Docket: T-161-22
Citation: 2022 FC 1534
Ottawa, Ontario, November 10, 2022
PRESENT: The Honourable Mr. Justice Fothergill
| BETWEEN:
|
| MAUREEN BARRETT
|
| Applicant
|
| and
|
| ROYAL BANK OF CANADA
|
| Respondent
|
JUDGMENT AND REASONS
[1] The Royal Bank of Canada [RBC] is a federally regulated bank. Maureen Barrett is a former employee of the RBC Life Insurance Company [RBC Life], one of the companies that comprises RBC’s insurance business [RBC Insurance].
[2] In September 2017, Ms. Barrett resigned from her position at RBC Life and assumed a new role as Financial Advisor with Sun Life Financial [Sun Life], another Canadian insurance company. Sun Life terminated her Advisor’s Agreement effective December 26, 2017. Ms. Barrett claims this was the result of RBC’s unauthorized disclosure of her personal banking information to Sun Life.
[3] Ms. Barrett has brought an application pursuant to s 14 of the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 [PIPEDA]. She seeks a declaration that RBC’s disclosure of her personal information to Sun Life contravened the PIPEDA, damages and costs.
[4] On February 26, 2021, the Office of the Privacy Commissioner [OPC] discontinued its investigation of a complaint made by Ms. Barrett pursuant to the PIPEDA. The OPC concluded that RBC’s disclosure of her personal information to Sun Life was in accordance with s 7(3)(d.1) of the PIPEDA, and RBC was not required to inform Ms. Barrett or obtain her consent.
[5] For the reasons that follow, RBC disclosed Ms. Barrett’s personal information to Sun Life without her knowledge or consent in furtherance of Sun Life’s investigation of Ms. Barrett’s possible breach of her Advisor’s Agreement. The disclosure was therefore authorized by s 7(3)(d.1) of the PIPEDA.
[6] The application pursuant to s 14 of the PIPEDA is dismissed.
II.
Background
A.
The Disclosure of Personal Information
[7] Throughout her employment with RBC Life and Sun Life, Ms. Barrett maintained regular banking and investment accounts with RBC. On July 28, 2017, she deposited a cheque for $18,850 into her personal RBC account. The cheque was drawn on an account with the Bank of Montreal [BMO] belonging to Genesis Project Management Consulting Inc [Genesis]. Ms. Barrett was the sole administrator and director of Genesis.
[8] Because Ms. Barrett was an employee of RBC Life, no hold was placed on the Genesis cheque. However, the cheque failed to clear. BMO subsequently advised RBC that Genesis’ account was closed in 2009, more than seven years before the cheque was written.
[9] The Genesis cheque was charged out of Ms. Barrett’s RBC bank account, leaving the account substantially overdrawn. By September 13, 2017, Ms. Barrett’s personal account was overdrawn by $14,641.
[10] Dora Simoes-Pereira, Manager of Investigations with RBC’s Corporate Investigation Services, commenced an investigation into the circumstances surrounding the deposit of the Genesis cheque. She discovered that Ms. Barrett had made a number of withdrawals and transfers from her RBC bank account within days of the deposit. According to Ms. Simoes-Pereira’s affidavit:
My review determined that, within days of the deposit, Ms. Barrett made a number of withdrawals from her RBC account, including a “branch to branch” transfer of $10,086 and an electronic transfer of $2,500 for a Transat Holiday payment; purchases using her debit card from a number of businesses including Penningtons, Walmart, Marshalls and Splendid Style; payments to Capital One Mastercard, a company called “Pay Today” and to another company called “Cash for You”. There were also unsuccessful attempts to withdraw $2,847.66 from the account with a Visa debit card.
[11] RBC made several attempts to contact Ms. Barrett regarding the transactions and resulting debt. She did not respond.
[12] Ms. Simoes-Pereira believed that Ms. Barrett’s conduct in relation to the Genesis cheque could be fraudulent and contrary to the Criminal Code, RSC 1985, c C-46. She reported the matter to the Peel Regional Police on behalf of RBC.
