Date: 20251010

Docket: T-591-24

Citation: 2025 FC 1679

Ottawa, Ontario, October 10, 2025

PRESENT: The Honourable Madam Justice Conroy

BETWEEN:

TRICIA DARLENE NOBLE, ALSO KNOWN AS TRICIA DARLENE MCDONALD

Applicant

and

SYNERGY CREDIT UNION LTD.

Respondent

JUDGMENT AND REASONS

I. Overview

[1] Ms. Tricia Darlene Noble, also known as Ms. Tricia Darlene McDonald [Applicant], brings this application, pursuant to s. 14 of the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 [PIPEDA], for a hearing by the Federal Court following the release of a report of the Privacy Commissioner of Canada [Commissioner] dated March 17, 2023 [Report] regarding her privacy complaint filed on April 20, 2020 [Complaint] against Synergy Credit Union Ltd. [Respondent].

[2] The Applicant makes a host of allegations on this application. Her Notice of Application requests over 20 separate orders, many include several sub-orders. Furthermore, her Memorandum of Fact and Law raises over 30 separate issues. The vast majority of the orders requested and issues raised are both outside the statutory jurisdiction of this Court, and beyond the scope of this application, which is limited by the language of s. 14 of the PIPEDA.

[3] However, the Applicant makes the following four allegations that are both within this Court’s jurisdiction and the scope of s. 14 of the PIPEDA:

• a)The Respondent’s policies and practices are not compliant with the recommendations set out at Schedule 1 to the PIPEDA;

• b)The Respondent misled the Commissioner during its investigation in representing that it had deleted certain personal information about the Applicant from its records;

• c)The Respondent failed to implement corrective measures it agreed to adopt after the release of the Report; and

• d)The Respondent continues to indiscriminately collect her personal information.

[4] With respect to the in-scope allegations, the Applicant seeks an order directing the Respondent to:

• a)Correct its practices in order to comply with the PIPEDA;

• b)Publish a notice to its credit union members of any actions taken or proposed to be taken to correct its practices;

• c)Destroy and delete indiscriminately collected personal information it misrepresented to the Commissioner that it already deleted;

• d)Provide her access to personal information it failed to produce in a readable format pursuant to her access to information request; and

• e)Cease any further collection of her personal information.

[5] The Applicant also seeks an order from the Court awarding her damages in the amount of 1% of the Respondent’s balance sheet, or some other amount that the Court deems fit, due to, among other things, humiliation, impact on her health, welfare, social, business and financial well-being, a breach of good faith, and intentional or negligent infliction of emotional distress and mental suffering. She also requests punitive, moral, and aggravated damages.

[6] For the reasons that follow, the application is dismissed except as set out below. The Respondent shall, within 30 days of receiving these reasons, provide to the Applicant by encrypted email or registered mail:

• a)A record showing the Applicant’s chequing account number and balance, or notice that no such record exists; and

• b)A record of the Applicant’s credit union membership, or notice that no such record exists.

[7] No further remedies or damages are warranted.

II. Background

A. The Parties’ Relationship

[8] In 2007, the Applicant began working for the Respondent, a credit union. The same year, the parties entered into a mortgage agreement.

[9] Sometime during the first three years of her employment, the Applicant lodged a complaint against the Respondent with the Saskatchewan Ministry of Labour Relations. After being dismissed from her employment with the Respondent in 2010, the Applicant made a complaint to the Saskatchewan Human Rights Commission [SHRC] in November 2011, alleging she was let go because of a disability. The parties reached a settlement of that dispute in 2014.

[10] The Applicant’s mortgage with the Respondent was set to mature in 2016. That year, the Respondent advised the Applicant it would not be renewing the agreement and requested that she move her mortgage elsewhere. The Respondent did so because, in its view, the Applicant was being abusive to its staff members. After the Applicant refused to take steps to move her mortgage, the Respondent made a demand on the loan and commenced foreclosure proceedings. The Applicant eventually moved her mortgage to a different lender, and the foreclosure did not proceed past the Respondent’s Notice of Intention to commence foreclosure.

[11] Believing the Respondent’s refusal to renew her mortgage was a retaliation for her 2011 SHRC complaint, the Applicant made a second complaint to the SHRC. The SHRC dismissed that complaint in March 2019, finding that the Respondent’s decision not to renew was not retaliatory, but a result of the breakdown in their business relationship.

