Date: 20110913
Docket: T-1687-10
Citation: 2011 FC 1070
Ottawa, Ontario, September
13, 2011
PRESENT: The Honourable Mr. Justice Mosley
BETWEEN:
|
YOLANDA GIRAO
|
|
|
Applicant
|
and
|
|
ZAREK TAYLOR GROSSMAN
HANRAHAN LLP
|
|
|
Respondent
|
|
|
|
REASONS FOR JUDGMENT AND
JUDGMENT
[1]
The
applicant, Mrs. Yolanda Girao, seeks remedies for a breach of privacy arising
from the disclosure of her personal information contained in a letter and
Report of Findings issued by the Privacy Commissioner of Canada which the
respondent law firm posted on the firm’s website. Among other things, Mrs.
Girao seeks compensation in the amount of $5,000,000.00 for public humiliation
and emotional damage.
[2]
This
is an application under s.14 of the Personal Information Protection and
Electronic Documents Act (“PIPEDA”), SC 2000, c 5 with regard to
a complaint made to the Privacy Commissioner of Canada (“PCC”) on
January 26, 2010.
BACKGROUND:
[3]
Mrs.
Girao represented herself on this application. She has been engaged in a
long-standing dispute with the Allstate Insurance Company of Canada (“Allstate”)
over
entitlements to accident benefits arising from a 2002 automobile accident. Mrs.
Girao had received payment from Allstate under the Statutory Accident
Benefits Schedule - Accidents on or After November 1, 1996 (SABS), O Reg
403/96 to the Insurance Act, RSO 1990, c I.8, as amended, for
various benefits and coverage of limited duration.
[4]
Mrs.
Girao sought a determination that she had suffered catastrophic impairment as a
result of the accident which, if conferred, would have entitled her to extended
benefits and increased coverage. An evaluation in June 2006 concluded that she
did not meet the medical criteria for a catastrophic designation as defined in
the SABS. Allstate denied payment of the catastrophic level benefits. Mrs.
Girao applied for mediation before the Financial Services Commission of Ontario
(“FSCO”) to resolve this and some related issues. The mediation was
unsuccessful and Mrs. Girao applied for arbitration through FSCO. The
respondent law firm Zarek Taylor Grossman Hanrahan LLP (“ZTGH”) represents
Allstate in those proceedings.
[5]
In
preparation for the arbitration, a series of assessments were obtained by Mrs.
Girao and Allstate from Ontario based medical
professionals which disagreed as to the extent of the injuries she had suffered
as a result of the accident. Allstate then sent the assessments to medical consultants
in the United
States
for review as the criteria for assessing catastrophic impairment in Ontario are based on
American Medical Association guidelines. In December 2007 Mrs. Girao filed a
complaint with the PCC against Allstate for disclosing her personal information
to the consultants without her consent.
[6]
On
February 23, 2009, the then Assistant Privacy Commissioner issued a Report of
Findings declaring that the complaint was not well-founded (“the 2009 Report”).
The report found that in the context of the FSCO proceedings, Allstate did not
disclose the applicant’s personal information in a reckless manner. By
initiating an arbitration proceeding in which she put her personal medical history
at issue, the complainant gave her implied consent for the collection, use and
disclosure of her personal information.
[7]
The
2009 Report was mailed to Allstate’s solicitor ZTGH and to the applicant with a
cover letter (“the 2009 decision letter”). At some time, thereafter, the PCC posted
a summary of the 2009 Report on its website to permit public access to the
“lessons learned” from the claim without identifying the complainant or
Allstate.
[8]
On
or about February 28, 2009, Eric Grossman, a partner at ZTGH, directed his
assistant to instruct ZTGH’s webmaster to post the 2009 Report on the ZTGH
website containing his profile under the heading “Recent Decisions”. Mr.
Grossman states in his affidavit that he did this because the decision was
relevant and of interest to ZTGH’s clients. The webmaster posted both the 2009
Report and the 2009 decision letter to Allstate on the website. The link to the
page containing those documents identified the matter as “Girao v. Allstate
Insurance” and referred to it as a “Privacy Complaint”.