[13] On September 15, 2017, Ms. Simoes-Pereira contacted Jillian Pennett, Senior Advisor on Compliance Market Conduct at RBC Insurance. She informed Ms. Pennett that RBC was investigating a matter involving Ms. Barrett that made her ineligible to work at RBC or sell RBC Life insurance policies. Both Ms. Simoes-Pereira and Ms. Pennett say no details of Ms. Barrett’s personal banking transactions were disclosed at that time.
[14] On September 19, 2017, Ms. Pennett telephoned Sandra Dolson, Compliance Manager of Third Party Distribution at Sun Life. She told Ms. Dolson that RBC Life had become aware of an issue concerning Ms. Barrett’s employment, and had changed her rehire status to “no/not eligible”
. This meant that RBC Life would not re-hire Ms. Barrett or approve any applications for her to sell their insurance policies, including in her new role at Sun Life.
[15] On November 10, 2017, Ms. Pennett discovered Ms. Barrett was soliciting a client from RBC Life. On November 13, 2017, Ms. Pennett sent an e-mail message to Ms. Dolson enquiring whether Sun Life was aware of this. Ms. Dolson responded that she would look into the matter, and advised that she had placed Ms. Barrett on Sun Life’s “restricted list”
.
[16] On November 14, 2017, Ms. Dolson asked Ms. Pennett for the name of RBC’s investigator. Ms. Pennett provided Ms. Simoes-Pereira’s name, and let Ms. Simoes-Pereira know that she had done so.
[17] Shortly thereafter, Ms. Simoes-Pereira was contacted by Cynthia Henry, a Senior Investigator with Sun Life. Ms. Henry asked if RBC could share any information regarding its investigation. According to Ms. Simoes-Pereira, she responded that the investigation “had to do with a personal banking matter”
. She may also have said that the matter “involved a cheque”
.
[18] Ms. Henry recalls her conversation with Ms. Simoes-Pereira as follows:
Ms. Simoes-Pereira told me that she was investigating Ms. Barrett with respect to a personal banking matter involving a cheque. She told me that Ms. Barrett had not responded to RBC’s attempts to reach her.
Ms. Simoes-Pereira did not provide me with dates, amounts, or any other financial information pertaining to Ms. Barrett’s personal banking history, nor did anyone else from RBC provide that information to me. I am not aware of anyone at Sun Life having received such information from RBC.
[19] This is the only communication that took place between RBC and Sun Life, and the only communication that is challenged in the present application.
[20] On November 30, 2017, Ms. Pennett contacted Ms. Dolson to advise that Ms. Barrett had improperly taken “RBC property along with the personal information of clients and spreadsheets containing approximately 80,000 names and contact information, including leads”
. She also stated that Ms. Barrett had been sent a cease and desist letter by courier on November 28, 2017.
[21] On December 7, 2017, Ms. Pennett told Ms. Dolson that, despite various attempts, RBC had been unable to contact Ms. Barrett.
[22] Sun Life summoned Ms. Barrett to an interview on December 7, 2017. Ms. Henry and Ms. Barrett have differing recollections of what was said.
[23] According to Ms. Barrett, Ms. Henry told her that RBC had disclosed the fact that she was being investigated for fraud, the details of her personal banking history, and RBC’s intention to pursue criminal charges against her:
On or about December 7, 2017, a manager at Sunlife named Jose Ferreyro (“Jose”), called me into a meeting with a Senior Investigator named Cynthia Henry (“Cynthia”).
Cynthia told me she had been contacted by RBC regarding my personal banking transactions and stated that RBC was purportedly investigation [sic] my banking transactions for fraud. RBC provided Sunlife the dates, amounts, and other financial information pertaining to my personal banking history, pertaining to the purported allegation in question. I was further advised that RBC intended to seek criminal charges against me.
At no point prior to this meeting with Cynthia and Jose had I ever been contacted by RBC about regarding [sic] purportedly fraudulent activities, nor had I ever been subject to criminal charges in the past regarding fraudulent banking activities or any other criminal activities.