[12] Ms. Kristy Miazga, an officer of the Respondent, swore an affidavit in this application [Miazga Affidavit] where she lists the many complaints that the Respondent has filed with regulatory bodies and the Respondent directly. The affidavit lists more than 20 formal complaints to the Respondent’s Board and general membership, plus several complaints to regulators in Saskatchewan and a complaint with the Ombudsman for Banking Services and Investments. These are in addition to her complaints filed with the Commissioner, including the Complaint at issue here.

[13] The Miazga Affidavit also describes a “social media campaign” by the Applicant commencing in 2015, accusing the Respondent of fraudulent and corrupt dealings and accusing the Respondent’s executive team of unethical behaviour.

[14] In 2022, in response to the Applicant’s online posts, the Respondent brought an action in the Saskatchewan Court of King’s Bench [SKKB] against the Applicant in defamation and for relief against frivolous and vexatious litigation. The Applicant filed a statement of defence and counterclaim in that action, which remains before the SKKB.

B. The Access Request

[15] On December 22, 2019, the Applicant made a written request to the Respondent for the disclosure of her personal information [Access Request].

[16] In her Access Request, the Applicant asked for “a copy of any and all records including emails, letters, member/employee file(s), audio and video records” that concerned her. The Access Request specified that the records she sought. These included, but were not limited to: the Applicant’s employee file, her member file, her mortgage loan file and related documentation concerning interest changes or renewals, communications and correspondence between the parties, and copies of documentation related to her prior SHRC complaints against the Respondent.

[17] The Respondent replied to the Access Request by email dated January 21, 2020. The email enclosed some of the requested records and explained why certain other records could not be provided.

[18] The Applicant also made a second request for “all the audio” the Respondent had concerning her. By email dated February 14, 2020, counsel for the Respondent advised that the Respondent had thoroughly reviewed its records for electronic recordings but that these were “effectively stored without a filing system meaning that there would be no why [sic] to locate any recordings if such exist.”

C. The Complaint

[19] The Applicant lodged her Complaint with the Commissioner on April 20, 2020, alleging that:

• a)Employees of the Respondent have access to her information without valid reason;

• b)Her information is being used for a purpose other than for which it was collected; and

• c)The Respondent is impermissibly screenshotting, retaining, and disclosing her Facebook posts.

[20] The Applicant’s Complaint requested that the Respondent be required to alert all 28,000 of its members that their phone calls have been recorded and provide them the opportunity to opt-out, as well as investigate its susceptibility to data breaches with respect to the information it retains.

[21] Finally, the Applicant’s Complaint alleged that the Respondent’s disclosure in response to her Access Request was incomplete – it was missing certain records, and some of the documents she received were “blemished and distorted” to the point of being unreadable.

D. The Commissioner’s Report

[22] The Commissioner investigated the Applicant’s Complaint, culminating in the Report dated March 17, 2023.

[23] With the Applicant’s agreement, the Commissioner narrowed her Complaint to three issues: (1) whether the Applicant obtained complete access to her personal information in an understandable format; (2) whether the Respondent collected more personal information than necessary for its purposes when it collected a Facebook post made by the Applicant in 2015; and (3) whether the Respondent has implemented effective policies and practices to give effect to the principles listed at Schedule 1 to the PIPEDA.

Incomplete Response to Access Request

[24] The Report concluded that the Respondent did initially fail to provide the Applicant with a complete response to her Access Request, contrary to Principle 4.9 (Individual Access) of PIPEDA. Certain records the Respondent initially deemed missing were later found, and audio recordings considered irretrievable were likely available at the time of the Access Request.

[25] Any further documents the Respondent was able to locate during the course of the Commissioner’s investigation were provided to the Applicant. No audio recordings could be shared; indeed, most of the recordings had already been deleted at the time of the Access Request due to the Respondent’s 90-day retention period. However, the Report did note that the Applicant had called the Respondent within 90 days of the Access Request. The Commissioner concluded that recordings of these later calls should have been shared with the Applicant at the time of her Access Request.

[26] The Commissioner therefore encouraged the Respondent to implement procedures to itemize and identify audio recordings in its possession to facilitate retrieval upon request.

[27] The Report also found that certain documents the Respondent disclosed to the Applicant pursuant to her Access Request were unreadable and could have been provided in a better format. The Commissioner considered this too to be a contravention of Principle 4.9 (Individual Access) and clause 4.9.4.

