Date: 20181115

Docket: T-852-18

Citation: 2018 FC 1155

Ottawa, Ontario, November 15, 2018

PRESENT:  The Honourable Madam Justice Roussel

BETWEEN:

CATHERINE B. MONTALBO

Applicant

and

ROYAL BANK OF CANADA

Respondent

JUDGMENT AND REASONS

I.  Introduction

[1]  The Applicant, Ms. Catherine B. Montalbo, has brought an application to the Court for a hearing pursuant to section 14 of the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 [PIPEDA]. She alleges that the Respondent, the Royal Bank of Canada, breached its obligations under the PIPEDA in its collection, security safeguards, retention and destruction of her personal information. She is seeking damages under paragraph 16(c) of the PIPEDA for distress and inconvenience.

[2]  For the reasons set out below, the application is allowed.

II.  Background

[3]  In January 2016, the Applicant communicated with the Respondent and requested approval for a residential property mortgage. Her original mortgage with another financial institution was set to expire on March 15, 2016 and the Applicant was looking to secure a new mortgage without a co-signer.

[4]  During the course of this process, the Applicant communicated her personal financial information to a Financial Advisor employed by the Respondent. This information included T4 slips, pay statements, notices of assessment, a tax summary and a receipt of payment made to the Canada Revenue Agency. The Financial Advisor subsequently forwarded by means of an internal mail transfer the Applicant’s records to a Mortgage Associate, who in turn, brought them to a Mortgage Specialist on February 25, 2016. The Mortgage Specialist reviewed the Applicant’s financial situation and determined that the Applicant would not qualify for a mortgage without a co-signer.

[5]  On March 8, 2016, the Applicant renewed her mortgage with the other financial institution.

[6]  The same day, the Applicant called the Financial Advisor to whom she had communicated her personal financial information and left a message asking about her mortgage application and documents. The Applicant called again the next day but the Financial Advisor’s telephone was no longer in service.

[7]  On April 29, 2016, the Applicant went to the branch where she had initially dropped off her documents seeking answers on the status of her personal records. She was informed by the branch manager that the Financial Advisor had moved to a branch in another province. The Applicant claims that the branch manager also told her that a thorough search of the branch had been conducted and her documents were nowhere to be found, and that they could have been shredded.

[8]  On May 2, 2016, the Financial Advisor called the Applicant and informed her that she had given the Applicant’s documents to the Mortgage Associate. The Applicant contacted the Mortgage Associate on May 4, 2016 to enquire about her personal records. The following day, the Mortgage Associate contacted the Applicant and informed her that he had her documents and that they were being held while the Applicant investigated her options regarding a co-signer. During this conversation, the Mortgage Associate asked the Applicant if she wanted the documents returned to her. She responded that she was undecided as the documents would be the subject of an investigation and asked the Respondent to keep her personal records while she made her decision.

[9]  The Applicant subsequently sent several letters of complaint to the Respondent regarding the handling of her personal records and asked that an investigation be conducted into the matter. In a letter dated May 24, 2016, the Manager of Client Care at the same branch explained that a thorough investigation was conducted and that:

… [y]our application started on January 14, 2016 and as of April 14, 2016 it had been outstanding for 3 months. We had not heard from you regarding an additional co-signor [sic], therefore we suspended your application. The documents that were used to support your declarations regarding your finances were moved into a secure miscellaneous shredding bin in the mortgage representative’s office.

All mortgage representatives work outside of our branches, and their office space has been approved by [the Respondent] for adherence to our high privacy standards. Our mobile staff members bring their shredding to the branches regularly to ensure the documents are destroyed properly. It is not unusual for a mortgage specialist to keep these documents in a miscellaneous box and bring them to the branch in bulk for shredding. This is why our mortgage specialist still had your documents, which were pending shredding.

As per my investigation I found that your documents did serve their purpose. I also was able to confirm that your documents have been stored in a secure location since your application expired and are pending shredding.

