Federal Court Decisions

Date: 20151117

Docket: T-392-15

Citation: 2015 FC 1283

Ottawa, Ontario, November 17, 2015

PRESENT:    The Honourable Mr. Justice Harrington

JUDGMENT AND REASONS

[1]               Patricia Cote believes to the depth of her very being that her former employer, Day & Ross Inc., has done her wrong. It denied her short-term disability claim. It failed to pass on crucial medical information which would have entitled her to group insurance long-term disability benefits. Rather than accommodate her disability arising from depression and anxiety, it fired her. As a result, her life is in shambles. She seeks compensation in the hundreds of thousands of dollars. She may be right; she may be wrong. I cannot say. I will not say. These matters are to be decided at another time, in another place by someone else; perhaps as early as next month in the New Brunswick Court of Queen’s Bench. All that is before me is an application under section 14 of the Personal Information Protection and Electronic Documents Act [PIPEDA].

[2]               In light of her treatment at the hands of Day & Ross, Mrs. Cote did four things, not necessarily in chronological order:

a.                she sued;

b.               she filed a complaint with the Canadian Human Rights Commission;

c.                she complained to the Superintendent of Insurance; and

d.               she filed a complaint with the Privacy Commissioner under the PIPEDA.

[3]               She first attempted to sue Day & Ross in this Court. Prothonotary Morneau directed that the Statement of Claim not be accepted for filing as the claim was beyond our jurisdiction. He was absolutely correct. Apart from master and crew wages, which have always formed part of an admiralty court’s jurisdiction, this Court does not have jurisdiction over employment contracts as such, even in federally regulated industries.

[4]               Mrs. Cote then sued Day & Ross in the New Brunswick Court of Queen’s Bench. She informs me that the matter has been set down for trial next month.

[5]               The Canadian Human Rights Commission decided not to deal with her complaint under s 41(1) of the Canadian Human Rights Act [CHRA] as there were other grievance or review procedures reasonably available. The Commission concluded that it should not deal with the complaint because the civil action in the New Brunswick’s Court of Queen’s Bench will look at the same facts and has the authority to grant remedies consistent with those available under the CHRA. At the termination of the civil action, the Commission might exercise its discretion to then deal with the complaint.

[6]               The situation with the Superintendent of Insurance is not in the record before me.

[7]               In the matter before me, the Privacy Commission issued a report that Mrs. Cote’s complaint was well founded and resolved. Under s 14(1) of PIPEDA, Mrs. Cote, within 45 days after receiving the Privacy Commissioner’s report, was entitled to apply to this Court for a hearing in respect of any matter in which the complaint was made or was referred to in the report and is covered in certain specific clauses of the PIPEDA schedule.

[8]               This application is not by way of judicial review. It is a de novo hearing (Nammo v TransUnion of Canada Inc, 2010 FC 1284, [2012] 3 FCR 600).

[9]               Under s 16 of PIPEDA, the Court may, among other things, order an organization to correct its practices, to publish a notice in that regard and “award damages to the complainant, including damages for any humiliation that the complainant has suffered.”

[10]           The complaint dealt with by the Privacy Commissioner was that Day & Ross failed to provide her with access to the personal information it held about her. More specifically, it did not respond to her request within the 30-day time frame specified in PIPEDA and the response ultimately provided was incomplete.

[11]           On 13 March 2013, Mrs. Cote sent an email to Day & Ross’s management coordinator in which she referred to PIPEDA and said “May I please be made privy of my personnel file via email?”

[12]           On 17 April 2013, Mrs. Cote was provided with information with an accompanying statement: “Here is everything that was in your HR employee file.” The response was late.

[13]           Mrs. Cote complained that the information provided did not include some medical information .There may have been a misunderstanding as medical information was not kept in her “personnel” file, but in another file. Further information was then provided, again, of course, outside the 30-day legal delay.

[14]           We now come to the reality of Mrs. Cote’s complaint. She had applied for short-term disability, and then long-term disability, based on her depression and anxiety. Although the policy was not filed in the record, the emails clearly establish that Day & Ross self-insures for the first 17 weeks. Thereafter, there is a group policy with Sun Life. Day & Ross, rightly or wrongly, rejected her short-term disability claim.

[15]           What it did not do in providing her with her medical information it kept on file was give copy of its correspondence with Sun Life with respect to long-term disability. Apparently it considered, quite wrongly in my view, that this correspondence was not covered by PIPEDA. That correspondence only came to light with an affidavit of documents in the action in the New Brunswick Court of Queen’s Bench. It was only then that Mrs. Cote realized that one of her doctor’s reports, which apparently had been misplaced for some time, had not been passed on to Sun Life. Day & Ross maintains that the report in question only dealt with short-term disability and so there was no reason to pass it on to Sun Life. It is not for me to say whether Day & Ross was obliged to pass the report on, or whether Mrs. Cote was prejudiced as a result.