[9]
In
June 2009, Mrs. Girao filed a complaint with the PCC about surveillance
conducted by a contractor retained by Allstate. In March 2010, the PCC issued a
second decision in favour of Allstate finding that the surveillance did not
exceed what would normally be expected in an insurance dispute.
[10]
On
January 26, 2010, the PCC received a complaint from the applicant with respect
to the posting of the 2009 Report and 2009 decision letter. The applicant’s
husband, Victor Mesta, had found the information on a commercial website based
in the United
States,
www.docstoc.com, which collects and
distributes documents related to a wide range of businesses including medical
professionals. Mr. Mesta had visited the site in May 2009 looking for
information about other cases involving Allstate’s U.S. consultants
and the issue of catastrophic impairment.
[11]
Mr.
Grossman learned of the complaint on or about February 26, 2010 upon receiving
a call from a representative of the PCC. He issued instructions for the
immediate removal of the information from the firm’s web site. That was done
within two hours of the matter being brought to his attention.
[12]
While
the 2009 Report and letter were on the ZTGH website, the page received 247
unique visitors, that is from different web addresses, some of whom were from members
of the firm. As of the date of the hearing, it appeared that the information remained
on the American site. At that location, the page had been viewed some fourteen
times prior to November 2010, including visits by the applicant’s husband and
members of ZTGH. There is no evidence of broader distribution or interest in
the content.
[13]
In
a decision dated September 28, 2010, Assistant Privacy Commissioner Chantal
Bernier concluded that the applicant’s complaint against ZTGH was well-founded and
resolved. In the Report of Findings (“the 2010 Report”) which accompanied the
decision letter, the PCC noted that the 2009 decision letter sent to Ms. Girao
and to Allstate contained her name. While the 2009 Report did not identify Mrs.
Girao by name, it did contain what the 2010 Report describes as her “personal
information including details about various processes she had been involved in
over the years to resolve a benefits dispute with Allstate.”
[14]
The
2010 Report cited ZTGH’s explanation that its decision to post the 2009 Report
was based on the belief that a report of finding issued by the PCC was a public
document and was not any different than decisions made by tribunals. Paragraph
7 of the 2010 Report states that ZTGH was informed that Reports of Findings are
not public documents to be accessed by the general public upon request and the
complainant had not consented to disclosure of her personal information.
[15]
The
issue before the PCC was whether ZTGH disclosed the complainant’s personal
information without her consent. At paragraph 11, the 2010 Report states the
following:
Although this Office does not
consider the report of finding to be a public document, neither does the Act
stipulate that the document is specifically to be treated as confidential. In
my view, what is clear from the case at hand is that the report of finding sent
to the two parties did contain the complainant’s personal information, whether
appearing alongside the cover letter or not (the latter patently identifying
her by name). As ZTGH did not have the complainant’s consent to disclose her
personal information, as required by Principle 4.3, it was in violation of this
principle by posting the documents on its web site, where they could be read by
anyone with access to the Web.
[16]
The
PCC found that the complaint was resolved by the removal of the 2009 decision
letter and the 2009 Report from the website.
ISSUES:
[17]
Much
of the applicant’s written and oral representations relates to the substance of
Mrs. Girao’s first complaint to the PCC against Allstate. The Notice of
Application in this matter solely addresses the September 28, 2010 decision and
Allstate was not a party to these proceedings. Accordingly, it is outside the
scope of this Court’s jurisdiction under s. 14 of PIPEDA to revisit that
matter at this time.
[18]
This
application raises the following issues:
1.
Did
ZTGH breach the applicant’s privacy rights by posting the PCC’s Report of
Findings and cover letter on its website?
2.
If
so, is the applicant entitled to remedies including an award of damages?