[10]  Dissatisfied with the response, the Applicant wrote to the Respondent’s Ombudsman’s Office on May 30, 2016. She received a response dated June 3, 2016, wherein it was stated that the Applicant’s documents were kept in a secure location at all times and that no privacy breach occurred. The Applicant wrote to the Respondent’s Ombudsman’s Office again on June 20, 2016, indicating that she was dissatisfied with the previous response. No further response followed from the Respondent.

[11]  On October 26, 2017, the Applicant filed a complaint with the Office of the Privacy Commissioner of Canada [OPC]. On March 26, 2018, the OPC issued a report in response to the complaint in which it declined to continue its investigation under paragraph 12.2(1)(c) of the PIPEDA. The OPC noted that it was satisfied that:

[The Respondent] has provided a reasonable explanation as to how your personal information was safeguarded (i.e., securely stored in the mortgage specialist’s office and later in a secure shredding bin) and that it was subsequently destroyed. It was not unreasonable for it to take [the Respondent] staff a short period of time to locate your personal information given the period of inactivity and that the mortgage specialist’s office was off-site.

In light of the information provided by the parties, the OPC is satisfied that the organization’s actions were appropriate. [The Respondent] has, therefore, provided a fair and reasonable response to the complaint.

[12]  In her application pursuant to section 14 of the PIPEDA, the Applicant is asking the Court to examine the conduct of the Respondent in relation to its collection, security safeguards, retention and destruction of her personal information. She is also seeking, pursuant to paragraph 16(c) of the PIPEDA, “monetary relief for mental and physical distress and for all the inconveniences this issue had (sic) caused”.

III.  Issues

[13]  The Applicant raises four (4) issues: (1) the Financial Advisor who collected her personal information did not have the authority to do so; (2) the Mortgage Associate who handled her mortgage application failed to properly safeguard her personal records by placing them in a bin or miscellaneous box and not a secured locked cabinet; (3) her personal records were illegally detained and inappropriately safeguarded between May 25, 2016 and January 2018; and (4) the Respondent illegally destroyed her personal records while there was an ongoing investigation by the OPC.

IV.  Statutory Scheme

[14]  Although the PIPEDA comprises six (6) parts, only Part 1 is relevant for the purposes of this application. It is entitled “Protection of Personal Information in the Private Sector” and is divided into five (5) Divisions. Two (2) of those Divisions concern this proceeding: Division 1, which deals with the protection of personal information (sections 5 to 10), and Division 2, which sets out a comprehensive remedy process (sections 11 to 17.2).

[15]  The purpose of Part 1, as set out in section 3 of the PIPEDA, is:

 

[16]  There is no dispute that Part 1 of the PIPEDA applies to the Respondent.

[17]  By virtue of subsection 5(1), organizations must comply with Schedule 1 of the PIPEDA, which incorporates the Principles Set Out in the National Standard of Canada Entitled Model Code for the Protection of Personal Information, CAN/CSA-Q830-96. These principles contain both obligations and recommendations relating to: (1) ensuring accountability; (2) identifying the purpose for which the personal information is being collected; (3) requiring the knowledge and consent of the individual whose information is collected, used or disclosed; (4) limiting collection to that which is necessary for the purposes identified by the organization; (5) limiting use and disclosure to the purposes of collection and limiting retention for only as long as necessary to fulfill those purposes; (6) ensuring the accuracy of the personal information; (7) providing appropriate security safeguards for the personal information; (8) making information concerning management policies and practices readily available; (9) providing individuals access to information regarding the existence, use and disclosure of their personal information; and finally (10) giving individuals the right to challenge an organization’s compliance with these principles through the establishment of complaint mechanisms.

[18]  Pursuant to subsection 11(1), an individual may file a written complaint with the OPC if he or she believes that an organization has contravened its obligations under the PIPEDA. In conducting its investigation into the complaint, the OPC enjoys broad investigatory powers, including discontinuing the investigation if it considers that the organization has provided a fair and reasonable response to the complaint (PIPEDA, paragraph 12.2(1)(c)). Under subsection 12.2(3) of the PIPEDA, the OPC shall notify the complainant and the organization that the investigation has been discontinued and give reasons.

