employee to have to work extended hours on one occasion;
reassignment to a different workstation; and fearing the loss of his job, I am
not convinced that any of this is attributable to the actions of the respondent
or that the respondent conducted itself in a high-handed manner towards the
applicant nor did the respondent clearly cause the “injury” to the applicant
which he alleges.
[58]
I
am of the view that the alleged breach of the PIPEDA was the result of an
unfortunate misunderstanding on the part of the respondent with respect to the
question of consent by subscribers to its corporate membership program which
has now been resolved. I do not find that the breach was the result of any
sort of malicious behaviour on the part of the respondent: Hill v. Church of
Scientology of Toronto, [1995] 2 S.C.R. 1130, [1995] S.C.J. No. 64, at
para. 196, that would justify the award of damages, let alone aggravated or
punitive damages, for the respondent’s conduct.
Conclusion
[59]
In
the result, I find that the breach of the PIPEDA by the respondent has been
adequately remedied by implementation of the recommendation of the Office of
the Privacy Commissioner.
I do not, therefore, consider it necessary
to order the respondent to correct its practices; to order the respondent to publish
a notice of any action taken or proposed to be taken to correct its practices;
or to award damages to the complainant. Accordingly, I must dismiss the
application. In the circumstances, I will exercise my discretion not to award
costs.
JUDGMENT
IT IS THE
JUDGMENT OF THIS COURT that the application is dismissed. The parties
shall bear their own costs.
“Richard
G. Mosley”
Email this Content