Cynthia told me that Sunlife and RBC had a business relationship as Sunlife sells RBC’s life insurance products. RBC informed Sunlife they did not want me to sell their products, and if I did, it would purportedly jeopardize their reputation. Cynthia went on to say she would discuss the matter with upper management and provide me with an update in January 2018.
[24] Ms. Henry says that Ms. Barrett voluntarily disclosed the details of RBC’s investigation:
[…] I asked her about the personal banking matter that RBC was investigating. Ms. Barrett initially denied knowing that she was under investigation. However, she then said that she had received a letter from RBC about an amount owing on her personal bank account. She described to me an issue with a cheque that had been returned after the funds had been spent by her, including the date and the approximate amount of the cheque.
[25] Not long after the interview, Sun Life informed Ms. Barrett that it was terminating her Advisor’s Agreement effective December 26, 2017. According to Ms. Barrett, Sun Life told her the termination was the “result of the allegations raised by RBC, and the personal financial and banking information they received from RBC regarding my affairs”
.
[26] On July 10, 2019, Sun Life sent a letter to Ms. Barrett’s counsel summarizing its reasons for terminating Ms. Barrett’s Advisor Agreement. These were: (1) her failure to appreciate the gravity of her seemingly fraudulent actions; (2) her possible possession of unauthorized client personal information; and (3) her overall lack of governability.
[27] Sun Life’s letter to Ms. Barrett’s counsel reads in relevant part:
When asked about the RBC investigation, Ms. Barrett denied any knowledge that she was under investigation. However, later in the discussion, she admitted she had received a letter from RBC about an amount owing on her personal account and a cease and desist letter asking for the return of RBC property. She indicated that she had not read the letters and that some remained unopened.
With respect to the personal banking matter, Ms. Barrett stated that in July she had deposited a cheque for an amount between $15,000 and $19,000 (she indicated she didn’t know the exact amount). She claimed the payment was for bookkeeping and other services she had completed for a friend's business.
[…]
Ms. Barrett went on to state that after she spent the funds, the payment was returned from the drawer’s bank. She indicated she did not know why the item was returned (if it was NSF or stopped or account closed, etc.) because she never opened any of the letters from RBC. She shared that the friend closed his business after making her payment. Ms. Barrett stated her friend settled the missed payment by issuing another cheque that she deposited at another bank. In effect, she admitted that she had been paid twice and then disclosed that she did not pay the funds back to RBC. She claimed she offered to repay at $400 a month but RBC declined the offer. She chose not to take any further action because she did not have the means to repay the debt because she could not get a loan due to her poor credit rating.
With respect to the list of client names, Ms. Barrett indicated that while she was at RBC insurance, she had purchased name lists of new business registrants from the City of Brampton and the City of Toronto for prospecting … Ms. Barrett indicated that when she told RBC that she was leaving, she asked if she could take the lists, and was told that they were hers …
Ms. Barrett claimed that she was unaware of any contractual obligation that prevented her from contacting her former clients.
Sun Life asked Ms. Barrett to provide receipts confirming the purchase of the name lists and personal information from the City of Toronto and the City of Brampton. Sun Life did not receive any proof of purchased personal information.
Sun Life was not comfortable with the information provided by Ms. Barrett. It was concerning that she did not seem to appreciate that her depiction of the events surrounding the debt owing to RBC from her personal bank account could be viewed as fraudulent on her part. Sun Life was also concerned that she was possibly in possession of individual’s personal information the disclosure of which to her was potentially unauthorized. Sun Life was overall concerned about her governability from a compliance perspective and therefore her Advisor Agreement was terminated on two weeks’ notice in accordance with the termination provision. There is no basis for a claim that Ms. Barrett's Human Rights were violated or that she should be reinstated.
[28] Ms. Barrett submitted a complaint against RBC to the OPC on August 6, 2019. The OPC encouraged Ms. Barrett to first refer the complaint to RBC’s Ombudsman, which she did on September 25, 2019.