[19]  Section 14 of the PIPEDA empowers a complainant to bring an application to this Court for a hearing in respect of any matter in respect of which the complaint to the OPC was made or that is referred to in the OPC’s report and that also refers to the principles set out in the clauses of Schedule I specifically identified in subsection 14(1) of the PIPEDA. Subsection 14(1) of the PIPEDA reads as follows:

[20]  An application for a hearing under section 14 is not a judicial review of the OPC’s decision. As this Court has previously stated, it is a de novo review of the conduct of the party against whom the complaint was made (Englander v Telus Communications Inc, 2004 FCA 387 at paras 47-48; see also Miglialo v Royal Bank of Canada, 2018 FC 525 at para 21 [Miglialo]; Fahmy v Bank of Montreal, 2016 FC 479 at para 22 [Fahmy]; Blum v Mortgage Architects Inc, 2015 FC 323 at para 12 [Blum]; Townsend v Sun Life Financial, 2012 FC 550 at para 23 [Townsend]; Landry v Royal Bank of Canada, 2011 FC 687 at para 1 [Landry]; Girao v Zarek Taylor Grossman Hanrahan LLP, 2011 FC 1070 at para 23 [Girao]; Nammo v TransUnion of Canada Inc, 2010 FC 1284 at para 28 [Nammo]; Randall v Nubodys Fitness Centres, 2010 FC 681 at para 32 [Randall]).

[21]  If the Court finds that the organization is in violation of its obligations, it must then consider the remedies available to the Applicant under section 16 of the PIPEDA. The Court may, in addition to any other remedies it may give, award damages to the complainant, including damages for any humiliation that the complainant has suffered (PIPEDA, para 16(c)).

V.  Analysis

[22]  At the hearing, the Respondent argued that the Court lacked jurisdiction to review some of the Applicant’s arguments on the basis that the issues she was raising were never previously complained of or referred to in the OPC’s report. I have reviewed the Applicant’s complaint as well as the OPC’s report and I am satisfied that I have jurisdiction to examine her arguments as they relate, albeit in a summary way, to matters which are covered in the OPC’s report, namely the collection, use, retention, security safeguards and destruction of the Applicant’s personal records.

A.  Collection of Personal Information and Documents by the Financial Advisor

[23]  In her written submissions, the Applicant contends that the Financial Advisor who collected her personal information and documents did not have the authority to do so as the collection of personal information for the purposes of assessing mortgage eligibility does not fall within a financial advisor’s job description. She also contends that the Financial Advisor is considered a third party under clause 4.1.3 of Schedule 1 of the PIPEDA.

[24]  The Applicant’s argument is without merit.

[25]  The Financial Advisor who collected the Applicant’s information is an employee of the Respondent. The Applicant is therefore misconstruing the concept of a “third party” found in clause 4.1.3 of Schedule 1 of the PIPEDA, which provides that an organization is responsible for personal information that has been transferred to a third party for processing.

[26]  Moreover, the Applicant’s belief that the Financial Advisor did not have the authority to collect her personal information is based on the job description of a financial advisor she found in conducting her research. As the collection of personal information for the purposes of assessing a mortgage application is not listed in the description, she contends that the Financial Advisor lacked the requisite authority to do so. While the Applicant relies on a particular job description, she was not able to tell the Court to which organization the job description relates nor was she able to demonstrate that the duties listed in the job description were consistent with those of the Respondent’s Financial Advisor.

[27]  In fact, there is no evidence on the record demonstrating that the collection of the information by the Financial Advisor was contrary to the collection principles under the PIPEDA. The Applicant concedes that the Financial Advisor collected the Applicant’s personal records for the sole purpose of assessing her eligibility in the context of her mortgage application. Not only was the collected information necessary and limited to that purpose, the Applicant consented to its collection when providing it to the Financial Advisor. There is also no evidence that she raised an objection at the time of doing so.

