Making private information public: The continued expansion of privacy class action liability

Introduction

Privacy class actions are a growing field in Canada. Historically, such actions were not pursued by plaintiffs, largely due to a perception that they were difficult to prosecute on a class-wide basis, given the diverse and individualised nature of loss arising from privacy breaches. However, that trend has changed.

Over the past few years, Canada has seen a considerable increase in privacy actions regarding data breaches and unauthorised use of personal information. This trend has been driven by the active enforcement activities of Canadian privacy regulators, increased media interest in privacy issues and the recognition of the tort of "intrusion upon seclusion" in Ontario.¹ In addition, developments in class action jurisprudence have arguably lowered the bar for class certification.

Although challenges remain for plaintiffs in certifying privacy claims, a recent decision of the Federal Court suggests that there may be another potential ground upon which to base a privacy class action - "publicity given to private life."

John Doe v Her Majesty the Queen - a novel claim for "publicity given to private life"

In John Doe and Suzie Jones v Her Majesty the Queen,² two anonymous plaintiffs alleged that Health Canada had wrongfully identified them as participants in a federal program for access to medical marihuana. In November 2013, Health Canada sent oversized envelopes marked "Marihuana Medical Access Program" through Canada Post to about 40,000 people registered in the program. The plaintiffs alleged that by identifying on the envelopes the participants' names together with the name of the program, Health Canada had breached their privacy and exposed them to security risks. They claimed that a reasonable person would conclude from the envelopes that the addressees were associated with the federal program, suffered from serious medical conditions, and possessed or consumed marihuana.

The mailings were contrary to past practice and shortly afterwards the Deputy Minister of Health Canada acknowledged that the envelopes were the result of an administrative mistake. In response to 339 complaints, the Privacy Commissioner subsequently concluded that the mailings violated the Privacy Act by referring to the program together with the individuals' names.

In the context of the low evidentiary threshold on a certification motion, the court certified, for the first time in a Canadian class action, the novel claim of "publicity given to private life". The court began by holding that such a claim appeared "to be an extension of the tort of intrusion upon seclusion" and that the tort had been recognised in the United States, being the defined as:

One who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of his privacy, if the matter publicized is of a kind that:

1. would be highly offensive to a reasonable person and
2. is not of legitimate concern to the public.³

The court also noted that there "are some parallels to the concept in continental Europe," and that the Court of Appeal of Manitoba had made reference to "public disclosure of embarrassing private facts about the individual" in a recent appeal on a motion to strike.⁴ This reference, made in the dissenting opinion of Monnin J.A., was to the academic work of Prof. Prosser, which had previously been cited by the Court of Appeal for Ontario in Jones v Tsige.⁵

The court concluded that the pleading was therefore sufficient to avoid being struck. It also recognized that the "area of privacy rights, either by statute, contract or tort, is developing rapidly."⁶

What is the impact on the privacy class action landscape?

The full impact of the decision in John Doe is yet to be seen. The context was a motion to certify a class action which imposes a very permissive threshold on novel claims. Novel claims have previously survived such motions, only to fail at the merits stage.

However, there are several factors which suggest that there will be an impact on the privacy class action landscape:

• The government has appealed the certification order, which means that the novel tort will be considered by the Federal Court of Appeal.⁷ If the decision is upheld, a new tort may be recognized or, at the very least, gain momentum.
• "Publicity given to private life" relates to different privacy breaches from those caught by "instruction upon seclusion," expanding the circumstances in which defendants might be liable for a breach of privacy rights.
• The extent to which "publicity given to private life" requires proof of harm is unclear, suggesting that such claims may be conducive to certification as class actions.