Simon looking earnest in Preveza, Greece

SimonShields@isp.com

Free Online Lawyer Consultations

Legal Guides
tenant / small claims / welfare (ontario works) / odsp / human rights / employment / consumer /
collection agencies / criminal injuries compensation / sppa (admin law) / animal cruelty / dogs & cats / wild animal law (all Canada)

home / about / testimonials / Conditions of Use

THE LATEST WORD

... what's this?

Privacy

1. General
2. Privacy in the Criminal Context
3. PIPEDA
-----------------------------

1. General

Privacy has gone of a lot of changes over the last generation or so, both statutory and the common law. The common law has seen the development in Ontario of a new tort of privacy ('intrusion upon seclusion': "Jones v. Tsige, 2012 ONCA 32 (CanLII)"), and the statutory law has seen the threefold passage of Ontario's Freedom of Information and Protection of Personal Privacy, the Municipal Freedom of Information and Protection of Personal Privacy and the federal Personal Information Protection and Electronic Documents Act.

2. Privacy in the Criminal Context

. R v Jarvis

In R v Jarvis (SCC, 2019) the court considered the issue of privacy from the criminal perspective on 'reasonable expectation of privacy' (also relevant are paras 28-53 on the specific voyeurism issue of the case):
[54] The interpretation of a statutory provision may be informed by the broader legal context. Because Parliament chose to describe the element of the offence with which we are concerned using the expression “reasonable expectation of privacy”, one aspect of the broader legal context is of particular importance in the case at bar: the jurisprudence interpreting the right to be secure against unreasonable search and seizure guaranteed in s. 8 of the Charter, along with closely related jurisprudence.

[55] The concept of “reasonable expectation of privacy” has played a central role in the jurisprudence on s. 8 of the Charter since this Court’s earliest decisions interpreting that provision: see Hunter v. Southam Inc., 1984 CanLII 33 (SCC), [1984] 2 S.C.R. 145. Since that time, the concept has also been employed by courts, including this Court, in delineating the scope of privacy rights outside the context of s. 8 of the Charter and has been used in other provisions of the Criminal Code: see Dagg, at paras. 71-75, per La Forest J., dissenting but not on this point; Srivastava v. Hindu Mission of Canada (Quebec) Inc., 2001 CanLII 27966 (QC CA), [2001] R.J.Q. 1111 (Que. C.A.), at paras. 68-69; Criminal Code, ss. 278.1 and 278.5.

[56] A legislature is presumed to have a mastery of existing law: Sullivan, at p. 205. When a legislature uses a common law term or concept in legislation, that term or concept is presumed to retain its common law meaning: Sullivan, at p. 543. Therefore, Parliament must be understood as having chosen the words “reasonable expectation of privacy” in s. 162(1) purposefully and with the intention that the existing jurisprudence on this concept would inform the content and meaning of these words in this section.

[57] Of course, the relevant differences between the context of s. 8 of the Charter and the context of the offence in s. 162(1) must be kept in mind. While one purpose of s. 162(1) of the Criminal Code is to protect individuals’ privacy interests from intrusions by other individuals, the purpose of s. 8 of the Charter is to protect individuals’ privacy interests from state intrusion: see Hunter v. Southam, at pp. 159-60; R. v. Plant, 1993 CanLII 70 (SCC), [1993] 3 S.C.R. 281, at p. 291. The s. 8 case law has developed in relation to this latter purpose. The “reasonable expectation of privacy” that is decisive in the s. 8 context is therefore an individual’s reasonable expectation of privacy vis-à-vis the state, or more specifically, vis-à-vis the instrumentality of the state that is said to have intruded on the individual’s privacy: see R. v. Duarte, 1990 CanLII 150 (SCC), [1990] 1 S.C.R. 30, at pp. 44-49; Plant, at pp. 291-93; R. v. Cole, 2012 SCC 53 (CanLII), [2012] 3 S.C.R. 34, at paras. 2-3 and 66-73; R. v. Marakah, 2017 SCC 59 (CanLII), [2017] 2 S.C.R. 608, at paras. 40-41.

[58] However, the s. 8 jurisprudence recognizes that the inquiry into whether an individual has a reasonable expectation of privacy vis-à-vis the state with respect to a certain subject matter may be informed, in part, by considering the individual’s privacy expectations vis-à-vis other individuals: see Duarte, at p. 47; R. v. Buhay, 2003 SCC 30 (CanLII), [2003] 1 S.C.R. 631, at paras. 19-24 and 33-34; R. v. Tessling, 2004 SCC 67 (CanLII), [2004] 3 S.C.R. 432, at paras. 32, 38-41 and 46-49. Thus, while the ultimate concern in the s. 8 context is whether there is a reasonable expectation of privacy vis-à-vis the state, the s. 8 case law contemplates that individuals may have reasonable expectations of privacy against other private individuals and that these expectations may be informed by some of the same circumstances that inform expectations of privacy in relation to state agents. This lends support to the view that the jurisprudence on s. 8 of the Charter may be useful in resolving the question raised in the case at bar.

[59] The s. 8 jurisprudence is instructive in interpreting s. 162(1) of the Criminal Code for another reason besides the fact that s. 162(1) uses the phrase “reasonable expectation of privacy”. The express terms of s. 162(1), as well as its legislative history, demonstrate that this provision is concerned with protecting individuals’ privacy interests in specific contexts. Because this Court and other courts in Canada have most frequently had occasion to consider the concept of privacy in the context of s. 8 of the Charter, the s. 8 case law represents a rich body of judicial thought on the meaning of privacy in our society. And far from being unmoored from our ordinary perceptions of when privacy can be expected, as Mr. Jarvis suggests, judgments about privacy expectations in the s. 8 context are informed by our fundamental shared ideals about privacy as well as our everyday experiences.