B.  The Mortgage Associate’s Failure to Safeguard the Applicant’s Personal Records

[28]  The Applicant contends that the Mortgage Associate failed to safeguard her personal records. This belief is based on two (2) conversations she had with the Mortgage Associate on May 4 and 5, 2016. The Applicant alleges that when she phoned the Mortgage Associate on May 4, 2016 to inform him that the Financial Advisor had stated that she had forwarded the documents to him, the Mortgage Associate denied receiving the documents. When he called her back the next day, the Mortgage Associate informed the Applicant that he had found the Applicant’s personal records “in a bin, miscellaneous box”. The Applicant is convinced that the Mortgage Associate is not telling the truth because if the documents had in fact been kept in a locked cabinet in his home office, he would not have taken a day to get back to her.

[29]  In an affidavit sworn on June 6, 2018, the Mortgage Associate states that all of his work for the Respondent is completed from an office located in his home. This office is dedicated solely to work for the Respondent and meets all the requirements of the Respondent for ensuring confidentiality of client records. Client records are stored in a locked cabinet in his home office and he possesses the only key to the locked cabinet. His laptop computer is also stored in a locked docking station and is password protected to ensure information cannot be accessed.

[30]  The Mortgage Associate further states that when the Applicant first contacted him, he did not recall where the documents were located at the time of the telephone call. He would not have advised the Applicant that her personal records were in a miscellaneous box or bin as it is not his practice to leave confidential records in an unsecured location. He states that he may have advised her that he had placed her personal records into miscellaneous filing which is an area within his locked cabinet where he keeps confidential records that are outstanding. On cross-examination, the Mortgage Associate also explained that when the Applicant first called him, it was late in the business day (Applicant’s Record at 63).

[31]  The Applicant’s argument must once again fail.

[32]  In accordance with clause 4.7 of Schedule 1 of the PIPEDA (Principle 7 - Safeguards), “[p]ersonal information shall be protected by security safeguards appropriate to the sensitivity of the information”. Pursuant to clause 4.7.3 of the same Schedule, the methods of protection should include physical measures such as locked filing cabinets and restricted access to offices. This would include storage of personal records in a locked cabinet in the office of the Mortgage Associate.

[33]  While the Applicant and the Mortgage Associate disagree on what the Mortgage Associate said to the Applicant during those two (2) telephone conversations, there is no evidence demonstrating, or even suggesting, that the Mortgage Associate failed to appropriately safeguard the Applicant’s personal records when they were in his possession. The basis upon which the Applicant’s complaint and belief is founded — that it took a day for the Mortgage Associate to get back to her — is simply not reasonable. While the Applicant may have wanted an answer immediately, it was not unreasonable for the Mortgage Associate to confirm that the Applicant’s personal records were in his home office cabinet and to call the Applicant the next day.

C.  Retention of the Applicant’s Personal Records for Twenty (20) Months

[34]  By letter dated May 24, 2016, the Applicant was first advised by the Respondent that her personal records were pending shredding.

[35]  The Applicant then received confirmation from the OPC by letter dated March 26, 2018 that her personal records had been handed over for destruction on May 25, 2018. The OPC’s report contains the following passage:

From both statements to you and discussions with our Office, we understand that the documents were stored securely in the mortgage specialist’s office, which is at a different location from the branch office where you dropped off your information. [The Respondent] further informed that once you requested that your information be destroyed, the documents were sent to the branch and then placed in a secure shredding bin on 25 May 2016, which was picked up by the secure destruction service provider that same day.

[36]  Despite receiving this information, the evidence demonstrates that the Applicant’s personal records were not placed in the secure shredding bin on May 25, 2016. According to the affidavit sworn by the Respondent’s Mortgage Associate on June 6, 2018, it appears that the Applicant’s personal records were in fact only placed in the shredding bin “in or around January of 2018”.

[37]  In light of this most recent information, the Applicant contends that the Respondent failed to establish the appropriate security safeguards for her personal records for the period of twenty (20) months, between May 25, 2016 and January 2018.

[38]  The Respondent concedes that it retained the Applicant’s personal records for longer than would ordinarily be its practice. It submits, however, that the direction contained in clause 4.5.3 of Schedule 1 of the PIPEDA regarding the destruction of personal information is suggestive rather than directive, requiring only that personal information “should” be destroyed, and not that it “must” be destroyed. The Respondent further submits that it was reasonable for it to extend the retention of the Applicant’s personal records given the issues raised by the Applicant in her complaints to the Respondent and to the OPC and the fact that she did not direct the Respondent to destroy or return her personal records at any time.