[29] On September 27, 2019, the RBC Ombudsman advised Ms. Barrett that they did not deal with employee matters. The Ombudsman forwarded her complaint to RBC. On September 30, 2019, RBC’s counsel informed Ms. Barrett of RBC’s position that the information in issue was not personal, and in any event, ss 7(3)(d.1) and (d.2) of the PIPEDA permitted disclosure of the information without her consent.
[30] On October 1, 2019, Ms. Barrett informed the OPC that RBC’s internal means of redress had been exhausted, and asked the OPC to investigate her complaint.
[31] On February 26, 2021, the OPC informed Ms. Barrett that it had discontinued its investigation. The OPC noted that RBC could rely on s 7(3)(d.1) of the PIPEDA, because the purpose of the disclosure was to investigate the breach of an agreement:
In the course of our investigation, RBC explained that it relied on paragraph 7(3)(d.1) of PIPEDA to share with Sun Life, without the Complainant’s knowledge or consent, information about RBC’s investigation into the Complainant’s alleged breach of RBC’s Code of Conduct.
[…]
Given the facts of the case, we accept that RBC shared information for the purpose of investigating a breach of an agreement. We are therefore of the view that RBC could rely on paragraph 7(3)(d.1) to share information with Sun Life without the Complainant’s consent.
C.
Ms. Barrett’s Criminal Conviction
[32] On July 14, 2021, Ms. Barrett was convicted of fraud over $5,000, contrary to s 380 of the Criminal Code. Justice Irving André of the Ontario Superior Court of Justice found that Ms. Barrett’s testimony was “unworthy of belief”
, and she had the requisite mens rea to commit the offence (R v Barrett, 2021 ONSC 4960 at paras 31-33):
In my view, the Crown has proven this component of the mens rea of the offence beyond a reasonable doubt. I say so for the following reasons.
I have already found as a fact that Ms. Barrett knew that the Genesis account was closed when she deposited the cheque in the amount of $18,850 into her RBC account on July 28, 2017. In my view, the following evidence is relevant to the question whether the deposit of the cheque and the subsequent depletion of the account would have deprived the RBC of the deposited funds.
First, it is significant that Ms. Barrett made the deposit within a week of bringing the account balance to zero. Second, Ms. Barrett quickly proceeded to deplete the account before the RBC could find out that the cheque would be returned NSF. Third, the reason for the fast withdrawals from the account, which include debt repayment, shopping at stores such as Penningtons, Marshalls and Splendid Style, the transfer of over ten thousand dollars and the payment of the fare for an overseas trip, all appear to be personal rather than business expenditures.
[33] Justice André imposed a conditional sentence of six months, a probation order of one year, and a restitution order in favour of RBC in the amount of $14,641 pursuant to s 738(1)(a) of the Criminal Code. Ms. Barrett was also prohibited from working in a financial institution for a period of five years pursuant to s 318(1)(2) of the Criminal Code.
[34] To date, Ms. Barrett has not made any payment to RBC in accordance with the restitution order, and the full amount of $14,641 remains owing.
[35] This application raises the following issues:
Did RBC disclose Ms. Barrett’s personal information to Sun Life?
Did RBC contravene Ms. Barrett’s rights under the PIPEDA?
Is Ms. Barrett entitled to damages?
[36] Applications under s 14(1) of the PIPEDA are to be determined de novo (Montalbo v Royal Bank of Canada, 2018 FC 1155 at para 20). No deference is owed to prior decision makers.
A.
Did RBC disclose Ms. Barrett’s personal information to Sun Life?
[37] Section 2 of the PIPEDA defines personal information “simply and very broadly”
as information about an identifiable individual (Royal Bank of Canada v Trang, 2014 ONCA 883 at para 10). RBC nevertheless argues that the information it disclosed about Ms. Barrett was not personal, because it did not include any “private information”
(citing PIPED Act Case Summary #15, 2001 CanLII 21546 (PCC)).
[38] According to RBC, personal information is limited to information that would also be protected by the concept of privacy and its associated values of “intimacy, identity, dignity and integrity of the individual”
(citing Canada (Information Commissioner) v Canada (Transportation Accident Investigation and Safety Board), 2006 FCA 157 [Safety Board] at paras 44, 52). RBC therefore maintains that the information in issue was not personal, because it contained no “intimate details”
about Ms. Barrett.