[60] I therefore turn now to a number of principles established in the jurisprudence on s. 8 of the Charter, and the broader privacy jurisprudence, that I consider relevant to interpreting the meaning of “reasonable expectation of privacy” in s. 162(1) of the Criminal Code. The first of these principles is that determining whether a person can reasonably expect privacy in a particular situation requires a contextual assessment that takes into account the totality of the circumstances: see Plant, at p. 293; R. v. Edwards, 1996 CanLII 255 (SCC), [1996] 1 S.C.R. 128, at paras. 31 and 45; Schreiber v. Canada (Attorney General), 1998 CanLII 828 (SCC), [1998] 1 S.C.R. 841, at para. 19; Buhay, at para. 18; Tessling, at para. 19. As I have explained above, the idea that a variety of circumstances may reasonably inform a person’s expectation of privacy is consistent with a common sense understanding of the concept of privacy. The fact that this is a well-established principle in our jurisprudence lends further support to the view that Parliament intended it to apply in the s. 162(1) context.

[61] The second principle from the jurisprudence on s. 8 of the Charter and the broader privacy jurisprudence that is applicable in the s. 162(1) context is that privacy is not an “all-or-nothing” concept. In other words, simply because a person is in circumstances where she does not expect complete privacy does not mean that she waives all reasonable expectations of privacy: see Duarte; R. v. Wong, 1990 CanLII 56 (SCC), [1990] 3 S.C.R. 36; R. v. Wise, 1992 CanLII 125 (SCC), [1992] 1 S.C.R. 527; R. v. Mills, 1999 CanLII 637 (SCC), [1999] 3 S.C.R. 668, at para. 108; Buhay, at para. 22; see also R. v. Spencer, 2014 SCC 43 (CanLII), [2014] 2 S.C.R. 212, at paras. 41-44; R. v. Quesnelle, 2014 SCC 46 (CanLII), [2014] 2 S.C.R. 390, at paras. 28-29 and 37-43; Alberta (Information and Privacy Commissioner) v. United Food and Commercial Workers, Local 401, 2013 SCC 62 (CanLII), [2013] 3 S.C.R. 733, at paras. 27 and 38 (“Alberta v. UFCW, Local 401”). Thus, the fact that a person knows she will be observed by others, including by strangers, does not in itself mean that she forfeits all reasonable expectations of privacy in relation to observation or visual recording.

[62] An example of this broader principle that is recognized in the jurisprudence is that the intrusion into our privacy that occurs when a person hears our words or observes us in passing is fundamentally different than the intrusion that occurs when the same person simultaneously makes a permanent recording of us and our activities: see Duarte, at p. 48; Wong, at pp. 44 and 48-53; see also Alberta v. UFCW, Local 401, at para. 27. A visual recording may be able to capture a level of detail that the human eye cannot. A visual recording can also capture this detail in a permanent form that can be accessed, edited, manipulated and studied by the person who created the recording and that can be shared with others: see R. v. Sandhu, 2018 ABQB 112 (CanLII), 404 C.R.R. (2d) 216, at para. 45; see also Alberta v. UFCW, Local 41, at para. 27. As this Court has recognized in the context of child pornography, where a photo or video represents sexual exploitation of a person, that person may be harmed for years following its creation by the knowledge that it “may still exist, and may at any moment be being watched and enjoyed by someone”: R. v. Sharpe, 2001 SCC 2 (CanLII), [2001] 1 S.C.R. 45, at para. 92, per McLachlin C.J.; see also paras. 164, 189-90 and 241, per L’Heureux-Dubé, Gonthier and Bastarache JJ. This is not to say that any person who appears in any public place retains a reasonable expectation that she will not be recorded by anyone for any reason: some types of visual recording in public places are to be expected. Rather, it is to emphasize that there is a fundamental difference between mere observation and recording and that this difference is part of the context that must be considered in analyzing reasonable expectations of privacy.

[63] Relatedly, the privacy jurisprudence recognizes the potential threat to privacy occasioned by new and evolving technologies more generally and the need to consider the capabilities of a technology in assessing whether reasonable expectations of privacy were breached by its use: see Wise, at pp. 534-35; Tessling, at para. 16; see also Alberta v. UFCW, Local 401, at paras. 20 and 27. As Voith J. observed in Rudiger, even where a permanent recording is not made, technology may allow a person to see or hear more acutely, thereby transforming what is “reasonably expected and intended to be a private setting” into a setting that is not: para. 98, see generally paras. 93-98. While evolving technologies may make it easier, as a matter of fact, for state agents or private individuals to glean, store and disseminate information about us, this does not necessarily mean that our reasonable expectations of privacy will correspondingly shrink.

[64] The next principle established by the jurisprudence on s. 8 of the Charter that is instructive in the case at bar is that the concept of privacy encompasses a number of related types of privacy interests. These include not only territorial privacy interests — “involving varying expectations of privacy in the places we occupy” (R. v. Gomboc, 2010 SCC 55 (CanLII), [2010] 3 S.C.R. 211, at para. 19) — but, significant to the case at bar, personal and informational privacy interests: Dyment, at p. 428, per La Forest J.; Tessling, at paras. 20-24.