[28] The Commissioner accepted that certain documents disclosed to the Applicant could not be printed in better quality because of the Respondent’s obsolete IT system. However, it found that the Respondent did not clearly communicate to the Applicant that she had the option of viewing the documents in-person on its system. The Respondent therefore offered to allow the Applicant to view the files in-person, and the Applicant indicated that she would consider the offer. The Commissioner therefore concluded that this issue was “well-founded and resolved”.

Collection of 2015 Facebook Post

[29] The investigation also revealed that the Respondent had collected a 2015 Facebook post made by the Applicant, speaking negatively about the Respondent’s service fees. The Commissioner characterized the Facebook group where it was posted as “private”. The Applicant discovered that the Respondent had collected this information because it was included in the response to her Access Request as part of her employee file.

[30] The Commissioner found that there was no identified purpose or authority for the collection of the post without the Applicant’s consent, and so the Respondent had violated Principle 4.4 (Limiting Collection) and clause 4.4.1.

[31] To resolve the matter, the Respondent agreed to delete the Facebook post and remove it from the Applicant’s employee file. Upon the Respondent’s confirmation that the information was deleted, the Commissioner considered this issue to be “well-founded and resolved”.

Policies and Practices Generally

[32] Finally, the Commissioner investigated the Applicant’s allegation that the Respondent’s policies and practices failed to meet Principles 4.1 (Accountability) and 4.8 (Openness) of PIPEDA.

[33] The investigation revealed deficiencies in how the Respondent handled personal information, such as recording phone calls to its contact center without a caller’s knowledge or consent. Its privacy policy was found to be “quite short” and lacking in even minimal information on the collection, use, and disclosure of personal information gathered on social media.

[34] Although the Report did not explicitly state that these practices contravened Schedule 1 to the PIPEDA, it did note that clause 4.1.4 states that organizations shall implement policies and practices to give effect to the principles, and Principle 4.8 states that an organization shall make readily available information about its policies and practices relating to the management of personal information.

[35] In light of the Commissioner’s inquiry about recorded phone calls, the Respondent added a recorded message to its system in June 2020, advising callers that any calls to or from its Member Contact Center may be recorded and monitored for training or quality assurance.

[36] The Respondent also undertook an external privacy audit during the Commissioner’s investigation, resulting in a gap analysis and action list with corrective measures [Corrective Measures].

[37] Following the external audit, the Respondent added a section to their privacy code addressing social media and deleted all social media posts it had already collected. The Respondent also provided staff with guidelines on the appropriateness of collecting social media posts, implemented annual training on PIPEDA obligations for staff, and developed a Privacy Policy. Furthermore, the Respondent implemented a destruction and retention program.

[38] Finally, the Report states that the Respondent committed to implementing, by the end of 2023, an itemized action plan with the Corrective Measures identified in the external audit. On the understanding that the Corrective Measures would be implemented accordingly, this issue was deemed to be well-founded and “conditionally” resolved.

E. Implementation of Corrective Measures and Close of the Complaint File

[39] By email dated January 18, 2024, the Commissioner’s office wrote to the Respondent advising that, based on the information it received after the Report was issued, it was “satisfied with [the] organization’s actions to implement the [Corrective Measures],” and considered the matter closed.

[40] I note that the Respondent’s evidence filed in this application did not include the information that it submitted to the Commissioner to demonstrate it implemented the Corrective Measures. The only evidence before this Court about the implementation of the Corrective Measures is the Commissioner’s email advising it was satisfied with the results.

III. Statutory Scheme

[41] The PIPEDA is legislation created for the purpose of protecting personal information. It aims to balance the protection of such information with “the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances”: PIPEDA, s. 3.

[42] There is no dispute between the parties that the PIPEDA applies to the Respondent.

[43] Pursuant to s. 5, every organization to whom the PIPEDA applies shall comply with the obligations set out at Schedule 1. There are 10 principles set out in Schedule 1, each with several clauses elaborating on an organization’s obligations under that principle.

[44] An individual who makes a request to be informed about the existence, use and disclosure of their personal information by an organization under Principle 4.9 (Individual Access) must do so in writing (s. 8). The Applicant did so through her Access Request, dated December 22, 2019.

[45] An individual may further make a written complaint to the Commissioner against an organization for contravening the PIPEDA or failing to follow a “recommendation” set out at Schedule 1 to the PIPEDA (s. 11(1)). If the complaint is a result of an organization’s refusal to grant a request under s. 8, then the complaint must be brought within six months of said refusal, unless the Commissioner allows otherwise (s. 11(3)). The Applicant filed her Complaint with the Commissioner on April 20, 2020, within six months of the Respondent’s January 21, 2020, response to her Access Request.

