A decision rendered on November 12, 2010, by Justice Phelan of the Federal Court (Steven v SNF Maritime Metal Inc, 2010 FC 1137) sheds some light on the types of damages an applicant can claim following a conclusion by the Privacy Commissioner of Canada (the “Commissioner”) that the Applicant had been the victim of a breach of privacy pursuant to the Personal Information Protection and Electronic Documents Act (“PIPEDA”).
The Applicant, employed by a third party (the “Employer”), was responsible for delivering scrap metal to the Respondents on behalf of the Employer. The Employer became concerned that its sales of scrap metal to the Respondent were below historical norms and, after communicating with the Respondent, the Employer learned that the Applicant maintained personal accounts for the sale of scrap metal to the Respondent. The Respondent provided the Employer with copies of records pertaining to the Applicant’s personal accounts, which revealed that the Applicant had been credited with, and received cash for, large quantities of scrap metal. The Applicant was dismissed from his employment.
The Applicant filed a complaint against the Respondent before the Commissioner, who held that the complaint was well-founded: the information contained in the Applicant’s personal account, which included his personal contact information and how much money he earned from the sale of scrap metal, qualified as personal information. Accordingly, the Applicant’s prior consent was required before the Respondent could disclose this information to the Employer.
The Applicant commenced proceedings pursuant to sections 14 and 16 of PIPEDA claiming damages resulting from the unauthorized disclosure of his personal information. In particular, he claimed damages associated with the loss of wages and with the loss of equity in his home and his automobile due to foreclosure resulting from his lower income.
The Court found that the source of the Applicant’s complaint was the loss of his employment and that the damages being claimed were directly tied to his termination. Even if the termination might not have occurred if there had not been a breach of privacy resulting from an unauthorized disclosure of his personal information by the Respondent, the nexus to the losses being claimed was the termination of employment, and not the privacy breach.
The Court added that: “The PIPEDA right of action is not an end run on existing rights to damages. It is a right to a different type of damages claim—breach of the right to privacy”.
The Court noted that to the extent that privacy was involved, it was minimal, and that the Applicant put forward no evidence to the effect that his standing in the community was negatively impacted or that other similar consequences which are features of a breach of privacy claim occurred. No damages were awarded.
This decision sheds light on the conditions applicable to the exercise of the right to remedies provided for by section 16 of PIPEDA. It would appear that the nexus between the damages sought and the breach of privacy must be very proximate. In other words, the recourse available pursuant to PIPEDA cannot be used as a vehicle to claim damages that are not a direct result of the breach of privacy.
This decision appears to narrow the scope of the types of damages available to claimants pursuant to section 16 of PIDEDA. Claims for such damages appear to be limited to damages that are caused to one’s reputation, those that may be associated with mental distress or anguish caused as a result of the breach or those resulting from actions which can be categorized as having been taken with a malicious intent to cause harm to the victim.