[65] As this Court has recognized, our society places a high value on personal privacy — that is, privacy with respect to our bodies, including visual access to our bodies: see Tessling, at para. 21; R. v. M. (M.R.), 1998 CanLII 770 (SCC), [1998] 3 S.C.R. 393, at para. 32; R. v. Golden, 2001 SCC 83 (CanLII), [2001] 3 S.C.R. 679, at paras. 83, 89-90, 98-99 and 106. While all aspects of privacy — both from the state and from other individuals — serve to foster the values of dignity, integrity and autonomy in our society, the connection between personal privacy and human dignity is especially palpable: see Dyment, at pp. 427-29, per La Forest J.

[66] In considering the concept of informational privacy, this Court has accepted that individuals have a valid claim “‘to determine for themselves when, how, and to what extent information about them is communicated to others’”: Tessling, at para. 23, quoting A. F. Westin, Privacy and Freedom (1970), at p. 7; see also Dyment, at p. 429, per La Forest J.; Alberta v. UFCW, Local 401, at para. 21. The safeguarding of information about oneself, which is also closely tied to the dignity and integrity of the individual, is of paramount importance in modern society: Dyment, at p. 429. When a court is considering whether there is a reasonable expectation of privacy in information, the nature and quality of the information at issue are relevant: see Plant, at p. 293; Tessling, at paras. 59-62; R. v. Gomboc, at paras. 27-40.

[67] Section 162(1)(a) implicates territorial privacy, as it is concerned with protecting privacy in particular places. More fundamentally, however, s. 162(1) as a whole is concerned with protecting personal and informational privacy by prohibiting the observation and visual recording of persons. The jurisprudence on s. 8 of the Charter reminds us that we should be attentive to the ways in which these privacy interests may be affected, even where territorial privacy is not necessarily engaged. It also recognizes the particularly pernicious threat to individual dignity and autonomy that may be posed by violations of these types of privacy expectations. Bearing in mind the high value that our society places on personal — and particularly bodily and sexual — privacy and informational privacy may also be useful in determining whether observation or recording breaches reasonable expectations of privacy in a particular case.

[68] This leads me to an important point about the reasonable expectation of privacy inquiry in the contexts of s. 8 the Charter and s. 162(1) of the Criminal Code. The s. 8 jurisprudence makes it clear that “reasonable expectation of privacy” is a normative rather than a descriptive standard: see Tessling, at para. 42. This Court has also found that the question of whether a person claiming the protection of s. 8 had such an expectation cannot be answered by falling back on a “risk analysis” — that is, by reducing the inquiry to whether the person put themselves at risk of the intrusion they experienced: Duarte, at pp. 47-48; Wong, at p. 45. Both of these propositions apply in the s. 162(1) context. Whether a person reasonably expects privacy is necessarily a normative question that is to be answered in light of the norms of conduct in our society. And whether a person can reasonably expect not to be the subject of a particular type of observation or recording cannot be determined simply on the basis of whether there was a risk that the person would be observed or recorded. The development of new recording technology, and its increasing availability on the retail market, may mean that individuals come to fear that they are being recorded by hidden cameras in situations where such recording was previously impossible; however, it does not follow that individuals thereby waive expectations of privacy in relation to such recording or that retaining such an expectation becomes unreasonable: see Tessling, at para. 42. Indeed, to accept such an approach would make the “reasonable expectation of privacy” a “meaningless standard” and would undermine Parliament’s very purpose in enacting s. 162(1): see Wong, at p. 45.

[69] That being said, determining whether a reasonable expectation of privacy arises in a particular set of circumstances does not involve an ad hoc balancing of the value of the accused’s interest in observation or recording against the value of the observed or recorded person’s interest in being left alone. Accordingly, I respectfully disagree with the approach taken by the dissenting judge in the Court of Appeal. The question he posed — whether “high school students expect that their personal and sexual integrity will be protected while they are at school” — is not the appropriate question: para. 131.

[70] Parliament has already weighed society’s interests in allowing individuals to observe and record others and in protecting individuals from surreptitious observation and recording. In the result, Parliament has enacted s. 162(1), which prohibits surreptitious observation and recording that breaches reasonable expectations of privacy in the three situations described in paras. (a) through (c) of that provision. It is inherent in the public good defence in s. 162(6) that the value of observation or recording to society might, in a particular case, outweigh the value of individual privacy interests, even where the observation or recording would otherwise ground a conviction under s. 162(1) of the Criminal Code. Thus, the only question to be asked in determining whether a person who is observed or recorded was in circumstances that give rise to a reasonable expectation of privacy is whether that person was in circumstances in which she would reasonably have expected not to be the subject of the observation or recording at issue.

3. The Federal PIPEDA (Personal Information Protection and Electronic Documents Act)

. Royal Bank of Canada v Trang

In Royal Bank of Canada v Trang (Ont CA, 2014) the Court of Appeal set out some basic principles respecting the PIPEDA (Personal Information Protection and Electronic Documents Act), in the context of deciding whether a bank was prevented by PIPEDA from providing another bank with a mortgage discharge statement. The court extensively considered several privacy issues, including whether there was implicit consent to such release under the Act, and it's earlier ruling on a similar issue in Citi Cards Canada Inc. v. Pleasance (Ont CA, 2011):
C. PIPEDA

[10] PIPEDA is a federal statute, enacted nearly 15 years ago in recognition of the era of technology in which we now live. It is, as this court said in Royal Bank of Canada v. Welton,[4] a “privacy statute.” Subject to specified exemptions, it protects individuals’ right to privacy in their personal information, defined simply and very broadly as “information about an identifiable individual”. Part 1 of PIPEDA, which is the part of the Act relevant to this appeal, deals with “protection of personal information in the private sector.”

[11] Although PIPEDA is federal legislation, it applies across Canada unless it has been displaced by provincial legislation that the Governor-in-Council by order has declared is substantially similar to PIPEDA. Ontario has not enacted a substantially similar privacy law of general application in the private sector. Thus PIPEDA governs the commercial activities of all Ontario lending institutions, whether provincially regulated or federally regulated as are RBC and Scotiabank.

[12] Section 3 of PIPEDA sets out the purpose of Part 1:
3. The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
[13] The Supreme Court of Canada has recognized the important role of privacy in our society. In commenting on the similarly worded purpose of Alberta’s Personal Information Protection Act, S.A. 2003, c. P-6.5, the court said:
The focus is on providing an individual with some measure of control over his or her personal information: Gratton, at pp. 6 ff. The ability of individuals to control their personal information is intimately connected to their individual autonomy, dignity and privacy. These are fundamental values that lie at the heart of a democracy. As this Court has previously recognized, legislation which aims to protect control over personal information should be characterized as “quasi-constitutional” because of the fundamental role privacy plays in the preservation of a free and democratic society.
See Alberta (Information and Privacy Commissioner) v. United Food and Commercial Workers, Local 401, 2013 SCC 62 (CanLII), [2013] 3 S.C.R. 733, at para. 19.

[14] The overarching purpose of Part 1 of PIPEDA, set out in s. 3, is reproduced as an express requirement in s. 5(3) of the Act:
5. (3) An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.
[15] In other words, PIPEDA seeks to balance individuals’ right to privacy in their personal information with organizations’ need to collect, use and disclose that information in their commercial activities. See Englander v. Telus Communications Inc., 2004 FCA 387 (CanLII), [2005] 2 F.C.R. 572, at paras. 38-40.

[16] Consent is a cornerstone of PIPEDA. Collection, use or disclosure of personal information ordinarily requires an individual’s knowledge and consent. An organization may collect, use or disclose personal information without an individual’s knowledge or consent only in the limited circumstances enumerated in s. 7 of the Act. So, for example, s. 7(3) sets out the circumstances in which an organization may disclose personal information without an individual’s knowledge or consent. The exemptions in ss. 7(3)(c) and (i) were the two exemptions argued in Citi Cards:
7. (3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is



(c) required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;



(i) required by law.
These limited exceptions in s. 7 attempt to strike the appropriate balance, reflected in s. 3, between privacy rights and organizational needs.

[17] The provisions of the Act must be read together with Schedule 1, which lists ten key principles for the protection of personal information.[5] The principles contain both obligations and recommendations for organizations. Under s. 5(1) of the Act, and subject to ss. 6 to 9, organizations must comply with the obligations set out in the Schedule.

[18] Clause 4.3 of the Schedule deals with principle three – consent. This principle and the other nine principles are not written in typically legal language. Clause 4.3.1 provides that consent is required for the disclosure of personal information and that usually an organization will seek that consent at the time of collection:
4.3.1 Consent is required for the collection of personal information and the subsequent use or disclosure of this information. Typically, an organization will seek consent for the use or disclosure of the information at the time of collection. In certain circumstances, consent with respect to use or disclosure may be sought after the information has been collected but before use (for example, when an organization wants to use information for a purpose not previously identified).
[19] Clause 4.3.5 provides that “[i]n obtaining consent, the reasonable expectations of the individual are also relevant.”

[20] Clause 4.3.6 is the clause of the Schedule RBC relies on in this court. That clause distinguishes between “sensitive” and “less sensitive” information and introduces the notion of implied consent for less sensitive information:
4.3.6 The way in which an organization seeks consent may vary, depending on the circumstances and the type of information collected. An organization should generally seek express consent when the information is likely to be considered sensitive. Implied consent would generally be appropriate when the information is less sensitive. Consent can also be given by an authorized representative (such as a legal guardian or a person having power of attorney).
I will return to this provision when I discuss RBC’s main ground of appeal.

..........

E. Analysis

[31] In this court, apart from its submission on the Execution Act, RBC does not rely on either of the two exemptions in s. 7(3) of PIPEDA, which were at issue in Citi Cards. Instead it relies mainly on cl. 4.3.6 of Schedule 1 and s. 3 of the Act to authorize Scotiabank to disclose the mortgage discharge statement. It also argues that Citi Cards is distinguishable because unlike the judgment creditor in that case, RBC has pursued all of its alternative remedies. And it first contends that the mortgage discharge statement is not even “personal information” of the debtors.

First Issue: Is the mortgage discharge statement “personal information” of the debtors?