[46] Upon receipt of a complaint, the Commissioner conducts an investigation (s. 12).

[47] Within one year after the day on which a complaint is filed, the Commissioner is required to prepare a report containing: their findings and recommendations, any settlements reached by the parties, and, if appropriate, a request that a party give the Commissioner notice of any action taken to implement the recommendations contained in the report (s. 13(1)).

[48] The Commissioner’s Report was issued March 17, 2023 (no party took issue with the timing of the Report). It contained the Commissioner’s findings, steps taken by the Respondent during the course of the investigation to remedy certain privacy concerns, and a request that the Respondent advise of its implementation of the Corrective Measures identified in the external audit by the end of 2023. By email dated January 18, 2024, the Commissioner indicated it was satisfied with the Respondent’s implementation of the Corrective Measures and accordingly closed the file.

[49] If an individual remains unsatisfied after receiving the Commissioner’s report, they may apply to this Court for “a hearing in respect of any matter in respect of which the complaint was made, or that is referred to in the Commissioner’s report” (emphasis added) (s. 14(1)). The Applicant brings the present application under this provision of the PIPEDA.

IV. Scope of Application

[50] As outlined at the outset of this decision, the Applicant makes allegations and seeks various orders for relief which are beyond the Court’s statutory jurisdiction and beyond the scope of s. 14 of PIPEDA.

[51] In a s. 14(1) hearing, “[t]he Court is limited to the matters in respect of which the complaint about the violation of principles was made or that are referred to in the Commissioner’s Report”: Miglialo v Royal Bank of Canada, 2018 FC 525 at para 21 [Miglialo]. It would be “inappropriate...to expand the proceeding to include matters that were not complained of or not referred to in the report”: Fahmy v Bank of Montreal, 2016 FC 479 at para 64 [Fahmy], citing Nammo v TransUnion of Canada Inc, 2010 FC 1284 at paras 25-26 [Nammo].

[52] Furthermore, the Court may only consider a matter arising from the Complaint or the Report which is also “referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 or 4.8 of Schedule 1, in clause 4.3, 4.5 or 4.9 of that Schedule as modified or clarified by Division 1 or 1.1, in subsection 5(3) or 8(6) or (7), in section 10 or in Division 1.1”: PIPEDA, s. 14(1); Nammo at para 24.

[53] Accordingly, I decline to consider matters raised by the Applicant which exceed this Court’s jurisdiction, fall outside s.14(1) or were not included in the Complaint or the Report: see Nammo at paras 23, 25. These matters include, but are not limited to:

• a)The Respondent’s handling of the Applicant’s SHRC complaints;

• b)The Respondent’s handling of the Applicant’s mortgage, including any steps taken to initiate foreclosure prior to the Applicant moving her loan to another lender;

• c)The Applicant’s concerns with Respondent’s counsel and his handling of the parties’ various disputes;

• d)Access requests submitted by the Applicant after her April 20, 2020 Complaint to the Commissioner;

• e)The appropriateness of the Respondent’s service fees and charges;

• f)Any alleged abuse of process or perjury by the Respondent’s officers, staff, or counsel in the course of the parties’ various disputes;

• g)The Applicant’s entitlement to a refund of fees, profit shares, the re-instatement of her membership with the Respondent, and participation in the election of the Respondent’s board members in 2023; and

• h)The Respondent’s compliance with various provincial statutes, including The Credit Union Act, 1998, SS 1998, c C-45.2, The Cost of Credit Disclosure Act, 2002, SS 2002, c C-41.01 and The Limitation of Civil Rights Act, RSS 1978, c L-16.

[54] Therefore, the only issues which remain to be addressed by the Court are the following:

• a)Whether the Respondent’s policies and practices comply with Schedule 1 to the PIPEDA;

• b)Whether the Respondent contravened PIPEDA by retaining certain information it said it destroyed;

• c)Whether the Respondent failed to implement certain Corrective Measures it agreed to adopt; and

• d)Whether the Respondent continues to indiscriminately collect the Applicant’s personal information following the release of the Report.

[55] Based on the outcome of these four issues, I will also consider whether any remedies are appropriate in these circumstances.