[39]  The Respondent has also adduced evidence, by means of the Mortgage Associate’s affidavit, that the Applicant’s personal records were, at all times between May 25, 2016 and January of 2018, kept in a sealed envelope inside the desk of the Manager Client Care at the branch where the Applicant dropped them off. The affidavit also states that no use was made of the personal records by the Manager Client Care, no other person had access to them, and once the personal records were placed in the shredding bin in or around January of 2018, no employee of the Respondent nor anyone else other than the professional shredding company that owns and operates the shredding bin had access to them.

[40]  I find it troubling that the Respondent would indicate to the OPC that the Applicant’s records were placed in a secure shredding bin on May 25, 2016 and picked up by the secure destruction service provider that same day, when in fact they were in a sealed envelope in the desk of the very same Manager Client Care who conducted the initial investigation into the Applicant’s complaint and who likely would have had some involvement in the response provided to the OPC.

[41]  It is equally disquieting that the Respondent has failed to adduce any evidence from the Manager Client Care in whose desk the Applicant’s records were kept, relying instead on Mortgage Associate’s hearsay evidence from the Manager Client Care and the Respondent’s counsel.

[42]  Pursuant to Rule 81(1) of the Federal Courts Rules, SOR/98-106, affidavits must be confined to facts that are within the personal knowledge of the deponent. Additionally, in accordance with Rule 81(2), where an affidavit is made on belief, an adverse inference may be drawn from the failure of a party to provide evidence from the person having personal knowledge of the facts. In this case, as the Manager Client Care had personal knowledge of material facts, the evidence should have been provided by this person. Given that the Respondent has failed to demonstrate that the information upon which it is relying is reliable and that it was necessary to submit the evidence in the form of hearsay, I draw an adverse inference from the Respondent’s failure to submit an affidavit from the Manager Client Care (Randall at paras 39-40).

[43]  I also note that the assertions made by the Mortgage Associate regarding the location of the Applicant’s records are lacking in detail.

[44]  As stated earlier, clause 4.7 of Schedule 1 of the PIPEDA requires that personal information be protected by security safeguards appropriate to the sensitivity of the information. Pursuant to clause 4.7.1 of the same Schedule, the security safeguards shall protect the personal information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification, regardless of the format in which it is held. According to clause 4.7.2, the nature of the safeguards will vary, depending on, among other things, the sensitivity of the information. Finally, it is stipulated in clause 4.7.3 that the methods of protection should include 1) physical measures, for example, locked filing cabinets and restricted access to offices; 2) organizational measures, such as security clearances and limiting access on a “need to know” basis; and 3) technological measures, such as the use of passwords and encryption.

[45]  Here, the Applicant’s records consisted of personal financial information. The Respondent conceded at the hearing that the information was highly sensitive. According to the Applicant, the records also included original documents as well as copies. Even if the records were kept in a sealed envelope inside the desk of the Manager Client Care, there is no other information on the methods of protection used by the Respondent to otherwise ensure the protection of the Applicant’s personal information. There is no evidence on whether the desk was locked, whether the Manager Client Care shared her office with other employees, whether others had access to the office. The absence of an affidavit from the Manager Client Care has precluded the Applicant from seeking particulars on the issue. Moreover, it prohibits me from determining whether the safeguards were appropriate to the sensitivity of the information.

[46]  Likewise, the lack of precision on the specific date in January 2018 when the Applicant’s records were placed in the shredding bin is equally of concern as it raises questions regarding the Respondent’s measures for tracking documents. Although in his affidavit the Mortgage Associate indicates referring to his notes, the Respondent has adduced no evidence of said internal notes, tracking slips or other documentation demonstrating that the Respondent has a process to establish the location of documents.