[16]           The Privacy Commissioner recommended that one of Day and Ross Inc.’s principles in its privacy policy be changed. The policy stated that it would only provide the reasons for denying access to personal information “upon request”. Those words have now been deleted from the policy.

[17]           Day & Ross had failed to properly explain to Mrs. Cote the basis upon which it initially withheld certain information, such as the correspondence with Sun Life, a third party. Section 8(7) of PIPEDA requires organizations to give reasons. Apparently, Day & Ross had assumed that this correspondence was not “personal information” within the meaning of PIPEDA. It was wrong. The Privacy Commissioner noted that Mrs. Cote’s access requests were now fulfilled, as a result, in part, of documents provided in the litigation before the New Brunswick Court of Queen’s Bench.

[18]           The closing two paragraphs of the report are as follows:

56.   We remain concerned, however, that the Organization’s initial responses to the complainant’s access requests were not in compliance with the Act. While we appreciate the competing demands faced by the Organization in the circumstances, the fact that the complainant may have had other ongoing disputes with the Organization at the time is not an excuse for non-compliance with the Act. We would therefore encourage the Organization to ensure that its policies and procedures are adequate and that staff is sufficiently trained on how to respond to access requests from employees. In particular, staff should be reminded of their obligation to provide reasons when refusing to provide information in response to an access request pursuant to the Act.

...

57.   Accordingly, we conclude that the matter is well-founded and resolved.

[Emphasis in original.]

[19]           The correspondence with Sun Life about Mrs. Cote was her personal information covered by PIPEDA and should have been disclosed without the necessity of litigation. Section 9(1) of PIPEDA provides that an individual shall not be given access to personal information if doing so would likely reveal information about a third party. However, if the information about the third party is severable, it shall be severed.

[20]           In Wyndowe v Rousseau, 2008 FCA 39, [2008] FCJ No 151 (QL), Rousseau was receiving long-term disability benefits from an underwriter and had been examined by Dr. Wyndowe who sent a formal report to the underwriters. The report resulted in disability payments being terminated. Dr. Windowe refused to share his examination notes. However, it was held that the notes could be assessed in so far as they contained personal information about Rousseau, i.e. the information he gave while answering the doctor’s questions and the report prepared for the insurer. There had to be a balance between this and the doctor’s personal interest in the notes.

[21]           In terms of remedies, Day & Ross has abided by the Privacy Commissioner’s recommendations. I see no need to make a further order. As to damages, Day & Ross submits that this is not a case in which damages should be awarded. I disagree. It failed Mrs. Cote three times. An order of damages may make it more alert and sensitive to its obligations in the future.

[22]           There are a number of cases which deal with the award of damages under PIPEDA. Many award no damages at all. In Biron v RBC Royal Bank, 2012 FC 1095, 418 FTR 131, the disclosure of credit card statements in a divorce proceeding resulted in damages of $2,500 plus costs. In Girao v Zarek Taylor Grossman, Hanrahan LLP, 2011 FC 1070, 397 FTR 108, the disclosure of personal information relating to medical conditions resulted in an award of $1,500 plus $500 costs. In Landry v Royal Bank of Canada, 2011 FC 687, 391 FTR 153, disclosure of financial information in divorce proceedings gave rise to damages of $4,500 plus costs.

[23]           In Nammo, above, disclosure of inaccurate personal information to a bank causing credit issues resulted in an award $5,000 in damages plus $1,000 in disbursements. In Chitrakar v Bell TV, 2013 FC 1103, 441 FTR 254, the respondent had ordered a credit report without the applicant’s consent. This kind of check can lower a person’s credit score. There was also no evidence that Bell TV had changed its contracting policies in light of the Privacy Commissioner’s report or that it even acknowledged that it had breached PIPEDA. The Court awarded general damages of $10,000, exemplary damages of $10,000 and $1,000 for disbursements.

[24]           Day & Ross has acknowledged its errors and changed its policy as requested. Nevertheless, an award of damages will drive home its failure to meet its obligations under PIPEDA and, hopefully, cause it to be more attentive to these matters in the future.

[25]           I shall award Mrs. Cote damages of $5,000, and $1,000 for disbursements and other costs.

JUDGMENT

FOR REASONS GIVEN;

THIS COURT’S JUDGMENT IS that:

1.                  The application is granted.

2.                  The applicant is awarded $5,000 in damages, and $1,000 for disbursements and other costs.

“Sean Harrington”

FEDERAL COURT

SOLICITORS OF RECORD

APPEARANCES:

SOLICITORS OF RECORD: