Many civil litigation files involving a significant amount of documentation contain personal information not necessarily relevant to the case. Given the legislative context for privacy law in Canada, the presence of that information can, according to the Supreme Court of Canada, raise significant privacy issues.
The Personal Information Protection and Electronic Documents Act “is complex and so broadly worded that a reasonable argument could be made to extend its reach so far as to transform both civil and criminal litigation into something very different than it is today,” the court observed in
Canada (Privacy Commissioner) v. Blood Tribe Department of Health.Because lawyers are subject to PIPEDA, the legislation has the potential to significantly affect how parties and their counsel may collect, use, and disclose personal information in litigation.
As the federal privacy commissioner noted in
Privacy Handbook for Lawyers: PIPEDA and Your Practice, no general litigation exemption exists in the act (although such an exemption does appear in provincial privacy legislation in Alberta, British Columbia, and Quebec).
“It thus falls to counsel to consider the extent to which his or her freedom to collect, use, and disclose personal information is limited by PIPEDA and the rights it vests in individuals to control collection, use, and disclosure of their information,” says Patrick Flaherty of Torys LLP’s Toronto office.
Making that decision is particularly difficult because, unlike the privacy commissioner, courts have leaned towards leaving information gathering for litigation purposes unfettered by PIPEDA.
For example, in
Ferenczy v. MCI Medical Clinics, a medical malpractice case, the plaintiff objected to the introduction into evidence of a surveillance video taken by an investigator retained by the defendant’s insurer. The plaintiff argued the surveillance amounted to collection of personal information in a commercial context without her consent in violation of PIPEDA.
But the Ontario Superior Court of Justice ruled that merely hiring an investigator to collect information didn’t by itself constitute a “commercial activity” as per the definition in PIPEDA. Rather, where the purpose of hiring the investigator was to defend a civil action, the information collected was for a “personal or domestic” purpose exempted by the statute.
The Federal Court reinforced this view in
State Farm Mutual Automobile Insurance Co. v. Privacy Commissioner of Canada.“The collection of information in order to properly defend a civil tort action has little or nothing to do with the purposes for which PIPEDA was enacted,” the court stated, noting that the legislation applied only where the “primary activity or conduct at hand” was a commercial activity.
But issues with PIPEDA’s application to litigation remain.
“The privacy commissioner of Canada has expressed the view that both
Ferenczy and
State Farm should not necessarily be viewed as authority that PIPEDA does not apply to litigation generally, particularly since both cases were decided in the factual context of activities in defence of personal injury claims against individuals, which is said to be different than, for example, litigation by or between commercial organizations,” Flaherty notes.
It may also be significant that the facts in
Ferenczy and
State Farm related only to the collection and not the use or disclosure of information.
“While it could be argued on the basis of the reasoning in
Ferenczy and
State Farm that PIPEDA has no application to use or disclosure of personal information in civil litigation, use and disclosure has not been specifically addressed in the case law,” says Flaherty.
“Moreover, the federal privacy commissioner has entertained complaints by individuals about the use and disclosure of personal information in litigation and has not applied the same reasoning in
Ferenczy and
State Farm about the scope of commercial activity.”
As well, while PIPEDA does provide that consent isn’t necessary for the collection of personal information to investigate a breach of an agreement or a contravention of law, Canada’s assistant privacy commissioner has ruled that this exception doesn’t extend to an investigation for the purpose of litigation.
Still, David Young of McMillan LLP’s Toronto office expects lawyers will continue to search for creative ways to block the admission of evidence on privacy grounds.
“In the last decade, this type of ancillary activity on the privacy front has overshadowed direct claims for breach of privacy,” he says.
But creative lawyering aside, PIPEDA does provide for disclosure without consent for certain purposes, such as debt collection.
“Whether an action for damages falls within the scope of this exemption has not been clearly dealt with, but in principle there is no reason why it should not,” says Flaherty.
Consent is also not necessary where obtaining it would compromise the availability or accuracy of the information, and, as noted earlier, where the collection is reasonable for the purposes of investigating the breach of an agreement or a contravention of Canadian or provincial laws.
Finally, disclosure without consent is permissible where necessary to comply with court orders or the rules of the court, including those related to production.
“The privacy commissioner has demonstrated a fairly liberal approach to the scope of production required for this type of compliance,” says Flaherty.
But even relevant documentation, whether in electronic form or otherwise, may include materials that contain personal information not related to the litigation.
Redacting the personally sensitive information is the recommended course for those wanting to follow best practices. But that’s easier said than done.
“Where the litigation involves terabytes of data, cost can become a serious issue,” says Flaherty.
“If it is expected that there could be significant privacy issues with production of documents, particularly in voluminous e-discovery, counsel should consider whether the discovery plan and court order implementing it should deal specifically with issues concerning personal information, including whether redaction is or is not required.”