[47]  I recognize that the Applicant has the burden of demonstrating, on a balance of probabilities, her allegation that the Respondent failed to safeguard her personal records between May 25, 2016 and January 2018 (Fahmy at para 23). I am also cognizant of the difficulties associated with demonstrating that an organization has failed to safeguard internally one’s personal information. In the circumstances of this case, I am satisfied that the Applicant has met her burden of proof. The fact that the Respondent informed the OPC that the Applicant’s personal records were destroyed, when in fact they were not, leads me to conclude that the Respondent did not know where the Applicant’s personal records were located. The Respondent was thus in violation of its obligations under clause 4.7.1 of the PIPEDA by failing to take appropriate safeguard measures to protect against the loss of personal information.

D.  Destruction of Records During the OPC Investigation

[48]  Although the issue was not clearly articulated in the Applicant’s memorandum of fact and law, the Applicant, who is self-represented, submitted at the hearing that the Respondent knowingly and maliciously destroyed her personal records, including her original documents, despite an ongoing investigation by the OPC. She is seeking a certificate of destruction from the Respondent because she believes that her personal records may not have been destroyed. This belief is grounded in the Respondent’s allegation that they were destroyed “in or around January of 2018”.

[49]  The Respondent contends that there is no evidence of maliciousness or obstruction.

[50]  Given the lack of precision on the date her documents were destroyed in January 2018, I understand the Applicant’s concern that her personal records may not have been destroyed and wanting a certificate to confirm it. However, I doubt that a certificate of destruction will give the Applicant the assurance she is seeking.

[51]  I also agree with the Respondent that there is no evidence on the record of maliciousness or obstruction by the Respondent.

[52]  Notwithstanding, the destruction of the Applicant’s records during the OPC’s ongoing investigation is worrisome. The Applicant’s complaint with the OPC was filed on October 26, 2017. The OPC’s report was issued on March 26, 2018. It is difficult to understand why the Applicant’s personal records were destroyed in the middle of the OPC’s investigation without the Respondent first informing the OPC of the existence of the personal records and then seeking instructions either from the OPC or the Applicant regarding their destruction. The destruction of the documents in January 2018 is difficult to reconcile with the position taken by the Respondent in the previous section of this decision that it was reasonable for it to extend the retention period of the Applicant’s personal records given the issues raised by the Applicant in her complaints to the Respondent and the OPC and the fact that she did not direct the Respondent to destroy or return her personal records at any time. The Applicant has failed to provide a satisfactory explanation on the issue.

[53]  Finally, I note from my review of the PIPEDA that subsection 8(8) provides that if an organization has personal information that is the subject of a request, it shall retain it for as long as is necessary to allow the individual to exhaust any recourse under Part 1 of the PIPEDA. As the application of this provision was not argued at the hearing, I will abstain from concluding that the Respondent was in breach of its obligations under this provision.

[54]  On the basis of the foregoing, while I am concerned with the destruction of the documents during the OPC’s investigation, the Applicant has failed to persuade me that the Respondent breached its obligations under the PIPEDA in this regard.

E.  Damages

[55]  Given my conclusion that I am satisfied that the Respondent failed to appropriately safeguard the Applicant’s personal records between May 2016 and January 2018, contrary to clause 4.7 of Schedule 1 of the PIPEDA, I must now address the issue of remedy under section 16 of the PIPEDA.

[56]  In addition to asking the Court to examine the conduct of the Respondent, the Applicant is seeking monetary relief and damages for mental, physical and emotional distress and for all the inconveniences caused by the issues at hand. She does not specify an amount in her written materials and when asked at the hearing what amount she was seeking, the Applicant responded that she was leaving it to the Court’s discretion.

[57]  The Respondent submits that if this Court finds that a breach of the PIPEDA occurred, an award of damages is not appropriate in the circumstances. The Applicant has not only failed to prove that she has suffered damage but she has also failed to provide evidence to prove that a damage award would further the objectives of the PIPEDA.

[58]  Section 16 of the PIPEDA reads as follows:

[59]  Before addressing the Applicant’s request for damages, it is useful to recall some of the principles enunciated by this Court governing an award of damages under paragraph 16(c) of the PIPEDA.