RELEVANT STATUTORY PROVISONS:
[19]
Section
14 of the PIPEDA allows an individual to file an application in the
Federal Court after having received a report from the PCC concerning a
complaint:
14. (1) A complainant may, after receiving
the Commissioner’s report or being notified under subsection 12.2(3) that the
investigation of the complaint has been discontinued, apply to the Court for
a hearing in respect of any matter in respect of which the complaint was
made, or that is referred to in the Commissioner’s report,
and that is
referred to in clause 4.1.3, 4.2,4.3.3, 4.4, 4.6, 4.7 or 4.8 of Schedule 1,
in clause 4.3, 4.5 or 4.9 of that Schedule as modified or clarified by
Division 1, in subsection 5(3) or 8(6) or (7) or in section 10.
|
14.
(1) Après
avoir reçu le rapport du commissaire ou l’avis l’informant de la fin de
l’examen de la plainte au titre du paragraphe 12.2(3), le plaignant peut
demander que la Cour entende toute question qui a fait l’objet de la plainte
— ou qui est mentionnée dans le rapport — et qui est visée aux articles
4.1.3, 4.2,4.3.3, 4.4, 4.6, 4.7 ou 4.8 de l’annexe 1, aux articles 4.3, 4.5
ou 4.9 de cette annexe tels qu’ils sont modifiés ou clarifiés par la section
1, aux paragraphes 5(3) ou 8(6) ou (7) ou à l’article 10.
|
[20]
Section
16 of the PIPEDA gives the Court the authority to grant the applicant
remedies, including damage awards, should the Court deem it just:
16. The Court may, in addition to any other
remedies it may give,
(a)
order an organization to correct its practices in order to comply with
sections 5 to 10;
(b)
order an organization to publish a notice of any action taken or proposed to
be taken
to correct its
practices, whether or not ordered to correct them under paragraph (a);
And (c)
award damages to the complainant, including damages for any humiliation that
the complainant has suffered.
|
16.
La Cour peut,
en sus de toute autre réparation
qu’elle
accorde :
a) ordonner à l’organisation de
revoir ses pratiques de façon à se conformer aux articles
5 à
10;
b) lui ordonner de publier un
avis énonçant les mesures prises ou envisagées pour corriger ses pratiques,
que ces dernières aient ou non fait l’objet d’une ordonnance visée à l’alinéa
a);
c) accorder au plaignant des
dommages-intérêts, notamment en réparation de l’humiliation subie.
|
[21]
Clause
4.3 in Principle 3 of Schedule 1 of the PIPEDA sets out the principles
in the national standard entitled Model Code for the Protection of Personal
Information, CAN/CSA-Q830-96.
Clause 4.3 is entitled “Consent” and reads as follows:
The
knowledge and consent of the individual are required for the collection, use,
or disclosure of personal information, except where inappropriate.
|
Toute
personne doit être informée de toute collecte, utilisation ou communication
de renseignements personnels qui la concernent et y consentir, à moins qu’il
ne soit pas approprié de le faire.
|
[22]
A
note following this Principle recognizes certain situations in which it may be
legitimate to disclose information without an individual’s express consent:
Note:
In certain circumstances personal information can be collected, used, or
disclosed without the knowledge and consent of the individual. For example,
legal, medical, or security reasons may make it impossible or impractical to
seek consent. When information is being collected for the detection and
prevention of fraud or for law enforcement, seeking the consent of the
individual might defeat the purpose of collecting the information. Seeking
consent may be impossible or inappropriate when the individual is a minor,
seriously ill, or mentally incapacitated. In addition, organizations that do
not have a direct relationship with the individual may not always be able to
seek consent. For example, seeking consent may be impractical for a charity
or a direct-marketing firm that wishes to acquire a mailing list from another
organization. In such cases, the organization providing the list would be
expected to obtain consent before disclosing personal information.