V. PIPEDA , s.14 Application – Standard of Review and Burden

[56] An application under s. 14 of PIPEDA is a de novo review. It is not a judicial review of the Commissioner’s Report, but rather a review of the conduct of the party against whom a complaint is filed: Montalbo v Royal Bank of Canada, 2018 FC 1155 at para 20 [Montalbo], citing, inter alia, Englander v Telus Communications Inc, 2004 FCA 387 at paras 47-48 [Englander], Miglialo at para 21.

[57] Unlike a judicial review, the Commissioner’s Report is not entitled to deference from the Court: Englander at para 48. However, the Commissioner’s Report was put into evidence by both parties, and is subject to challenge or contradiction like any other document adduced in evidence: Fahmy at para 61, citing Englander at para 48; Miglialo at para 21.

[58] Although the application “is said to be a de novo action, it must be dealt with in a summary manner”: PIPEDA, s. 17(1); Miglialo at para 21.

[59] In order to succeed in this application, “the burden is on the Applicant to show a violation of PIPEDA on a balance of probabilities, using evidence that is clear, convincing and cogent” (emphasis added): James v Amazon.com.ca, Inc, 2023 FC 166 at para 4 [Amazon]. “It will also be for the [A]pplicant to satisfy the Court of the damages she claims she suffered as a result of the violation”: Amazon at para 4, citing Miglialo at para 22.

VI. Submissions and Analysis

A. Are the Respondent’s Policies and Practices PIPEDA-Compliant?

[60] The Applicant alleges that the Respondent’s policies and practices violate the principles at Schedule 1 to the PIPEDA. The Report considered this issue with respect to the Respondent’s recording of phone calls, its retention schedule for documentation, and the adequacy of its privacy policies.

[61] The Commissioner’s Report is uncontradicted evidence of the following: (1) in June 2020, the Respondent implemented a recorded message advising callers that their calls will be recorded; (2) the Respondent added to their privacy code a section addressing social media; (3) the Respondent developed a Privacy Policy and implemented employee training on PIPEDA obligations; and (4) the Respondent implemented a destruction and retention program.

[62] The January 18, 2024 email from the Commissioner’s office is further uncontradicted evidence that the Respondent implemented the Corrective Measures identified in the external audit before the end of 2023.

[63] While the Applicant asserts that the Respondent is nonetheless failing to “diligently and honestly” administer its affairs in compliance with the PIPEDA, she has failed to particularize this allegation or substantiate it with any evidence. The Applicant has therefore failed to meet her burden of proof on this issue.

B. Did the Respondent contravene PIPEDA by retaining certain personal information it said it destroyed?

[64] The Applicant asserts that the Respondent misled her and the Commissioner when it advised them during the investigation that it had deleted her sensitive medical information, as well as the social media posts she says the Respondent collected without an identified purpose, consent or authority.

[65] The Applicant believes the Respondent continues to retain the personal information it purports to have destroyed and even though it has implemented a destruction and retention program. She bases this on the fact that these documents were included in the Respondent’s January 18, 2024 affidavit of documents in its SKKB defamation action against her [Affidavit of Documents]. This Affidavit of Documents was served on the Applicant after the Report was released.

[66] The Applicant’s second affidavit filed for the present application attaches the Affidavit of Documents as an exhibit. The Affidavit of Documents includes an index of the relevant and material documents in the possession, custody or control of the Respondent. The index lists several social media posts ostensibly created by the Applicant. While the Affidavit of Documents is on the record before this Court, the actual documents listed therein are not, for the most part, on the application record.

[67] Outside of the 2015 Facebook post described in the Report, the Applicant did not precisely identify the documents she says ought to have been deleted and were not.

[68] Accordingly, I am left to address this issue without the benefit of reviewing the documents that the Applicant says ought to have been deleted.

[69] The Miazga Affidavit states that counsel for the Respondent has retained copies of social media posts considered to be defamatory for the purpose of the SKKB action against the Applicant.

[70] The Respondent disputes the characterization of the 2015 Facebook post as private. In the Respondent’s view, the Facebook group, “What’s Happening in Lloydminster”, has approximately 20,000 members and is therefore public. The Report and the Miazga Affidavit state that the Respondent deleted this Facebook from Applicant’s employee file, despite the Respondent’s disagreement with the Commissioner on this point.

[71] The Respondent notes that the social media postings the Applicant complains of were put into the public square by the Applicant herself. It argues the majority of these social media posts defame the Respondent and its executive team. The Respondent argues that it is untenable for the Applicant to rely on the PIPEDA to assert that the Respondent cannot collect and retain social media posts it considers defamatory for the purposes of pursuing the defamation action against her.

[72] I agree.