[60]  While the Court enjoys a wide discretion to award damages, any award of damages should be done on a principled basis. An award of damages is not to be made lightly and should only be made in the most egregious situations where there has been a serious breach of the PIPEDA. The Applicant has the burden of proving that the damages claimed arose out of a breach of the PIPEDA and the claim cannot be used as a surrogate for another claim of damages. Where it is appropriate, the Court may award damages even when no actual financial loss has been proven. In determining whether damages should be awarded and the quantum of such damages, the Court may consider a number of non-exhaustive factors, including: (1) the seriousness of the breach; (2) the nature of the information at stake; (3) the impact of the breach on the Applicant; (4) the nature of the relationship between the parties; (5) the conduct of the Respondent before and after the breach; (6) whether the Applicant attempted to mitigate his or her loss; (7) whether the Respondent benefited from the breach; (8) whether the award of damages would further the objectives of the PIPEDA in ensuring that organizations are diligent in retaining as secure, personal information; and (9) whether the award of damages may be justified to deter future breaches (Miglialo at paras 21, 41-42, 46-47; Fahmy at para 75; Blum at paras 15-20; Townsend at paras 30-32; Girao at paras 42-47; Landry at paras 28-32; Nammo at paras 66, 71, 74, 76-77; Randall at paras 55-56).

[61]  Upon considering the foregoing principles, I find that only nominal damages are warranted in this case. I accept that the Applicant’s records contained personal information as defined in the PIPEDA. However, there is no evidence that the Respondent’s failure to appropriately safeguard the Applicant’s personal information resulted in the Applicant’s personal information being accessed without authorization, disclosed, copied or used for other improper purposes. There is equally no evidence that the Respondent acted in bad faith, nor that its conduct is systemic. The Applicant has also failed to adduce persuasive evidence to support her claim in damages. The Applicant states in her affidavit that this situation has caused her some sleepless nights, physical and mental distress, depression, loss of concentration at work resulting in a three (3) day suspension without pay. She also claims to have had an accident at work. However, the Applicant has failed to articulate these allegations. Furthermore, the physician’s report and statement of expenses she attempted to introduce at the hearing are inadmissible as they should have been included in the Applicant’s record pursuant to subsection 309(2) of the Federal Courts Rules. Even if I were to determine that the evidence was admissible, I find that the physician’s report cannot be afforded any weight as it does not establish any nexus between the Applicant’s problems and a breach under the PIPEDA. As for the statement of expenses, for the most part, the amounts listed consist of expenses which would be recoverable as disbursements in a bill of costs.

[62]  Having said that, I am nevertheless satisfied that the Applicant has suffered some anxiety and stress. In addition, the pursuit of her complaint and bringing the matter to Court has undoubtedly caused her some inconvenience. As a result, in the exercise of my discretion, the Applicant shall be compensated a nominal amount for her troubles. Accordingly, the Respondent shall pay the Applicant damages in the amount of $2,000.00.

[63]  As the Applicant was self-represented, she cannot recover costs for legal fees. However, she is entitled to recover from the Respondent the cost of her disbursements, which are fixed at $800.00, inclusive of taxes.

JUDGMENT in T-852-18

THIS COURT’S JUDGMENT is that:

1. The application is allowed;

2. The Respondent shall pay the Applicant damages in the amount of $2,000.00;

3. The Applicant is entitled to recover the disbursements in this application which are fixed at $800.00, inclusive of taxes.

“Sylvie E. Roussel”

FEDERAL COURT

SOLICITORS OF RECORD

DOCKET:	T-852-18
STYLE OF CAUSE:	CATHERINE B. MONTALBO v ROYAL BANK OF CANADA
PLACE OF HEARING:	CALGARY, ALBERTA
DATE OF HEARING:	OCTOBER 16, 2018
JUDGMENT AND REASONS:	ROUSSEL J.
DATED:	NOVEMBER 15, 2018

APPEARANCES:

Catherine B. Montalbo	For The Applicant (ON HER OWN BEHALF)
John R. Cusano Ricki T. Johnston	For The Respondent

SOLICITORS OF RECORD:

Gowling WLG (Canada) LLP Calgary, Alberta

For The Respondent