|
Note :
Dans certaines circonstances, il est possible de recueillir, d’utiliser et de
communiquer des renseignements à l’insu de la personne concernée et sans son
consentement. Par exemple, pour des raisons d’ordre juridique ou médical ou
pour des raisons de sécurité, il peut être impossible ou peu réaliste
d’obtenir le consentement de la personne concernée. Lorsqu’on recueille des
renseignements aux fins du contrôle d’application de la loi, de la détection
d’une fraude ou de sa prévention, on peut aller à l’encontre du but visé si
l’on cherche à obtenir le consentement de la personne concernée. Il peut être
impossible ou inopportun de chercher à obtenir le consentement d’un mineur,
d’une personne gravement malade ou souffrant d’incapacité mentale. De plus,
les organisations qui ne sont pas en relation directe avec la personne concernée
ne sont pas toujours en mesure d’obtenir le consentement prévu. Par exemple,
il peut être peu réaliste pour une oeuvre de bienfaisance ou une entreprise
de marketing direct souhaitant acquérir une liste d’envoi d’une autre
organisation de chercher à obtenir le consentement des personnes concernées.
On s’attendrait, dans de tels cas, à ce que l’organisation qui fournit la
liste obtienne le consentement des personnes concernées avant de communiquer
des renseignements personnels.
|
ANALYSIS:
Did ZTGH
breach the applicant’s privacy rights by posting the Report of Findings and
cover letter on its website?
[23]
The
hearing in the Federal Court of an application under subsection 14(1) of the PIPEDA
made after receipt of a report by the PCC is a de novo review of the
Commissioner’s findings and recommendations: Randall v Nubodys Fitness
Centres, 2010 FC 681 at para 32; Mirza Nammo v Transunion of Canada Inc.,
2010 FC 1284 at para 28. What is at issue is not the Commissioner’s report, but
the conduct of the party against whom the complaint is filed: Englander v
Telus Communications Inc., 2004 FCA 387 at paras 47-48.
[24]
Here
the applicant submits that the respondent has breached her privacy rights as they
are protected under the PIPEDA. Generally speaking, privacy “connotes
concepts of intimacy, identity, dignity and integrity of the individual”: Canada (Information
Commissioner) v Canadian Transportation Accident Investigation & Safety
Board,
2006 FCA 157, [2007] 1 FCR 203, 49 CPR (4th) 7 at para 52. Privacy
may also be understood as “the right of the individual to determine for himself
when, how, and to what extent he will release personal information about
himself”: R. v Duarte, [1990] 1 SCR
30, 1990 CarswellOnt 77 at para 27.
[25]
The
information contained in the 2009 Report included the following:
·
The
complaint that Allstate had disclosed the applicant’s personal information to a
third party without her consent;
·
A
summary of the PCC investigation which outlined the background to the
proceedings in which the complainant sought extended benefits and coverage;
·
A
summary of the medical assessments obtained for the mediation and arbitration
proceedings;
·
A
discussion of the PIPEDA principles which applied to the complaint;
·
The
findings and conclusion which held the complaint to be “not well-founded”.
[26]
Much
of this information also appears in the summary posted by the PCC on its
website, presumably with the consent of the applicant.
[27]
The
respondent submits that the only information which was posted
on their website that is personal information is the applicant’s name. No other
identifying information such as her address was posted. The respondent submits that
the applicant’s consent was not required for the posting of the 2009 Report and
letter because such documents should be considered to be public in nature. If consent
was required, the respondent submits, it should be implied given the
applicant’s involvement in related litigation in which the same and even more information
about the applicant’s history has been made public on several occasions.
