Docket: T-392-15
Citation:
2015 FC 1283
Ottawa, Ontario, November 17, 2015
PRESENT: The
Honourable Mr. Justice Harrington
|
BETWEEN:
|
|
PATRICIA COTE
|
|
Applicant
|
|
and
|
|
DAY & ROSS
INC.
|
|
Respondent
|
JUDGMENT AND REASONS
[1]
Patricia Cote believes to the depth of her very
being that her former employer, Day & Ross Inc., has done her wrong. It denied
her short-term disability claim. It failed to pass on crucial medical
information which would have entitled her to group insurance long-term
disability benefits. Rather than accommodate her disability arising from
depression and anxiety, it fired her. As a result, her life is in shambles. She
seeks compensation in the hundreds of thousands of dollars. She may be right;
she may be wrong. I cannot say. I will not say. These matters are to be decided
at another time, in another place by someone else; perhaps as early as next
month in the New Brunswick Court of Queen’s Bench. All that is before me is an
application under section 14 of the Personal Information Protection and
Electronic Documents Act [PIPEDA].
[2]
In light of her treatment at the hands of Day
& Ross, Mrs. Cote did four things, not necessarily in chronological order:
a.
she sued;
b.
she filed a complaint with the Canadian Human
Rights Commission;
c.
she complained to the Superintendent of
Insurance; and
d.
she filed a complaint with the Privacy Commissioner
under the PIPEDA.
[3]
She first attempted to sue Day & Ross in
this Court. Prothonotary Morneau directed that the Statement of Claim not be
accepted for filing as the claim was beyond our jurisdiction. He was absolutely
correct. Apart from master and crew wages, which have always formed part of an
admiralty court’s jurisdiction, this Court does not have jurisdiction over
employment contracts as such, even in federally regulated industries.
[4]
Mrs. Cote then sued Day & Ross in the New
Brunswick Court of Queen’s Bench. She informs me that the matter has been set
down for trial next month.
[5]
The Canadian Human Rights Commission decided not
to deal with her complaint under s 41(1) of the Canadian Human Rights Act
[CHRA] as there were other grievance or review procedures reasonably available.
The Commission concluded that it should not deal with the complaint because the
civil action in the New Brunswick’s Court of Queen’s Bench will look at the
same facts and has the authority to grant remedies consistent with those
available under the CHRA. At the termination of the civil action, the
Commission might exercise its discretion to then deal with the complaint.
[6]
The situation with the Superintendent of
Insurance is not in the record before me.
[7]
In the matter before me, the Privacy Commission
issued a report that Mrs. Cote’s complaint was well founded and resolved. Under
s 14(1) of PIPEDA, Mrs. Cote, within 45 days after receiving the Privacy
Commissioner’s report, was entitled to apply to this Court for a hearing in
respect of any matter in which the complaint was made or was referred to in the
report and is covered in certain specific clauses of the PIPEDA schedule.
[8]
This application is not by way of judicial
review. It is a de novo hearing (Nammo v TransUnion of Canada Inc,
2010 FC 1284, [2012] 3 FCR 600).
[9]
Under s 16 of PIPEDA, the Court may, among other
things, order an organization to correct its practices, to publish a notice in
that regard and “award damages to the complainant,
including damages for any humiliation that the complainant has suffered.”
[10]
The complaint dealt with by the Privacy
Commissioner was that Day & Ross failed to provide her with access to the
personal information it held about her. More specifically, it did not respond
to her request within the 30-day time frame specified in PIPEDA and the
response ultimately provided was incomplete.
[11]
On 13 March 2013, Mrs. Cote sent an email to Day
& Ross’s management coordinator in which she referred to PIPEDA and said “May I please be made privy
of my personnel file via email?”
[12]
On 17 April 2013, Mrs. Cote was provided with
information with an accompanying statement: “Here is
everything that was in your HR employee file.” The response was late.
[13]
Mrs. Cote complained that the information
provided did not include some medical information .There may have been a
misunderstanding as medical information was not kept in her “personnel” file,
but in another file. Further information was then provided, again, of course,
outside the 30-day legal delay.
[14]
We now come to the reality of Mrs. Cote’s
complaint. She had applied for short-term disability, and then long-term
disability, based on her depression and anxiety. Although the policy was not
filed in the record, the emails clearly establish that Day & Ross
self-insures for the first 17 weeks. Thereafter, there is a group policy with Sun
Life. Day & Ross, rightly or wrongly, rejected her short-term disability
claim.