[39] RBC also asserts that the PIPEDA protects only personal information that an organization has collected. Here, the information was not collected from Ms. Barrett or anyone else. The information that was disclosed to Sun Life was derived from RBC’s own investigation.
[40] Safety Board concerned a proceeding under the Privacy Act, RSC 1985, c P-21 and the Access to Information Act, RSC 1985, c A-1. In Girao v Zarek Taylor Grossman Hanrahan LLP, 2011 FC 1070, Justice Richard Mosley considered Safety Board in the context of the PIPEDA, and concluded that information is personal simply if it is “about”
an identifiable individual (at para 32):
The scope of what constitutes “personal information” is not clear from the Act and the jurisprudence. The meaning of the term was discussed by the Federal Court of Appeal in Canada (Information Commissioner) v Canadian Transportation Accident Investigation & Safety Board, 2006 FCA 157 at paragraph 43 in the context of proceedings under the Privacy Act and the Access to Information Act. What I draw from that decision and the authorities cited therein, is that information is personal if it is “about” an identifiable individual. A person will be identifiable if the information disclosed, together with other publicly available information, would tend to or possibly identify them.
[41] The information RBC disclosed to Sun Life regarding its investigation of Ms. Barrett was “about”
her as an identifiable individual. At a minimum, it revealed that she held a personal banking account with RBC. This was information that RBC had collected from her, at least in part, when she opened the account. The information also revealed that she was under investigation for possible wrongdoing in connection with her personal banking account.
[42] The information RBC disclosed to Sun Life regarding its investigation of Ms. Barrett was therefore “personal information”
for the purposes of the PIPEDA.
B.
Did RBC contravene Ms. Barrett’s rights under the PIPEDA?
[43] Part I of the PIPEDA concerns the protection of personal information in the private sector. Section 3 of the PIPEDA describes the purpose of Part I as balancing an individual’s right to privacy with an organization’s need to collect, use and disclose personal information in order to facilitate commercial activity:
Purpose
3 The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
|
Objet
3 La présente partie a pour objet de fixer, dans une ère où la technologie facilite de plus en plus la circulation et l’échange de renseignements, des règles régissant la collecte, l’utilisation et la communication de renseignements personnels d’une manière qui tient compte du droit des individus à la vie privée à l’égard des renseignements personnels qui les concernent et du besoin des organisations de recueillir, d’utiliser ou de communiquer des renseignements personnels à des fins qu’une personne raisonnable estimerait acceptables dans les circonstances.
|
[44] Organizations must ordinarily confirm an individual’s knowledge or consent before collecting, using, or disclosing their personal information (PIPEDA, Schedule 1, Principle 4.3). However, s 7 of the PIPEDA permits organizations to collect, use, or disclose personal information without an individual’s knowledge or consent in specific enumerated circumstances.
[45] Paragraphs 7(3)(d.1) and (d.2) of the PIPEDA permit the disclosure of personal information without an individual’s knowledge or consent in order to further an investigation and suppress or prevent fraud:
Disclosure without knowledge or consent
7(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is
[…]
(d.1) made to another organization and is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada or a province that has been, is being or is about to be committed and it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the investigation;
(d.2) made to another organization and is reasonable for the purposes of detecting or suppressing fraud or of preventing fraud that is likely to be committed and it is reasonable to expect that the disclosure with the knowledge or consent of the individual would compromise the ability to prevent, detect or suppress the fraud;
|
Communication à l’insu de l’intéressé ou sans son consentement
7(3) Pour l’application de l’article 4.3 de l’annexe 1 et malgré la note afférente, l’organisation ne peut communiquer de renseignement personnel à l’insu de l’intéressé ou sans son consentement que dans les cas suivants:
[…]
d.1) elle est faite à une autre organisation et est raisonnable en vue d’une enquête sur la violation d’un accord ou sur la contravention au droit fédéral ou provincial qui a été commise ou est en train ou sur le point de l’être, s’il est raisonnable de s’attendre à ce que la communication effectuée au su ou avec le consentement de l’intéressé compromettrait l’enquête;
d.2) elle est faite à une autre organisation et est raisonnable en vue de la détection d’une fraude ou de sa suppression ou en vue de la prévention d’une fraude dont la commission est vraisemblable, s’il est raisonnable de s’attendre à ce que la communication effectuée au su ou avec le consentement de l’intéressé compromettrait la capacité de prévenir la fraude, de la détecter ou d’y mettre fin;
|
[46] Ms. Barrett maintains that RBC breached her rights under the PIPEDA by disclosing her personal banking information to Sun Life without her knowledge or consent. She claims that RBC disclosed her personal information for no reasonable purpose, because there was no court order, subpoena, or other lawful justification for the disclosure. At the time of the disclosure, she had not yet been convicted of any crime, and RBC had not made any finding of wrongdoing.