[28]
The
respondent submits that the posting of the documents involved the disclosure of
information which a reasonable person would consider appropriate in the
circumstances. This, the respondent submits, is consistent with Section 5(3) of
PIPEDA:
An
organization may collect, use or disclose personal information only for
purposes that a reasonable person would consider are appropriate in the
circumstances.
|
L’organisation
ne peut recueillir, utiliser ou communiquer des renseignements personnels
qu’à des fins qu’une personne raisonnable estimerait acceptables dans les
circonstances.
|
[29]
The
respondent filed evidence of a Decision and Order concerning the applicant’s
arbitration in the FSCO. The FSCO published the Decision and Order on its
website without redacting the applicant’s personal information including her
medical history, details of the legal proceedings in which she is engaged or
her name. In the present application, the applicant has also filed information
of a more sensitive nature than that which appears in the 2009 Report,
including a psychiatric report, without requesting that it be kept
confidential. When asked about this, Mrs. Girao stated that she was not
concerned about the details of her personal history being made public but with
the appropriation and use of her personal information by ZTGH without her
consent.
[30]
Mrs.
Girao acknowledges that what is published on the FSCO website and other
litigation in which she is involved, including the public record of this
proceeding, reveals much more about her than does the PCC report that was
posted on the respondent’s website. The difference, she submits, is that she
went into the other litigation and this application knowing that her personal
information would be publicly accessible and consented to its disclosure in those
forums. She gave no similar consent to the disclosure of the 2009 Report
regarding her complaint against Allstate to ZTGH.
[31]
The applicant contends that it is irrelevant that she has willingly
disclosed the information about her dispute with Allstate and her medical
history in other proceedings that are public in nature including this
application. She says that the 2009 Report and 2009 decision letter contained
her personal information and her consent was required to disclose it in any
other forum or context.
[32]
The
scope of what constitutes “personal information” is not clear from the Act and
the jurisprudence. The meaning of the term was discussed by the Federal Court of Appeal in Canada (Information Commissioner) v Canada (Transportation Accident Investigation
and Safety Board) 2006 FCA 157 at paragraph 43
in the context of proceedings under the Privacy Act and the Access to
Information Act. What I draw from that decision and the authorities cited
therein, is that information is personal if it is “about” an
identifiable individual. A person will be identifiable if the information
disclosed, together with other publicly available information, would tend to or
possibly identify them. Here there could be no doubt that the information in
the 2009 Report was “about” Mrs. Girao and her complaint against Allstate as
she was named in the decision letter. In that respect, it was personal
information falling within the scope of PIPEDA, as the PCC found.
[33]
It was suggested during the hearing by counsel for the
respondent that this application constituted a collateral attack by Mrs. Girao
on ZTGH and, in particular, Mr. Grossman, because of their defence of
Allstate’s interests in the insurance litigation. While
the tone of Mrs. Girao’s representations indicate that there may be some
substance to that concern, the motivation of the applicant in a PIPEDA
review is not relevant: Waxer v J.J. Barnicke Limited, 2009 FC 170 at
para 28; Wyndowe v Rousseau, 2008 FCA 39 at para 9. If a breach of the
statute is made out, she is entitled to redress regardless of her motivation.
[34]
The
respondent submits that the Commissioner’s position that its reports are
confidential is inconsistent with the open court principle and the duty to give
reasons as it is applied in judicial and quasi-judicial proceedings. It is
apparent that ZTGH treated the report as a decision similar to those made by
tribunals in adversarial proceedings. Such reports, the respondent contends,
should be publicly accessible to inform those subject to PIPEDA, and
their legal advisors, of the scope of the statute’s reach so they may govern
their affairs or advise their clients accordingly. The respondent relies on the
PCC’s acknowledgment at paragraph 11 of the 2010 Report that there is nothing
in PIPEDA stating that PCC reports are confidential and are to be
withheld from the public.
[35]
The
2009 Report was a matter of some significance in the area of insurance litigation.
The PCC posted a three-page summary of the report on its website to inform the
public about the operation of the statute and the work of the office. That does
not mean that the inquiry conducted by the PCC involves the type of openness
that is characteristic of the work of courts and tribunals in our system. Indeed,
s. 20(1) of the PIPEDA requires that the Commissioner and her staff not
disclose any information that comes to their knowledge in the exercise of their
duties, subject to certain specified exceptions including the duty to report to
the audited organizations.