[73] The Report finds that the 2015 Facebook post was collected for “unidentified purposes and without authority” (Principle 4.4 and 4.4.1 of PIPEDA). It notes that the Respondent agreed to destroy and remove the sensitive medical information and a 2015 social media post from the Applicant’s employee file. The Respondent’s evidence is that no such information is contained in the Applicant’s employee file.

[74] The Applicant has failed to establish that the Respondent misled the Commissioner to believe it deleted the impugned information from her employee file, or that it continues to retain this information in her employee file.

[75] It is however a different matter altogether for the Respondent’s counsel to collect, retain and disclose potential evidence of alleged defamation for the clear purpose of an ongoing action before the SKKB. While PIPEDA protects an individual’s privacy, “privacy cannot be used to protect a person from the application of either civil or criminal liability”: BMG Canada Inc. v. John Doe (F.C.), 2004 FC 488 (CanLII), [2004] 3 FCR 241 at paras 38-39 (see also, Voltage Pictures LLC v. John Doe, 2014 FC 161 at para 54, where the Court states that “[p]rivacy considerations should not be a shield for wrongdoing… ”).

[76] Principle 4.3 of PIPEDA sets out the general rule that the knowledge and consent of an individual is required for the collection, use, or disclosure of their personal information, “except where appropriate”. Section 7 of PIPEDA sets out exceptions to the general rule in Principle 4.3.

[77] I conclude that the collection, use and disclosure of social media posts and other personal information for the purpose of the defamation action fall within the exceptions set out under ss. 7(1)(b), 7(2)(a), and 7(3)(a), (c) and (i) of PIPEDA. The relevant subsections of PIPEDA are set out below:

[78] The phrases, “the laws of Canada or a province” in s.7(1)(a) and “the laws of Canada, a province” in s.7(2)(a) include the common law such as the law of tort, including defamation: M. W. Drapeau & J. M. Juneau, Federal Access to Information and Privacy Legislation Annotated 2026 Edition, Thomson Reuters, at 9:35, citing Ferenczy v MCI Medical Clinics, 2004 CanLII 12555 (ON SC) [Ferenczy]. The Respondent collected the Applicant’s social media posts for the purpose of investigating an action in defamation and it is not reasonable to expect the Respondent to seek the consent of the Applicant in these circumstances.

[79] Section 7(3)(c) and (i) exempt information disclosed pursuant to the rules of court and at trial: Ferenczy at para 33; Ontario Psychological Association v Mardonet, 2015 ONSC 1286 at para 51. Accordingly, disclosing this information in the discovery process and at a trial of the defamation action, without the consent of the Applicant, is permissible under PIPEDA.

[80] I conclude that the Applicant has failed to establish the Respondent has misled the Commissioner as alleged or retains the impugned information contrary to PIPEDA.

C. Has the Respondent Implemented the Corrective Measures?

[81] The Applicant submits that the Respondent failed to implement the Corrective Measures outlined in the Report and referenced in the Commissioner’s January 18, 2024 email. She also submits that the Respondent failed to honour its offer to allow her to view unreadable documents in-person on its IT system. I address each allegation in-turn.

(1) Corrective Measures from External Audit

[82] The Applicant “question[s], if indeed, the respondent implemented all corrective measures identified by their external consultant.” She asks that the Court order the Respondent to provide a copy of the external audit, action plan, and final report to the Commissioner from December 2023, confirming the implementation of the Corrective Measures.

[83] As previously mentioned, the Respondent failed to include in its evidence the information it submitted to satisfy the Commissioner that the Corrective Measures were implemented.

[84] Nevertheless, the uncontradicted evidence before the Court is that the Commissioner closed its file on the Complaint because it was satisfied with the Respondent’s implementation of the agreed-upon Corrective Measures. Beyond speculation, the Applicant has not provided evidence to support her contention that the Respondent failed to implement these measures.

[85] The Applicant says that the inclusion of her purportedly deleted personal information in the Affidavit of Records is evidence of non-compliance with the Corrective Measures. However, as previously discussed, the Respondent’s collection, use and disclosure of her personal information for the purpose of the defamation action does not violate PIPEDA.

[86] Based on the foregoing, I cannot conclude that the Applicant has met her burden to prove on a balance of probabilities and based on clear, convincing, and cogent evidence, that the Respondent has failed to correct its practices in accordance with the Corrective Measures.

[87] I note that at the hearing the Applicant advised that on January 18, 2024 she made an access to information request to the Commissioner for the release of the information upon which it decided to close the Complaint file. Following the hearing, the Applicant wrote the Court advising she received a response to this access request which included a “Privacy Action List” that the Respondent provided to the Commissioner following the issuance of the Report. As this information is not properly in evidence, I have not considered it in coming to my conclusion on this issue.

(2) Access to Unreadable Documents

[88] The Report concluded that the Respondent contravened Principle 4.9 (Individual Access) and clause 4.9.4 when it failed to clearly communicate to the Applicant that she could view certain records in-person because they were unreadable when printed out. However, the Commissioner considered the matter resolved because the Respondent offered to allow her to view such records in-person on its IT system. At the time the Report was released, the Applicant was still considering the offer.

[89] On March 27, 2023, 10 days after the release of the Report, the Applicant emailed the Respondent asking to view these files in-person (Applicant Affidavit, sworn March 12, 2024, Exhibit 179).

[90] By letter dated April 5, 2023, the Respondent gave the Applicant “official notice that we will not be honouring your Access to Information Request to view your record, in person, off our IT system.” The Respondent maintained that “PIPEDA allows individuals to access their personal information, but it does not guarantee that individuals can access their personal information in a particular form.” The letter further states that the information she seeks was emailed to her in August 2020 (Applicant Affidavit, Exhibit 180).

[91] It is concerning that the Respondent extended an offer to the Applicant that it failed to honour, as contemplated in the Report. However, the Applicant stated in oral submissions that she is “fine now with the unreadable documents” as she now has access to many of them through the Affidavit of Documents. The only documents that the Applicant still seeks access to are records of: (i) her profit share account; (ii) the existence of her chequing account with the Respondent; and (iii) her membership with the Respondent.

[92] The Respondent argues that the existence of a profit share account is an issue in dispute in another legal proceeding. As summarized in the Report, the Respondent asserts that the Applicant does not own this type of account and so cannot produce such a record. As was the case with the Commissioner, the Court will not (and could not) make a ruling on the existence of this record as it is not a privacy matter.

[93] With respect to the Applicant’s chequing account, the Respondent says it is disputed that the Applicant continues to actively use it, but to the extent there is a record of any nominal account, the Respondent consents to provide a record of it. Similarly, the Respondent consents to provide any record it has on the Applicant’s membership, if such exists. However, the Respondent was clear that it has no certificate confirming membership, and that it will not create any new or specialized document for the purpose of responding to the Applicant’s request.

[94] The Court thanks the Respondent for its cooperation to help resolve this issue.

[95] Accordingly, the Respondent is ordered to provide to the Applicant, by encrypted email or registered mail, and within 30 days of the receipt of these reasons: (1) a record showing the Applicant’s chequing account number and balance, or notice that no such record exists; and (2) a record it has of the Applicant’s credit union membership, or notice that no such record exists.

D. Has the Respondent Continued to Indiscriminately Collect the Applicant’s Personal Information?

[96] The Applicant contends that the Respondent and its counsel continue to indiscriminately collect her personal information for unidentified purposes and without authority or consent. Again, she points to the Affidavit of Documents that she says contain screenshots of her social media posts which post-date the Report.

[97] Per the Miazga Affidavit, these screenshots are not being collected or retained by the Respondent. They are documents in the possession of counsel who is representing the Respondent in the defamation action and constitute evidence in that proceeding.

[98] Beyond the collection of evidence for the defamation action, the Applicant has not tendered any evidence to show that the Respondent has continued to indiscriminately collect her personal information.

[99] As noted, the onus rests with the Applicant to prove her allegations on a balance of probabilities. She has failed to do so on this issue.

VII. Remedies

[100] Section 16 of PIPEDA governs remedies. It provides:

A. No Damages Warranted

[101] The Applicant seeks damages amounting to 1% of the Respondent’s balance sheet, or some other amount that the Court deems fit.

[102] There is no basis to award any damages.

[103] Whether damages are appropriate, and the quantum of any damages awarded, are matters within the Court’s discretion: Nammo at para 54.

[104] The burden of proof rests on the Applicant to establish the damages suffered, and that they were caused by the Respondent’s breach of the PIPEDA: Miglialo at paras 21-22, citing Biron v RBC Royal Bank, 2012 FC 1095 at para 38; Montalbo at para 60.

[105] An award of damages is not to be made lightly, and should only be made in the most egregious of situations: Randall v Nubodys Fitness Centres, 2010 FC 681 at para 55 [Randall]; Montalbo at para 60.

