Protecting privacy and confidentiality

Key laws and legal tests

Other than applicable data protection legislation, is there a separate law of privacy in your jurisdiction that regulates the publication of private or confidential information? If yes, what is the test to determine whether an individual’s privacy has been infringed?

While invasions of privacy and breaches of personal information predominantly occur within private organisations and public bodies due to their substantial data collection, individuals are also safeguarded against privacy infringements from other individuals.

In Canadian common law jurisdictions, there are two sources of privacy torts that protect individuals from invasions of privacy. The first is a common law collection of four privacy torts, which are the torts of: (1) intrusion upon seclusion; (2) wrongful appropriation of personality (appropriation of name or likeness); (3) publication (or public disclosure) of private facts; and (4) false light in the public eye. The recognition and application of privacy torts can vary from one province to another due to differences in legal interpretations, court decisions and legislative frameworks. For example, while some provinces like Ontario have recognised the tort of ‘intrusion upon seclusion’ (Jones v Tsige, [2012] O.J. No. 148 (C.A.) (Tsige)), other provinces might not have explicit legal precedents or statutes that firmly establish the same tort.

The second source of privacy torts are the provincial and federal privacy statutes. British Columbia (Privacy Act, R.S.B.C. 1996), Manitoba (The Privacy Act, CCSM c P125), Saskatchewan (Privacy Act, R.S.S. 1978, c. P-24) and Newfoundland and Labrador (Privacy Act, RSNL 1990, c P-22) have adopted statutes that create different causes of action for invasion of privacy.  

In common law provinces, the tests applied to determine whether there has been a violation of the right to privacy depend on the specific type of privacy tort involved. For example, to establish intrusion upon seclusion, three elements must be proven by the claimant (Tsige, paragraph 71):

  • the defendant’s conduct must be intentional or reckless;
  • the defendant must have invaded, without lawful justification, the plaintiff's private affairs or concerns; and
  • a reasonable person would regard the invasion as highly offensive causing distress, humiliation or anguish.

 

Moreover, in Quebec, privacy rights are safeguarded by the Quebec Charter and by the CCQ. Under the CCQ, individuals are granted the right to privacy, which encompasses both physical and moral aspects of privacy (sections 3, 35 and 36 CCQ). This law recognises the value of personal information and upholds the principle that any publication infringing upon an individual's reasonable expectation of privacy can be deemed unlawful. On the other hand, the Quebec Charter further reinforces this protection by affirming the right to respect for one's private life, which includes personal information (section 5 and 49). The application test to determine whether an individual's right to privacy has been infringed is a twofold test. First, it assesses whether the information published was of a private or confidential nature and whether the individual had a reasonable expectation of privacy in the circumstances at hand. This principle revolves around the individual's subjective expectations, which must be reasonable. When evaluating these expectations, the key aspect to consider is the inherent nature of the private element, be it distinguishing a confidential conversation from a business-related discussion (Srivastava c. Hindu Mission of Canada (Quebec) Inc., 2001 CanLII 27966 (QC CA)). Additionally, the individual’s character plays a role; for instance, safeguarding the image of a public figure contrasts with that of an ordinary individual. The court assesses various factors to establish the scope of privacy expectations, including the level of control the person has over the private matter, the nature of the information, the person’s personality, their subjective expectation for safeguarding privacy, and the reasonableness of these prospects. Secondly, the court must apply a test of proportionality to weigh the potential harm in light of the public interest and competing fundamental rights (Veilleux c. Compagnie d'assurance-vie Penncorp, 2008 QCCA 257, paragraph 16).

Private information

Are any types of information automatically considered to be private?

The determination of whether information is considered to be private depends on a variety of factors, such as the nature of the information, the context in which it is collected or shared, as well as the complex interplay of legal principles, societal norms and individual expectations of privacy. As a result, whether information is treated as private under the law often requires a case-by-case assessment.

There is no blanket classification of certain types of information as automatically private according to the law. Instead, federal and provincial laws have only defined the concept of ‘personal information’, which refers to any information that relates to a natural person and allows that person to be identified, either directly or indirectly (for example, section 2 of the Act respecting the protection of personal information in the private sector (Quebec Private Sector Act), section 1 of the Personal Information Protection Act, SBC 2003, c. 63, section 1 of the Personal Information Protection Act, SA 2003, c P-6.5 and section 2 of PIPEDA). These definitions encompass any data that can be linked to a specific individual and used to identify them.