[36]
What
can then be done with those reports is unclear. As noted, PIPEDA does
not deal with that question. I expect that they receive fairly wide
distribution within the audited organizations and the legal community to
improve compliance and inform legal advice. The reports are written by the PCC staff
without reference to personal identifiers such as name and address. But the
information contained in the reports, together with other publicly available
information, may lead to the identification of the complainant and to the
disclosure of the complainant’s personal information without consent.
[37]
The
non-consensual disclosure of personal information respecting complainants under
PIPEDA is inconsistent with the intent of the legislation to promote
privacy interests. That intent is compatible with the legitimate interest of
the public to obtain information about PCC decisions. Those interests can be accommodated
by the preparation of anonymized summaries such as the PCC posted on its
website.
[38]
In
choosing to publish the 2009 Report to provide information to the industry and
profession, the onus was on the respondent to ensure that they did not disclose
personal information about the complainant without her consent. They were
reckless in failing to ensure that Mrs. Girao was not identifiable in the
posting.
[39]
I
conclude, therefore, that the PCC properly found that there had been a breach
of the statute by the publication of the applicant’s personal information on
the respondent’s website without her consent.
Is the applicant entitled to
remedies including an award of damages?
[40]
The
applicant seeks the following remedies:
·
That
the respondent be required to post an apology to the applicant on its website for
one year for not complying with principle 4.3 under Schedule 1 of the PIPEDA;
·
That
the respondent be required to post on its website for one year the 2010 Report
and cover letter;
·
That
the respondent pay to the applicant $5,000,000.00 in compensation for the
public humiliation suffered and for the emotional damage she has suffered as a
result of the breach.
[41]
Mrs.
Girao contends that Mr. Grossman posted the 2009 Report and decision letter for
ZTGH’s and his personal economic gain, that the action was deliberate, that it
caused her great public humiliation and put her mental health in jeopardy. She
submits that ZTGH should compensate her by an amount roughly equivalent to the
firm’s earnings for the length of time during which her personal information
was posted on their website.
[42]
In
Randall, above at paragraph 55, I expressed the view that an award of
damages under s. 16 of PIPEDA should only be made in the most egregious
situations. In that case, I was satisfied that the breach which occurred was
the result of an unfortunate misunderstanding between the parties that had been
resolved by the remedial action taken by the respondent and did not call for
damages. In Nammo, above, Justice Russell Zinn awarded damages of
$5000.00 for a breach that was serious in nature involving financial
information of high personal and professional importance.
[43]
In determining the damages to be awarded, Justice Zinn
acknowledged the quasi-constitutional nature of privacy rights in Canada and
referred to the Supreme Court’s recent damages analysis from Vancouver
(City) v Ward, 2010 SCC 27. In that case the Supreme Court pointed to three
rationales for awarding damages for breaches of The Canadian Charter of
Rights and Freedoms: compensation, deterrence and vindication.
[44]
With respect to the compensatory rationale, the Supreme
Court observed at paragraph 48 of Ward that “the
concern is to restore the claimant to the position she would have been in had
the breach not been committed … As in a tort action, any claim for compensatory
damages must be supported by evidence of the loss suffered.” According to this
rationale, demonstrable losses suffered by the applicant as a result of the
disclosure of her personal information could be compensated by an award of
damages under s. 16 of PIPEDA.
[45]
The Court in Ward went on in paragraph 51 to characterize
an award of damages pursuant to the deterrence and vindication rationales as
“an exercise in rationality and proportionality”. Chief Justice McLachlin
observed at para 52 that “[a] principal guide to the determination of
quantum is the seriousness of the breach, having regard to the objects of s.
24(1) damages. The seriousness of the breach must be evaluated with regard to
the impact of the breach on the claimant and the seriousness of the state
misconduct”.
[46]
At paragraph 76 of Nammo Justice Zinn sets out
certain non-exhaustive factors that could be applied to PIPEDA
applications for damages before this Court:
·
Whether awarding damages would further the general objects
of PIPEDA and uphold the values it embodies;
·
Whether damages should be awarded to deter future breaches;
and
·
The seriousness or egregiousness of the breach.