[106] This Court has noted that cases in which damages have been awarded “seem to fall for the most part in the category of cases where private information was disclosed”: Miglialo at para 44.

[107] The extent of the Respondent’s past breaches are identified in the Report: an initial failure to provide complete disclosure in response to the Access Request, the indiscriminate collection of a 2015 Facebook post for the purpose of her employee file, and inadequate policies regarding call recording, document retention, and privacy training for staff.

[108] The Respondent rectified these issues by adopting the Commissioner’s recommendations throughout the investigation and subsequently implementing the Corrective Measures.

[109] The Applicant has not established any quantifiable loss warranting compensation. Furthermore, the seriousness of the breach does not merit a damage award: there was no unauthorized disclosure of the Applicant’s personal information and there is no evidence that the Respondent benefitted by violating the PIPEDA (Girao at paras 47-48, citing Nammo at paras 68-71).

[110] The humiliation or mental anguish the Applicant has suffered does not appear to be caused by the Respondent’s handling of her personal information. The Applicant advised the Respondent in 2022 that she was experiencing severe mental health challenges due to being served her with the statement of claim for the defamation action, and that this event caused her to experience severe flashbacks associated with the Respondent’s commencement of foreclosure proceedings against her in 2016. The Applicant says that she and her family doctor have questioned the possibility of a post-traumatic stress disorder; she is awaiting a diagnosis.

[111] While I appreciate the mental stress the Applicant appears to have suffered over the course of nearly 14 years of on-and-off litigation with the Respondent, she has not met her burden to prove that these concerns were caused by the Respondent’s breach of the PIPEDA in its handling of her personal information: see Girao at paras 55-56.

B. Other Remedies

[112] While there were initially concerns with the Respondent’s privacy policies and practices, the evidence before the Court is that these breaches have been adequately remedied by the implementation of the Commissioner’s recommendations during the investigation and through the implementation of the Corrective Measures after the release of the Report: Randall at para 59. Accordingly, there is no basis upon which to make an order pursuant to ss. 16(a) or (b) of the PIPEDA for the Respondent to correct its practices or publish a notice thereof.

[113] However, the Court has broad discretion to fashion appropriate remedies pursuant to s. 16. The remedies listed under paragraphs (a)-(c) are “in addition to any other remedies [the Court] may give.”

[114] Therefore, as previously discussed, the Respondent is ordered to provide to the Applicant, by encrypted email or registered mail, and within 30 days of receipt of these reasons: (a) a record showing the Applicant’s chequing account number and balance, or notice that no such record exists; and, (b) a record of the Applicant’s credit union membership, or notice that no such record exists.

VIII. Costs

[115] I advised the parties at the hearing that I may seek further submissions on costs following the release of my reasons.

[116] Following the hearing, the Applicant provided her submissions on costs. If the parties cannot agree on costs, then the Respondent may file its submissions on costs within 14 days of the issuance of this judgment, and the Applicant may file any reply within 21 days of the issuance of this judgment. The costs submissions shall not exceed three pages, double spaced, excluding any bill of costs or breakdown of fees.

JUDGMENT in T-591-24

THIS COURT’S JUDGMENT is that

1. The application is dismissed, with the exception of the order that follows in paragraph 2 below;

2. The Respondent must, within 30 days of receipt of these reasons, provide to the Applicant by encrypted email or registered mail:

1. A copy of a record of her chequing account showing the account number and balance, or notice that no such record exists; and

2. A record of the Applicant’s credit union membership, or notice that no such record exists.

3. Costs will be determined following receipt of costs submissions.

blank	"Meaghan M. Conroy"
blank	Judge

FEDERAL COURT

SOLICITORS OF RECORD

DOCKET:	T-591-24
STYLE OF CAUSE:	TRICIA DARLENE NOBLE, ALSO KNOWN AS TRICIA DARLENE MCDONALD v. SYNERGY CREDIT UNION LTD
PLACE OF HEARING:	TORONTO, ONTARIO
DATE OF HEARING:	MARCH 17, 2025
REASONS AND JUDGMENT:	CONROY J.
DATED:	OCTOBER 10, 2025

APPEARANCES:

Tricia Darlene Noble, also known as Tricia Darlene McDonald	For The Applicant (ON HER OWN BEHALF)
Jeffrey D. Kerr	For The Respondent

SOLICITORS OF RECORD:

PSM LLP Lloydminster, Saskatchewan

For The Respondent