[15]
What it did not do in providing her with her
medical information it kept on file was give copy of its correspondence with Sun
Life with respect to long-term disability. Apparently it considered, quite
wrongly in my view, that this correspondence was not covered by PIPEDA. That
correspondence only came to light with an affidavit of documents in the action
in the New Brunswick Court of Queen’s Bench. It was only then that Mrs. Cote
realized that one of her doctor’s reports, which apparently had been misplaced
for some time, had not been passed on to Sun Life. Day & Ross maintains
that the report in question only dealt with short-term disability and so there
was no reason to pass it on to Sun Life. It is not for me to say whether Day
& Ross was obliged to pass the report on, or whether Mrs. Cote was
prejudiced as a result.
[16]
The Privacy Commissioner recommended that one of
Day and Ross Inc.’s principles in its privacy policy be changed. The policy
stated that it would only provide the reasons for denying
access to personal information “upon request”. Those
words have now been deleted from the policy.
[17]
Day & Ross had failed to properly explain to
Mrs. Cote the basis upon which it initially withheld certain information, such
as the correspondence with Sun Life, a third party. Section 8(7) of PIPEDA requires
organizations to give reasons. Apparently, Day & Ross had assumed that this
correspondence was not “personal information” within the meaning of PIPEDA. It
was wrong. The Privacy Commissioner noted that Mrs. Cote’s access requests were
now fulfilled, as a result, in part, of documents provided in the litigation
before the New Brunswick Court of Queen’s Bench.
[18]
The closing two paragraphs of the report are as
follows:
56. We remain concerned, however, that the Organization’s initial
responses to the complainant’s access requests were not in compliance with the
Act. While we appreciate the competing demands faced by the Organization in the
circumstances, the fact that the complainant may have had other ongoing
disputes with the Organization at the time is not an excuse for non-compliance
with the Act. We would therefore encourage the Organization to ensure that its
policies and procedures are adequate and that staff is sufficiently trained on
how to respond to access requests from employees. In particular, staff should
be reminded of their obligation to provide reasons when refusing to provide
information in response to an access request pursuant to the Act.
...
57. Accordingly, we conclude that the matter is well-founded
and resolved.
[Emphasis in original.]
[19]
The correspondence with Sun Life about Mrs. Cote
was her personal information covered by PIPEDA and should have been disclosed
without the necessity of litigation. Section 9(1) of PIPEDA provides that an
individual shall not be given access to personal information if doing so would
likely reveal information about a third party. However, if the information
about the third party is severable, it shall be severed.
[20]
In Wyndowe v Rousseau, 2008 FCA 39,
[2008] FCJ No 151 (QL), Rousseau was receiving long-term disability benefits
from an underwriter and had been examined by Dr. Wyndowe who sent a
formal report to the underwriters. The report resulted in disability payments
being terminated. Dr. Windowe refused to share his examination notes. However,
it was held that the notes could be assessed in so far as they contained
personal information about Rousseau, i.e. the information he gave while
answering the doctor’s questions and the report prepared for the insurer. There
had to be a balance between this and the doctor’s personal interest in the
notes.
[21]
In terms of remedies, Day & Ross has abided
by the Privacy Commissioner’s recommendations. I see no need to make a further
order. As to damages, Day & Ross submits that this is not a case in which
damages should be awarded. I disagree. It failed Mrs. Cote three times. An
order of damages may make it more alert and sensitive to its obligations in the
future.
[22]
There are a number of cases which deal with the
award of damages under PIPEDA. Many award no damages at all. In Biron v RBC Royal
Bank, 2012 FC 1095, 418 FTR 131, the disclosure of credit card statements
in a divorce proceeding resulted in damages of $2,500 plus costs. In Girao v
Zarek Taylor Grossman, Hanrahan LLP, 2011 FC 1070, 397 FTR 108, the
disclosure of personal information relating to medical conditions resulted in
an award of $1,500 plus $500 costs. In Landry v Royal Bank of Canada,
2011 FC 687, 391 FTR 153, disclosure of financial information in divorce
proceedings gave rise to damages of $4,500 plus costs.
[23]
In Nammo, above, disclosure of inaccurate
personal information to a bank causing credit issues resulted in an award
$5,000 in damages plus $1,000 in disbursements. In Chitrakar v Bell TV,
2013 FC 1103, 441 FTR 254, the respondent had ordered a credit report without
the applicant’s consent. This kind of check can lower a person’s credit score.
There was also no evidence that Bell TV had changed its contracting policies in
light of the Privacy Commissioner’s report or that it even acknowledged that it
had breached PIPEDA. The Court awarded general damages of $10,000, exemplary
damages of $10,000 and $1,000 for disbursements.
[24]
Day & Ross has acknowledged its errors and
changed its policy as requested. Nevertheless, an award of damages will drive
home its failure to meet its obligations under PIPEDA and, hopefully, cause it
to be more attentive to these matters in the future.
[25]
I shall award Mrs. Cote damages of $5,000, and
$1,000 for disbursements and other costs.
Email this Content