[47]
In
assessing the seriousness of the breach in question, Justice Zinn took into
account the following considerations in his analysis at paragraphs 68-71 of Nammo:
- The impact of the
breach on the health, welfare, social, business or financial position of
the applicant;
- The conduct of the
respondent before and after the breach;
- Whether the
respondent benefited from the breach.
[48]
Other
factors that may be relevant to the seriousness of the breach include:
- The nature of the
information at stake;
- The nature of the
relationship between the parties;
- Prior breaches by
the respondent indicating a lack of respect for privacy interests.
[49]
In
this case, the information was personal but not highly sensitive. I accept that
the breach here was an isolated incident. There is nothing on the record that
suggests the documents were posted maliciously or with the intent to cause
harm. See: Hill v Church of Scientology of Toronto, [1995] 2
SCR 1130 at para 196. Nor is there any evidence of repeated violations of
privacy interests by the respondents. However, the disclosure was in a form
that implicates the statutory scheme itself in that it related to a PCC
investigation and report of findings.
[50]
Parliament
has ensured that Canadians have the right to file complaints with the PCC for
investigation without fear of having their personal information disclosed other
than in certain constrained circumstances. That right should be protected by
the Courts. To that end, an award of damages would further the general objects
of PIPEDA and uphold the values it embodies. A damage award would also
send the message to lawyers and individuals with increased public
responsibility that they must proceed prudently when dealing with private
information.
[51]
In
considering the relationship between the parties, there is an obvious imbalance
between a self-represented litigant and a law firm. However, the applicant is
not unfamiliar with the legal process. She has represented herself in a civil
action before the Superior Court of Justice since 2008. Mrs. Girao previously
had legal assistance to advance her insurance claims but informed the Court
that she no longer has confidence in the profession due to disputes with her
former solicitors.
[52]
At
the time the breach occurred, Mrs. Girao was engaged in adversarial proceedings
with a third party represented by the respondent. Thus, while her motivation in
making complaints to the PCC may be irrelevant in so far as her entitlement to
remedies for a breach of her privacy interests is concerned, animus against the
respondent may bear on the quantum of any damages that the Court may award. I
inferred from her impassioned oral representations that Mrs. Girao’s sense of grievance
relates more to the actions of Allstate in denying coverage than to the
disclosure of her personal information. But it was also clear that she bears
considerable animus towards ZTGH and Mr. Grossman in particular, for their part
in denying her what she believes to be her rightful benefits.
[53]
Law
firms providing advice to clients who deal with the personal information of
their customers must be knowledgeable about privacy law and the risks of disclosure.
Lawyers also have a public duty to protect the integrity of the legal process. The
failure of lawyers to take measures to protect personal information in their
possession may justify a higher award than that which would be imposed on
others who are less informed about such matters.
[54]
Section
16 of PIPEDA provides no guidance as to the quantum of damages that may
be granted. Here the applicant is claiming that she suffered mental anguish as
a result of the breach. In calculating what might be an appropriate amount to
award for such harms, it may be useful to refer to relevant provincial
legislation. Section 65 of the Ontario Personal Health
Information Act,
2004, SO 2004, c 3, Sch A, may be of assistance in this context as it deals
with the protection of medical information. Under that provision, the Superior
Court of Justice may award damages, not exceeding $10, 000.00 for mental
anguish resulting from the willful or reckless contravention of the statute.
[55]
In
some cases, such as Nammo, a damages award may also be used to compensate
a complainant for economic loss and expense incurred in dealing with the
consequences of the breach. Here, the respondent points to the lack of any
evidence in the applicant’s record that would support a finding that she had
suffered any damages as a result of the posting. The respondent submits that
the posting of the 2009 Report has not attracted adverse attention to the
applicant in any way that would sustain a claim of damages. I agree that the
record does not establish that the applicant suffered humiliation as a result
of the breach.