[32] In oral argument, RBC took the position that the mortgage discharge statement it seeks was not even “personal information” of the Trangs. It pointed out that all the details of the Trangs’ mortgage – the principal amount, the rate of interest, the payment periods and the due date – were made publicly available when the mortgage was registered. Therefore the Trangs could not claim a privacy interest in the mortgage discharge statement as that statement would simply set out the current principal and interest owing on the mortgage at the time RBC asked the Sheriff to sell the property.[7]

[33] I do not agree with RBC’s position. I accept that the financial details of the Trangs’ mortgage, when it was registered, are on the public record in the Ontario Land Registry System. That they are is authorized both by Ontario regulation and by PIPEDA. The Ontario legislature decided to make the details of a mortgage publicly available at the time a mortgage is registered, that is at the beginning of the mortgagor/mortgagee relationship: see O. Reg. 19/99 (Electronic Registration), s. 6, passed under the Land Registration Reform Act.[8]

[34] In turn, s. 7(3)(h.1) of PIPEDA recognizes that consent is not required for the disclosure “of information that is publicly available and is specified by the regulations.” But under s. 1(c) of the Regulations Specifying Publicly Available Information,[9] the only information that is considered publicly available for the purpose of s. 7(3)(h.1) of the statute is “personal information that appears in a registry collected under a statutory authority and to which a right of public access is authorized by law”.

[35] Thus mortgagors, such as the Trangs, cannot claim a privacy interest in the financial details of their mortgage at the time their mortgage is registered. Provincial regulation requires those financial details be made publicly available, and their public availability is authorized by PIPEDA and the regulations under it.

[36] Current mortgage balances, however, are not publicly available information in the Ontario Land Registry System or under PIPEDA. Yet it can hardly be denied that a current mortgage balance is, under PIPEDA, personal information of a mortgagor – it is “information about an identifiable individual.” Nor can it be said that the Trangs have waived any privacy interest in their current mortgage balances simply because the details of their mortgage at the time of registration are on the public record. For these reasons, RBC’s argument that the mortgage discharge statement is not personal information of the Trangs must fail.

Second Issue: Does cl. 4.3.6 of Schedule 1 to PIPEDA permit Scotiabank to provide a mortgage discharge statement to RBC?

[37] This is the main issue in this appeal. RBC’s submission on this issue has two branches: the first branch is that this court’s decision in Citi Cards was per incuriam because it did not consider cl. 4.3.6 of Schedule 1. Therefore stare decisis does not bind us to follow Citi Cards; we are free to come to a different decision. The second branch is that even if the per incuriam exception to stare decisis does not apply, Citi Cards is wrong because it failed to give effect to cl. 4.3.6 of Schedule 1. RBC argues that in accordance with that clause, Scotiabank had the Trangs’ implied consent to disclose the mortgage discharge statement to a judgment creditor. We should therefore overrule our court’s previous decision. I am not persuaded by either branch of RBC’s submission.

.....

(b) Scotiabank does not have the Trangs’ implied consent to disclose a mortgage discharge statement to RBC

[41] RBC makes two arguments why we should find that the Trangs impliedly consented to disclose a mortgage discharge statement: the statement contains “less sensitive” information; and to refuse disclosure would frustrate, inconvenience and unnecessarily increase the cost of enforcing a lawfully obtained judgment.

[42] Amicus responds by arguing that a mortgage discharge statement contains sensitive financial information for which express consent for disclosure is required, that implied consent to disclose is not within the reasonable expectations of the mortgagor, and that RBC had other means to obtain the statement.

(i) Implied consent

[43] Under cl. 4.3.1 of Schedule 1, consent is required for the disclosure of personal information. The Trangs have not expressly consented to disclosure of a mortgage discharge statement to RBC. Clause 4.3.6 of Schedule 1, however, includes the notion of implied consent for the disclosure of personal information. For convenience, I reproduce the clause:
4.3.6 The way in which an organization seeks consent may vary, depending on the circumstances and the type of information collected. An organization should generally seek express consent when the information is likely to be considered sensitive. Implied consent would generally be appropriate when the information is less sensitive. Consent can also be given by an authorized representative (such as a legal guardian or a person having power of attorney).
[44] To determine whether an individual impliedly consents to disclosure, two considerations are relevant: the sensitivity of the information in question; and the reasonable expectations of the individual. The first consideration is found in cl. 4.3.6 itself; the second consideration is found in cl. 4.3.5.[10]

(ii) Sensitivity of the information

[45] PIPEDA does not define “sensitive” and “less sensitive” information, or the circumstances in which consent may be implied. Clause 4.3.6 of Schedule 1 does, however, establish a link between the sensitivity of the information and the appropriate form of consent.

[46] Where information is likely sensitive, an organization should seek express consent. And under cl. 4.3.4 of Schedule 1, any information can be sensitive depending on the context:
4.3.4 The form of the consent sought by the organization may vary, depending upon the circumstances and the type of information. In determining the form of consent to use, organizations shall take into account the sensitivity of the information. Although some information (for example, medical records and income records) is almost always considered to be sensitive, any information can be sensitive, depending on the context….
[47] Where information is less sensitive, consent may be implied. But even less sensitive information may, depending on the context, require express consent. The important point, however, is that the sensitivity of the information must be assessed in the overall context of the relationship between the organization and the individual – here, between Scotiabank and the Trangs. In assessing that sensitivity, the relationship between the Trangs and RBC has no role to play. As Blair J.A. said in Citi Cards, at para. 23, “[t]he Act does not contemplate a balancing between the privacy rights of the individual and the interests of a third-party organization”.

[48] Nonetheless, RBC submits that the information in a mortgage discharge statement is less sensitive information. Therefore the Trangs can be taken to have impliedly consented to its disclosure. RBC contends that as the details of the mortgage at the beginning of the mortgagor/mortgagee relationship are publicly available, the details during the course of that relationship can hardly be considered sensitive information.