Furthermore, Canadian privacy laws provide that certain types of ‘sensitive’ personal information require greater protection. Personal information is generally considered sensitive when it entails a high level of reasonable expectation of privacy because of its nature (eg, medical, financial or biometric information) or because of the context of its use or disclosure (for example, section 12 paragraph 3 (2) Quebec Private Sector Act). A parallel can be drawn with ‘private information’ since courts generally tend to acknowledge that the highest expectation of privacy stems from records closely tied to an individual's core biological information. Such information, by its very nature, is considered by the courts to be the most personal and private aspect of our lives (R. v NK, 2021 NSSC 334, paragraph 35).

Privacy rights

Do the attributes of the claimant affect their privacy rights? For example, do public figures have a lower right to privacy?

It is commonly argued that public figures, due to their prominence and role in public life, may have a lesser right to privacy or a reduced expectation of it compared to private individuals. This contention stems from the understanding that public figures willingly assume a level of scrutiny inherent to their status, potentially impacting the scope of their privacy protection (Aubry c. Éditions Vice-Versa inc., 1998 CanLII 817 (CSC), paragraph 56 to 58).

Injunctions

What steps can an individual take to prevent the publication of private information? If applicable, what is the test for a privacy injunction and can it be obtained from the courts on an urgent basis?

Although it can be a challenging endeavour, injunctive relief is available to prevent the publication of private information. Injunctive relief is considered an extraordinary remedy and generally requires a compelling demonstration of several criteria. First, urgency must be evident, indicating the need for immediate action to avert irreparable harm. A clear and well-founded right to privacy, substantiated by a strong likelihood of success on the underlying legal claim, is also essential. Additionally, the risk of serious and irreparable harm, which surpasses ordinary inconvenience, must be demonstrated. The court assesses the balance of convenience, considering the harm and convenience to all parties involved, and evaluates the broader public interest implications of granting or denying the injunction (Plourde c. Mendonça, 2011 QCCS 5500).

Injunctive relief, especially pre-publication injunctions, raises the concern of potential censorship. The courts are cautious about preventing the dissemination of information or opinions, particularly if the alleged defamation is a matter of public interest or concerns matters of public importance (Bijouterie C.M. Michaud (1990) enr. c. Société Radio-Canada, 1999 CanLII 11085 (QC CS), paragraph 37-40).

Overall, while injunctive relief may be available in defamation cases, obtaining such relief is generally more challenging due to the obligation to achieve a delicate balance between protecting the reputation of individuals and safeguarding freedom of expression. Courts are cautious when restricting speech and will carefully consider the specific circumstances of each case before granting injunctive relief.

Other remedies

What other remedies are available for breach of privacy?

In addition to seeking court-issued injunctions to prevent further harm, individuals can pursue a claim for monetary compensation for losses incurred as a result of a privacy breach. This compensation can encompass moral damages, reputational damages, and financial losses. The courts may issue cessation orders to halt the offending behaviour, while correction or rectification orders can ensure false or misleading information are corrected.

Moreover, in cases of intentional misconduct that unlawfully infringe upon a right or freedom recognised by the Quebec Charter, exemplary or punitive damages may potentially be awarded to deter such actions and establish a form of punishment (section 49 of the Quebec Charter).

Protecting company information

Privacy is generally regarded as a right of the individual. Do companies have separate means of preventing the disclosure or misuse of confidential or commercially sensitive information?

Privacy is commonly acknowledged as a right of the individual, yet companies in Quebec may benefit from various mechanisms adopted to prevent the disclosure or the misuse of confidential or commercially sensitive information. Indeed, companies often rely on contractual agreements, non-disclosure agreements and trade secret protections to uphold the confidentiality of their proprietary information (Sébastien Jetté and Judith Robinson, La protection des secrets commerciaux en dehors de la relation employeur-employé, Développements récents en droit de la propriété intellectuelle 2003, p. 17). These legal tools enable companies to define and enforce boundaries concerning the use and dissemination of sensitive data, thereby safeguarding their competitive advantage, proprietary technologies and strategic plans. Through these means, companies can protect their interests while respecting both individual privacy rights and the imperative of maintaining business confidentiality.