[56]
The
applicant asserts that her mental health was seriously affected. The record
before me does not make a connection between the treatment she is presently undergoing
and the disclosure of the personal information. The one medical report filed is
from a psychiatrist dated April 4, 2008; almost one year before the 2009 Report
and letter were posted. The letter speaks to the applicant’s psychological
condition and treatment as it related to the car accident, and not in any way
to the subsequent disclosure of her personal information.
[57]
According
to an exhibit attached to Mrs. Girao’s affidavit, her husband became aware of
the ZTGH posting as early as May 2009. Mrs. Girao referred to it in a letter to
a PCC investigator in August 2009, presumably while the first complaint was
under review. No steps were taken to inform ZTGH of this prior to the PCC’s call
to Mr. Grossman in February, 2010. The information thus remained on the ZTGH
website for a much longer period than might have been the case if the firm had
been notified in a timely manner. It is not clear when it first appeared on the
US website.
[58]
The
evidence is that 247 persons accessed the information on the ZTGH site prior to
the filing of the complaint, including members of the firm itself. I expect
that most of those persons would have been interested in the legal issues
arising from the case and not in Mrs. Girao’s personal information. While the
2009 Report may still be accessed at the U.S. site and
could be disseminated further by visitors to that site, the evidence indicates
that the traffic to that page was minimal. In any event, there is nothing
before me to indicate that there would be any broader interest in the
applicant’s personal information or that it has been used in any way to cause
any adverse effects to her health and welfare.
[59]
There
is no evidence before me that the respondent posted the information for
economic gain. Mr. Grossman saw the 2009 Report to be an important precedent in
the domain of insurance defence litigation and posted it on his firm’s website
to inform their clients and others about the development of the law in that
field. It is a common business practice for law firms to post such information.
Success achieved by the firm in litigation may help to retain or attract
clients. But there is no basis in law upon which Mrs. Girao would be entitled
to an accounting of any benefits that may have flowed to ZTGH from the
publication of the 2009 Report even if the value of such benefits could be
calculated, which is unlikely.
[60]
The
nature of this breach fits somewhere at the low end between the breach
committed in Randall: “the result of an unfortunate misunderstanding”;
and that which was committed in Nammo: a “serious breach
involving financial information of high personal and professional importance”.
That is not the case here. While the information related to her claim for
increased benefits, there was no disclosure of her financial status. The
applicant submitted evidence of her current limited income on this application,
but there is no evidence that this is due to the disclosure of her personal
information or that she has missed opportunities to earn income as a result.
[61]
The
respondent was careless in posting but did not act in bad faith. ZTGH deleted
from its website all references to the applicant as soon as it became aware
that there was a concern. The law firm was negligent in not taking steps to
ensure that any personal information about an identifiable complainant was
removed before it posted the report. In the result I consider it appropriate to
make an award of $1500.00.
[62]
As
for the other remedies sought by the applicant, I see no present purpose in
requiring the respondent to post an apology or the PCC 2010 decision on the
firm’s website. I note that this decision will be posted on the Court’s website
and will be accessible indefinitely. That may have a greater effect in
promoting adherence to the objects of the legislation.
[63]
The
applicant seeks her costs of this application. There is no evidence before me
of any expenses incurred by the applicant other than that disclosed by the
Court record, or, of foregone remuneration. I note that a motion to proceed in
forma pauperis was denied because no evidence of assets was filed.
Nonetheless, I think it appropriate to award the applicant a modest lump sum of
$500.00 to cover her out of pocket expenses. See AZ Bus Tours v. Tanzos
2009 FC 1134 at para.49.
JUDGMENT
THIS COURT’S JUDGMENT
is that
1.
the
application for review of the Report of Findings by the Privacy Commissioner of
Canada is granted;
2. the respondent
shall pay the applicant $1500.00 in damages for the disclosure of her personal
information ; and
3. the
respondent shall pay the applicant $500.00 for her costs in bringing this
application.
“Richard
G. Mosley”