[47] RBC relies on s 7(3)(d.1) of the PIPEDA, and says that it disclosed Ms. Barrett’s personal information to Sun Life for the purpose of that organization’s investigation concerning Ms. Barrett’s solicitation of RBC Life’s clients, contrary to her Advisor’s Agreement. RBC asserts that the disclosure was reasonable, and it “acted with care and due diligence”
.
[48] RBC argues that it disclosed limited and high level information that was proportionate to the purpose of Sun Life’s request. RBC notes that the OPC found that “RBC could rely on paragraph 7(3)(d.1) to share information with Sun Life without the Complainant’s consent”
.
[49] I respectfully disagree with the OPC that the disclosure of Ms. Barrett’s personal information was authorized by RBC’s investigation of her breach of RBC’s Code of Conduct. At the time of the disclosure, Ms. Barrett was no longer employed by RBC Insurance, and it is doubtful that she continued to be bound by RBC’s Code of Conduct. To the extent that RBC was investigating Ms. Barrett’s previous non-compliance with the Code of Conduct, disclosing her personal information to Sun Life would have done nothing to further the investigation.
[50] I nevertheless agree with RBC that it reasonably disclosed Ms. Barrett’s personal banking information in furtherance of Sun Life’s investigation of Ms. Barrett’s possible breach of her Advisor’s Agreement. RBC Life informed Sun Life on November 10, 2017 that Ms. Barrett had solicited a client from RBC Life. This is when Ms. Dolson began to look into the matter, and also when Ms. Barrett was placed on Sun Life’s “restricted list”
.
[51] No specific clause of Ms. Barrett’s Advisor’s Agreement with Sun Life prohibited the solicitation of clients from her former employer. However, Clause 3.1.14 required that she act honestly and in good faith, and uphold the highest standards of professional ethics:
3.1.14 Ethical Standards: in the business carried on by the Advisor under this Agreement (including business conducted with Portal Suppliers in respect of Portal Products), act:
(a) honestly, in good faith, and in the best interests of the Company and its Affiliates and its Clients; and
(b) in a manner that is consistent with the highest standards of professional ethics.
[52] RBC’s disclosure of Ms. Barrett’s personal banking information was precipitated by Ms. Dolson’s inquiry, and was relevant to Sun Life’s investigation of Ms. Barrett’s possible breach of her Advisor’s Agreement. It was reasonable for RBC not to inform Ms. Barrett or seek her consent prior to the disclosure, because this could have compromised the investigation.
[53] I am not persuaded that RBC reasonably disclosed Ms. Barrett’s personal information to Sun Life in order to suppress or prevent fraud, as contemplated by s 7(3)(d.2) of the PIPEDA. RBC argues that the common law has long permitted financial institutions that have been or could be defrauded to share information that could protect other financial institutions and the public from fraud. As the Ontario Court of Appeal explained in Royal Bank of Canada v Ren, 2009 ONCA 48 at paragraph 22:
In its essence, PIPEDA is a privacy statute. It restricts disclosure of private information subject to certain exemptions, one such exemption being the detection and prevention of fraudulent activity. In such circumstances, where reasonable grounds exist to believe that a private entity has been, is, or is about to be defrauded, limited information sharing between private business organizations and private investigative bodies is permitted for the purpose of preserving and protecting the economic interests of the business enterprise at risk. From what we can tell, the impugned provisions of PIPEDA do little more than codify the existing common law which permitted the sharing of such information in similar circumstances: see Canadian Imperial Bank of Commerce v. Sayani (1993), 83 B.C.L.R. (2d) 167 (C.A.), at paras. 18-32.
