Canada’s federal privacy law, PIPEDA, was enacted to be one of our framework laws that would underpin our digital economy. It’s goal was to recognize the privacy rights of individuals and at the same time to recognize the legitimate needs of organizations to collect, use, and disclose personal information. That balance between privacy and uses of personal information for appropriate purposes was underscored by the Supreme Court in a decision released yesterday in Royal Bank of Canada v. Trang 2016 SCC 50. .
In a ruling that overturned the 3:2 ruling of the Ontario Court of Appeal below and a prior decision of that court in Citi Cards Canada Inc. v. Pleasance, 2011 ONCA 3, the Court ruled that a mortgagee can disclose personal information in a mortgage discharge statement to a judgment creditor of the mortgagor seeking to enforce its rights against the mortgagor. In reaching this very pragmatic and cogently reasoned conclusion, the Court made a number of very important statements about PIPEDA summarized below that will inevitably be applied in future cases.
- PIPEDA is a federal statute that in essence is “consumer protection legislation for the digital economy”. However, it should not be interpreted to “unduly prioritize privacy interests over the legitimate business concerns” given that the “overall intent of PIPEDA is also “to promote both privacy and legitimate business concerns””.
- PIPEDA has a number of exceptions that permit, inter alia, disclosures without any consent.
- One exception is “an order made by a court”. The Citi case had construed this exception very narrowly. The Supreme Court disagreed ruling .that s.7(3) of “PIPEDA does not diminish the powers courts have to make orders, and does not interfere with rules of court relating to the production of records.”
- The exception for an order made by a court applies even when a motion for disclosure is sought under the Rules of Civil Procedure or the inherent jurisdiction of the court. The Court did not exhaustively canvass the test for when such orders can be made. However, it concluded making an order for disclosure in the circumstances was “appropriate”. Given the breadth of the Court’s inherent jurisdiction, this ruling will have very important impacts in future cases where no explicit exception for a collection, use or disclosure of personal information exists under PIPEDA. According to the Court:
I conclude that an order requiring disclosure can be made by a court in this context if either the debtor fails to respond to a written request that he or she sign a form consenting to the provision of the mortgage discharge statement to the creditor, or fails to attend a single judgment debtor examination. A creditor who has already obtained a judgment, filed a writ of seizure and sale, and completed one of the two above-mentioned steps has proven its claim and provided notice. Provided the judgment creditor serves the debtor with the motion to obtain disclosure, the creditor should be entitled to an order for disclosure. A judgment creditor in such a situation should not be required to undergo a cumbersome and costly procedure to realize its debt.
- The Court also confirmed that PIPEDA does not interfere with a disclosure that is for the purpose of collecting a debt owed by the individual to an organization, or disclosure that is required by law. “In other words, the intention behind s. 7(3) is to ensure that legally required disclosures are not affected by PIPEDA”.
- The principle of informed consent is foundational to PIPEDA. That consent can be express or implied. The general rule is that consent be express, but implied consent is accepted in “strictly defined circumstances”. In determining what type of consent is required, the reasonable expectations of the individual are relevant.
- Implied consent is generally appropriate when personal information is not sensitive. While financial information of individuals is generally considered to be sensitive, the degree of sensitivity must be assessed contextually. In this case, the information contained in mortgage discharge statement was considered to be less sensitive than other information and it had both a public and private nature.
- When determining the reasonable expectations of the individual, the whole context is important. “Indeed, to do otherwise would unduly prioritize privacy interests over the legitimate business concerns that PIPEDA was also designed to reflect, bearing in mind that the overall intent of PIPEDA is ‘to promote both privacy and legitimate business concerns’”. Further, the legitimate business interests of organizations seeking disclosure of personal information is “a relevant part of the context which informs the reasonable expectations of the” individual. On the facts of the case, the Court found that “a reasonable person would consider it appropriate for a mortgagee to provide a mortgage discharge statement to a judgment creditor who has obtained a writ of seizure and sale of the mortgaged asset from the court and filed it with the sheriff”.
The parties before the Court were RBC and the Privacy Commissioner who was appointed as amicus curiae. The mortgagee, Scotiabank, and the mortgagors (the Trangs) were not involved in the appeal.
For more information and analysis about the case, see the blog post published by my firm McCarthy Tétrault on Cyberlex.