[49] It is tempting to agree with RBC’s submission and conclude that any mortgagor must be taken to have impliedly consented to the disclosure to a judgment creditor of the money owing on one of the mortgagor’s assets. After all, as RBC points out, earlier disclosure is mandated by regulation. Disclosure at a later time would reflect the balance owing on the same asset; only the amount would differ. And not to imply consent would seem to serve no purpose other than to assist the Trangs, and mortgagors in their position, in avoiding payment of a lawfully obtained judgment against them.

[50] This temptation, however, runs up against the very broad protection the Act affords to the privacy of an individual’s personal information. Undoubtedly, the amount the Trangs owe on their mortgage is, to them, personal information, even though it seems to be just a number.

[51] Yet it is not just a number. The balance owing on a person’s mortgage can be an important piece of private information that opens a window to many aspects of that person’s financial profile. It indicates financial worth. It measures how a person deals with financial liabilities. It opens a portal to a person’s financial stability or instability. In many contexts, the disclosure of this seemingly innocuous information to a third party without consent may affect a person’s interests adversely. Even the timing of the disclosure could be sensitive.

[52] And, how is Scotiabank to assess the sensitivity of the information so that it can say its customers, the Trangs, impliedly consented to disclosure to another bank? It is one thing for Scotiabank to invoke implied consent to advance its own needs. It is quite another for Scotiabank to invoke implied consent to advance the needs of a third party.

[53] This temptation to find implied consent also runs up against the language and scheme of the Act. The language of the consent principle in the Schedule does not support RBC’s position. For example, as is evident from cl. 4.3.4, income records of an individual are almost always considered sensitive information. A mortgage discharge statement is like an income record in the sense that it contains personal financial information of the mortgagor, often of a significant financial asset. And, as I have said, both express and implied consent under the Schedule focus on the relationship between the organization and the individual, not on a stranger to that relationship.

[54] Thus I do not agree with RBC’s submission. It seems to me that the information in a mortgage discharge statement is sensitive information for which the mortgagee would need the mortgagor’s express consent to disclose to a third party, such as a judgment creditor. And, Scotiabank does not have the Trangs’ express consent to do so.

[55] A current mortgage balance is not publicly available information. Just because the legislature chose to make the details of a mortgage publicly available at the beginning of the mortgage relationship does not strip a mortgage balance during the course of a mortgage relationship of the sensitivity it would ordinarily have – a sensitivity for which implying consent to disclosure would be inappropriate. As the Supreme Court said in the Alberta (Information and Privacy Commissioner) case: “The ability of individuals to control their personal information is intimately connected to their individual autonomy, dignity and privacy.”

[56] Moreover, the context in which disclosure is sought increases the sensitivity of the information. Disclosure is not sought by the “organization”, in this case by the mortgagee, Scotiabank, but by a stranger to the mortgage relationship: RBC, a third party judgment creditor. In that context, information about the state of the Trangs’ mortgage is sensitive information. In reality it is information about the debtors themselves and about their financial situation. To disclose that information to a judgment creditor without a court order requires their express consent.

(iii) Reasonable expectations of the individual

[57] Clause 4.3.5 of Schedule 1 provides that “[i]n obtaining consent, the reasonable expectations of the individual are also relevant.” Even if a current mortgage balance can be considered “less sensitive” information, disclosure of a discharge statement to a judgment creditor is not within the reasonable expectations of a mortgagor.

[58] An individual’s reasonable expectations must be assessed objectively. That objective assessment flows from s. 5(3) of the statute, which provides that an organization may “disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.” But, to repeat what Blair J.A. noted in Citi Cards, that assessment must focus on the relationship between the individual and the organization – here between the Trangs and Scotiabank. The reasonable expectations of RBC, a stranger to that relationship, are irrelevant in deciding whether implying consent to disclosure is appropriate.

[59] What then are the reasonable expectations of a mortgagor who gives a mortgage to a bank? I think the Trangs could reasonably expect two things from Scotiabank. First, they could expect the protection of their personal information afforded by the common law. And the common law has long recognized that a bank owes a duty to keep a customer’s personal information confidential. A bank ought not to disclose that information without the customer’s consent, unless required to do so by law, court order or some overriding public duty,[11] or unless the bank’s own interests require disclosure. See M.H. Ogilvie, Bank and Customer Law in Canada, 2d ed. (Toronto: Irwin Law, 2013), at pp. 324-38; Tournier v. National Provincial and Union Bank of England, [1924] 1 K.B. 461 (C.A.).

[60] Under this last exception, Scotiabank could collect, use and disclose personal information concerning the Trangs to administer and, if necessary, enforce its mortgage. In doing so, Scotiabank would be legitimately protecting its own interests.

[61] Second, the Trangs could also reasonably expect that if Scotiabank were going to disclose their personal information for a purpose unrelated to the administration or enforcement of the mortgage, it would obtain the Trangs’ consent. In other words, personal information legitimately collected for one purpose should not be disclosed for an entirely different purpose without the individual’s consent. Indeed, cl. 4.2.4 of Schedule 1 to PIPEDA so provides:
4.2.4 When personal information that has been collected is to be used for a purpose not previously identified, the new purpose shall be identified prior to use. Unless the new purpose is required by law, the consent of the individual is required before information can be used for that purpose….
[62] Thus I agree with Blair J.A.’s comment, at para. 23 of his reasons in Citi Cards: “This information is collected and used by the Banks for purposes of administering the mortgage; it is not collected or used for purposes of facilitating another judgment creditor’s execution on its judgment.”

[63] In summary, both the sensitivity of the information and the Trangs’ reasonable expectations supported Scotiabank’s refusal to disclose the mortgage discharge statement to RBC without the Trangs’ express consent.

(iv) Costs, inconvenience and other means to obtain the discharge statement

[64] RBC had two ways to obtain the mortgage discharge statement from Scotiabank: by a term in its loan agreement with the Trangs or by a court-ordered examination under rule 60.18(6)(a) of the Rules of Civil Procedure. The first would have eliminated any costs or inconvenience to RBC; the second would impose some modest costs and inconvenience. I will discuss these two alternatives in more detail after addressing RBC’s other grounds of appeal.

Third Issue: Does s. 3 of PIPEDA permit Scotiabank to provide a mortgage discharge statement to RBC?

[65] RBC relies on s. 3 of the Act, which for convenience I reproduce here:
3. The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
[66] RBC emphasizes the concluding words of s. 3 – “for purposes that a reasonable person would consider appropriate in the circumstances.” And as I have said, those words also appear in s. 5(3) of the Act. RBC submits that “a reasonable person would believe it to be reasonable to order the disclosure of the balance owing on a mortgage when the alternative would be frustrating the enforcement of a judgment which has been lawfully obtained through court process.”

[67] Even if one were to accept the “reasonableness” of RBC’s position, its submission on s. 3 or s. 5 cannot succeed. Neither is an independent basis for authorizing disclosure under PIPEDA. Section 3 emphasizes that the purposes for which an organization may collect, use or disclose information are those that a reasonable person would consider appropriate in the circumstances. And s. 5(3) obligates an organization to collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

[68] Indeed, by its wording, s. 5(3) applies in addition to the requirement of consent. But neither s. 3 nor s. 5(3) is an alternative to obtaining consent or an exception to the need for consent. An organization that collects, uses or discloses personal information for a purpose consistent with ss. 3 and 5(3) will nonetheless contravene PIPEDA if it fails to obtain the affected individual’s consent, unless an exception to the requirement for consent applies.

[69] I would not give effect to this ground of appeal.

......

Fifth Issue: Is Citi Cards distinguishable?

[73] In Citi Cards, the motion judge held, and Blair J.A. agreed, that the judgment creditor had not exhausted its alternate remedies because it had not tried to examine the debtor’s wife. In this appeal, RBC submits that it has exhausted its alternate remedies because it has twice tried to examine the Trangs, each time without success. It therefore submits that because it took reasonable steps to obtain the mortgage statement from the debtors, it should be entitled to that statement from Scotiabank.

[74] The motion judge rejected this submission. In his view, that RBC had exhausted other means to obtain the statement did not add to its substantive argument that it was entitled to the statement under PIPEDA. Although I agree with the motion judge, as Blair J.A. noted in Citi Cards, and as I will discuss, where a judgment creditor has exhausted other means to obtain a mortgage statement, that will be a relevant consideration when a court decides whether to exercise its discretion to order the mortgagee to produce the statement on a motion under rule 60.18(6). Subject to this caveat, I would not give effect to this ground of appeal.

Means to obtain the mortgage discharge statement

[75] RBC could have obtained the mortgage discharge statement in one of two ways: either by a term in its loan agreement with the Trangs or by a motion under rule 60.18(6)(a) of the Rules of Civil Procedure.

(a) The loan agreement

[76] With foresight, RBC could have obtained the Trangs’ consent to the disclosure of a mortgage discharge statement by a term in its loan agreement. For example, the term might have provided that if the Trangs defaulted on their loan and RBC obtained a judgment against them, then for the purpose of enforcing the judgment, the Trangs would agree that any mortgagee of their property could deliver a mortgage discharge statement to RBC. The Trangs’ express consent to disclosure of the discharge statement in the loan agreement would be sufficient to meet the requirements of PIPEDA and for Scotiabank to deliver the discharge statement to RBC. However, RBC did not obtain the Trangs’ consent in its loan agreement.

(b) A motion under rule 60.18(6)(a)

[77] Although RBC did not obtain the Trangs’ consent in its loan agreement, it can still seek to obtain the mortgage discharge statement by a motion under rule 60.18(6)(a) of the Rules of Civil Procedure. That rule states:
60.18(6) Where any difficulty arises concerning the enforcement of an order, the court may,

(a) make an order for the examination of any person who the court is satisfied may have knowledge of the matters set out in subrule (2).
Under rule 1.03(1), an order includes a judgment. To obtain an order under rule 60.18(6), the party seeking the order must show a “difficulty” in enforcing its judgment. What is a “difficulty” for the purpose of the rule? I think “difficulty” will have to be assessed case by case. But the refusal of the Sheriff to sell without a discharge statement is not a “difficulty” that entitles the execution creditor to go directly to rule 60.18(6) before at least attempting other means to obtain the information. In exercising their discretion under rule 60.18(6), courts should be reticent to require strangers to the litigation to appear on a motion.

[78] Our court has already endorsed this approach in commenting on Rule 591, the predecessor to rule 60.18(6). In Canadian Imperial Bank of Commerce v. Sutton (1981), 1981 CanLII 1886 (ON CA), 34 O.R. (2d) 482, at p. 484, Lacourcière J.A. wrote:
Caution, however, should be exercised by a judge before whom an application is made so that persons who are strangers to the litigation are not unduly harassed by examinations. The relatives of a judgment debtor or a stranger should not be ordered to be examined unless the judgment creditor has exhausted all means available before resorting to an application of this kind. However, the wording of the Rule leaves it to the discretion of the court to make an order where a difficulty arises in the execution or enforcement of a judgment.
[79] Here, RBC can show “difficulty” in enforcing its judgment, both because the Trangs failed to appear for two judgment debtor examinations and because Scotiabank will not produce a discharge statement. Therefore, RBC can resort to a rule 60.18(6)(a) motion. It can seek an order to examine a representative of Scotiabank.