[54] At the time of the disclosure, RBC was aware of Ms. Barrett’s allegedly fraudulent conduct involving her personal banking account. The activity had already occurred, and disclosure to Sun Life was not required to detect or prevent it. Given that Ms. Barrett did not hold any personal banking accounts with Sun Life, there was no reason to think she would engage in similar behaviour in relation to that company. According to the OPC’s guidance document, Applying paragraphs 7(3)(d.1) and 7(3)(d.2) of PIPEDA, OPC, March 2017), the risk of fraud must be “probable and not merely possible”
.
[55] There is no merit to Ms. Barrett’s assertion that ss 7(3)(d.1) and (d.2) of the PIPEDA permits the disclosure of personal information without an individual’s knowledge or consent only where the disclosure is made to investigative bodies. While ss 7(3)(d.1) and (d.2) of the PIPEDA previously permitted disclosure only to “an investigative body, a government institution or a part of a government institution”
, on June 18, 2015 the statute was amended to authorize disclosure to “another organization”
(Digital Privacy Act, SC 2015, c 32, s 6). In any event, Ms. Henry was acting in her capacity as a Senior Investigator with Sun Life.
C.
Is Ms. Barrett entitled to damages?
[56] Even if Ms. Barrett could demonstrate a violation of the PIPEDA, an award of damages would not be appropriate. Any breach by RBC would not have been egregious (Randall v Nubodys Fitness Centres, 2010 FC 681 at para 55). Ms. Barrett’s Advisor’s Agreement with Sun Life was ultimately terminated because of her conduct and information she provided voluntarily, not because of the very limited disclosure of her personal banking information by RBC.
[57] Damages under the PIPEDA may be recovered only where they are the direct result of the fault committed. As Justice Michael Phelan held in Stevens v SNF Maritime Metal Inc, 2010 FC 1137 (at paras 27-28):
PIPEDA’s s. 14 right and s. 16 remedy is not a substitute for matters which are truly claims for wrongful dismissal. The Court must examine the real nature of the remedy claimed. Such claims as humiliation, loss of community support, diminution of standings and loss of income flowing therefrom (to name but a few) caused by breach of the Act fall within the statutory cause of action created by the Act. Claims for loss of income and similar loss due to termination of employment not caused by breach of the Act, do not.
The source of the Applicant’s complaint is the loss of his employment. He even claims for loss due to loss of a second job. But all of his loss claimed is tied directly to his termination for cause. While the termination might not have occurred if there had not been disclosure, the nexus to the claimed loss is termination of employment for which Stevens had, but gave up, the right to claim was unlawful.
[58] It should be noted that Ms. Barrett does not challenge the much more extensive disclosure of her personal information to Sun Life by RBC Life and RBC Insurance. This is what prompted the investigation by Sun Life that ultimately led to her dismissal.
[59] Ms. Barrett’s Advisor’s Agreement with Sun Life was not terminated until more than a month after RBC’s limited disclosure of her personal banking information, and only after Sun Life had completed its own investigation. The reasons given by Sun Life for terminating Ms. Barrett’s agreement were: (1) her failure to appreciate the gravity of her seemingly fraudulent actions; (2) her possible possession of unauthorized client personal information; and (3) her overall lack of governability.
[60] RBC disclosed Ms. Barrett’s personal information to Sun Life without her knowledge or consent in furtherance of Sun Life’s investigation of Ms. Barrett’s possible breach of her Advisor’s Agreement. The disclosure was therefore authorized by s 7(3)(d.1) of the PIPEDA.
[61] The application is dismissed. By agreement of the parties, costs are awarded to the successful party in the all-inclusive amount of $2,500.
Email this Content