Lawyers and law firms face a higher standard in dealing with personal information, according to the counsel for an insurance defence firm rebuked by a Federal Court judge for breaching the privacy of an opposing litigant on a web site posting.
Toronto-based Zarek Taylor Grossman Hanrahan LLP was ordered to pay Yolanda Girao $1,500 plus $500 in costs after Federal Court Justice Richard Mosley found the firm had disclosed her personal information by posting a report of findings by the privacy commissioner of Canada alongside a covering letter that identified her as the applicant.
The law firm acted for the respondents in the privacy case, the Allstate Insurance Co. of Canada. Aird & Berlis LLP partner Dennis O’Leary represented the respondent in the Federal Court proceeding.
“The message to lawyers is that they should exercise a greater degree of caution because it’s clear law firms will be held to a higher, perhaps a much higher, level of care,” O’Leary says.
“It was an inadvertent breach, but technically, the judge found there was one and therefore made the finding and there was a tiny slap on the wrist for damages. They obviously would have preferred there to be no finding but they accepted it and haven’t appealed.”
Girao had asked for $5 million in damages for “public humiliation and emotional damage” as a result of the breach, but Mosley found there was no evidence to support those claims.
Instead, he said in his Sept. 13, 2011, judgment that the information released without her consent was “personal but not highly sensitive” and that the breach was an isolated incident.
“The respondent was careless in posting but did not act in bad faith,” he wrote.
Still, a damage award, Mosley said, would “send the message to lawyers and individuals with increased public responsibility that they must proceed prudently when dealing with private information.”
He continued: “Law firms providing advice to clients who deal with the personal information of their customers must be knowledgeable about privacy law and the risks of disclosure. Lawyers also have a public duty to protect the integrity of the legal process.”
Girao’s dispute with Allstate dates back to a 2002 car accident. Allstate made a payment related to the crash, but Girao went after a declaration that she had suffered catastrophic impairment, something that would have increased her entitlement.
Allstate refused to increase the benefits based on a 2006 assessment that indicated she didn’t meet the threshold for catastrophic impairment. The case then went to arbitration, at which point Allstate retained Zarek Taylor Grossman Hanrahan.
Before the arbitration, Girao underwent a number of assessments performed by medical professionals in Ontario. Allstate sent the reports to the United States for review by medical consultants there with expertise in designations for catastrophic impairment.
That prompted Girao to file a complaint with the privacy commissioner in December 2007 against Allstate for disclosing her personal information to the consultants without her consent.
In a February 2009 report of findings, the privacy commissioner found Girao’s complaint wasn’t well founded and that her consent was implied based on the fact that she had initiated the arbitration that put her medical history at issue.
Believing it was a notable decision, Zarek Taylor Grossman Hanrahan posted the privacy commissioner’s report on its web site.
“They are an insurance boutique firm and their clients are some of the big insurers, so this is something that’s of interest to them,” says O’Leary.
“If she hadn’t been deemed to have given consent, it would have turned the practice on its ear because all of a sudden, all the defendants and insurers would have to go out and get the permission of the plaintiff basically to do a defence medical.”
The privacy commissioner’s office also posted an altered summary of the report on its own web site, but Girao complained to it again about the law firm’s version because it identified the parties involved as Girao versus Allstate Insurance.
This time, the privacy commissioner sided with Girao and Mosley agreed.
“In choosing to publish the 2009 report to provide information to the industry and profession, the onus was on the respondent to ensure that they did not disclose personal information about the complainant without her consent,” wrote Mosley.
Girao’s husband discovered the law firm’s posting in May 2009, but she didn’t launch her complaint about it until January 2010. In the intervening period, Girao had advanced another complaint to the privacy commissioner about Allstate’s surveillance of her.
The office later dismissed that case.
During arguments, O’Leary suggested Girao’s application was a collateral attack on the law firm and partner Eric Grossman because of his defence of Allstate’s interests in the insurance litigation.
But Mosley ruled Girao’s motivations were irrelevant to his decision on whether a breach had occurred but did take them into consideration in his assessment on the amount of damages she was entitled to.
“I inferred from her impassioned oral representations that Mrs. Girao’s sense of grievance relates more to the actions of Allstate in denying coverage than to the disclosure of her personal information,” wrote Mosley.
“But it was also clear that she bears considerable animus towards [the law firm] and Mr. Grossman in particular, for their part in denying her what she believes to be her rightful benefits.”
The law firm didn’t learn there was an issue with its posting until February when the privacy commisioner’s office contacted it and had it removed within two hours.
O’Leary believes the firm’s fast action was a factor in the small size of the award against it.