[80] Moreover, under rules 34.10(2)(b) and (3), Scotiabank would be required to bring to the examination and produce a discharge statement:
34.10(2) The person to be examined shall bring to the examination and produce for inspection,



(b) on any examination, including an examination for discovery, all documents and things in his or her possession, control or power that are not privileged and that the notice of examination or summons to witness requires the person to bring.

(3) Unless the court orders otherwise, the notice of examination or summons to witness may require the person to be examined to bring to the examination and produce for inspection,

(a) all documents and things relevant to any matter in issue in the proceeding that are in his or her possession, control or power and are not privileged; or

(b) such documents or things described in clause (a) as are specified in the notice or summons.
[81] An order made under rules 60.18(6)(a) and 34.10 is an order that would permit Scotiabank to disclose the mortgage discharge statement to RBC without the Trangs’ consent. It would satisfy the exemption in s. 7(3)(c) of PIPEDA.[12] The motion that RBC twice brought to compel Scotiabank to produce a discharge statement would not satisfy that exemption.

[82] Section 7(3)(c) of PIPEDA authorizes an organization (Scotiabank) to disclose personal information (a mortgage discharge statement) without the individual's (Trangs') knowledge and consent if disclosure is required to comply with a court order or the rules of court relating to the production of records. By its wording, s. 7(3)(c) does not itself authorize disclosure. Instead, it authorizes disclosure without consent if the order for disclosure is based on an authority or rule separate from PIPEDA. This distinction is important because it gives effect to PIPEDA's objective: to protect an individual's right of privacy and to permit only narrow exceptions to that right.

[83] This important distinction is evident in this case. RBC did not obtain an order on a motion under rule 60.18(6)(a). Instead, it simply brought a motion – not once, but twice – to require Scotiabank to produce the discharge statement. It could succeed on that motion only if the exemption in s. 7(3)(c) authorized disclosure. But it does not. It is, as Blair J.A. wrote in Citi Cards, at para. 25, "circular" to say Scotiabank is required to disclose a discharge statement "because disclosure is required by an order not yet made."[13]

[84] In contrast, an order made on a motion under rules 60.18(6)(a) and 34.10 is a court order made on the basis of a separate authority or "rules of court" – our Rules of Civil Procedure. An order under these rules does not engage "circular" reasoning.[14] It is grounded in specific procedural rules, which satisfy the exemption in s. 7(3)(c) of PIPEDA. On a successful motion under rules 60.18(6)(a) and 34.10, Scotiabank would be required, in the words of the exemption, "to comply with ... an order made by a court ... to compel the production of information, or to comply with rules of court relating to the production of records".

[85] My colleague suggests that “[i]t would fly in the face of increasing concerns about access to justice in Canada to dismiss this appeal and require RBC to bring yet another motion." Respectfully, I do not agree that RBC's access to justice has been imperilled. PIPEDA is a privacy statute. By passing it, Parliament has recognized the high value Canadians place on the privacy of their personal information. Exceptions, which allow our personal information to be disclosed without our knowledge or consent, are carefully and narrowly tailored. A party seeking disclosure without consent must satisfy the court that one of the narrow exceptions applies.

[86] RBC, which is hardly an unsophisticated lender, had a procedural route available to come within the exception in s. 7(3)(c) and obtain the discharge statement. In Citi Cards, Blair J.A. identified that procedural route as a motion under rule 60.18(6)(a). Instead, however, RBC twice sought to short-circuit this route by bringing a motion Citi Cards had already said would not satisfy the exception. And when RBC finally sought to examine Scotiabank, it did not bring a rule 60.18(6)(a) motion to obtain a court order, which is a prerequisite to coming within the exception. Instead, it asked only that a representative of Scotiabank appear for an examination voluntarily. Although a Scotiabank representative did so, she properly indicated that PIPEDA prevented her from disclosing the discharge statement without a court order or the Trangs' consent.

[87] A motion under rule 60.18(6)(a) undoubtedly would increase RBC’s cost and inconvenience in enforcing its judgment. Because RBC failed to obtain the Trangs’ express consent, that cost and inconvenience seem to be a small price to pay for protecting the Trangs’ privacy rights.

[88] As important, under rule 60.18(6)(a), the court has discretion whether to make the order requested. Because of this discretion, the court can act as a gatekeeper for the disclosure of personal information. That it has this role is entirely appropriate because it is in the best position to balance the interests of the various affected parties and determine whether disclosure is justified.

[89] In exercising its discretion, the court may, for example, take into account whether, as between the execution creditor and the judgment debtor, the information is sensitive, and whether the judgment creditor has exhausted other means to enforce its judgment. Here, that RBC has twice sought without success to examine the Trangs would be a relevant consideration. In other cases – and Citi Cards is an example – the court may be concerned to protect the interests of a spouse or co-mortgagor who is not a debtor.

F. Conclusion

[90] RBC may still bring a motion for an order to examine a representative of Scotiabank under rule 60.18(6)(a). .....


Cases to be integrated


Law Society Number #37308N / Website © Simon Shields 2005-2019