The common law tort of “intrusion upon seclusion” was incorporated into Ontario law in 2012 in the case of Jones v Tsige 2. On February 18, 2015, the Court of Appeal for Ontario held that the Personal Health Information Protection Act (PHIPA), Ontario’s health information specific privacy law, is not an exhaustive code and that plaintiffs are not precluded from asserting a common law claim on the basis of the tort, for a breach of privacy involving personal health information.
Intrusion On Seclusion In Ontario Law
In 2012, in the context of an action against a bank employee for reviewing the plaintiff’s confidential financial information without authorization and for the defendant’s personal reasons, the Court of Appeal imported the tort of intrusion on seclusion from American law into Ontario law. The plaintiff had no recourse under the Personal Information Protection and Electronic Documents Act (PIPEDA), the private sector privacy law applicable in Ontario. PIPEDA applies to the collection, use and disclosure of personal information in the course of a commercial activity. As such, it would have applied had the plaintiff chosen to proceed against the bank as the defendant’s employer, but not to an action against the defendant because the latter’s unauthorized activities were personal and not commercial in nature.
PHIPA affords individuals an avenue of recourse where their personal health information has been collected, used or disclosed by an unauthorized person or for an unauthorized purpose. Under PHIPA, a person may make a complaint to the Information and Privacy Commissioner of Ontario (IPC). The IPC has broad powers of investigation and order making authority under PHIPA. The authority extends to orders directed at health information custodians, such as hospitals, and any other person. Orders made by the IPC that have become final, when there is no further right of appeal, may be filed with the Court and on filing become enforceable as an order of the Court. Further, where the Commissioner has made an order that becomes final, a person affected by the order may commence a proceeding in the court for damages for actual harm that the person has suffered as a result of the contravention of PHIPA. Where the court makes a finding that the harm suffered by the plaintiff was caused by a contravention of PHIPA that the defendants engaged in wilfully or recklessly, the court may include in its award of damages an award not exceeding $10,000 for mental anguish.
The IPC has the discretion not to investigate and not to make an order, a discretion that the Court found was significant to its analysis of PHIPA and whether the tort of intrusion on seclusion should apply in circumstances where the plaintiff could seek redress under PHIPA.
Hopkins V. Kay
In Hopkins v. Kay, a patient of a hospital, on her own behalf and that of other patients in the “class”
proposed to be certified by the court, alleged that her hospital records had been accessed by hospital staff without consent or other authorization. The hospital acknowledged that members of its staff had accessed the records without lawful cause, apologized to the patients and took disciplinary action against the staff members.
Motion To Dismiss
The hospital brought a motion to have the action dismissed on the basis that the breach of privacy on which it is based falls squarely within the scope of PHIPA and that PHIPA is a comprehensive legislative scheme dealing specifically with personal health information. The hospital’s position was that PHIPA has “occupied the field” so that claims based on the common law tort of intrusion on seclusion are precluded by PHIPA.
On the basis of the Court of Appeal’s decision in Jones v Tsige, the motion judge held that it was not plain and obvious that PHIPA is a complete code precluding a common law action for breach of privacy where the information involved is personal health information. The hospital took the question to the Court of Appeal.
Appeal Of Decision Of Motion Judge
The Court of Appeal concluded, following a detailed analysis of the scheme established in PHIPA for the collection, use, disclosure and protection of personal health information, that an action for intrusion upon seclusion is available to the plaintiffs. The Court acknowledged that PHIPA is a “comprehensive set of rules about the manner in which personal health information may be collected, used, or disclosed across Ontario’s health care system”3. However, the Court found that the PHIPA does not contain detailed procedures or a detailed dispute resolution mechanism, leaving such details to the discretion of the IPC. The Court’s analysis was shaped by three factors identified by the Nova Scotia Court in the case of Pleau v. Canada (A.G.) 4:
- the process for dispute resolution established by the legislation and more specifically, whether it is consistent with exclusive jurisdiction, for example, whether it contains privative clauses ousting the jurisdiction of the court;
- the relationship between the nature of the dispute and the rights and obligations created by the overall scheme of the legislation, or put otherwise, the extent to which the dispute is regulated by the legislative scheme and the assumption of jurisdiction by the court would be consistent with that scheme; and
- whether the legislation affords the plaintiff effective redress.
On the first factor, the Court concluded that the complaints procedure in PHIPA is not designed for the resolution of all individual complaints and that PHIPA contemplates proceedings, relating to the unauthorized use or disclosure of personal health information, other than those provided for in PHIPA.
On the second factor, the Court concluded that permitting an action in tort for a privacy breach involving personal health information would not circumvent the restrictions and limitations imposed under PHIPA, including the requirement for an order of the IPC, to demonstrate actual harm, and within a proceeding to recover damages for actual harm, the limit on damages available for mental anguish. The Court was of the view that proving a breach of PHIPA is less onerous than making out a claim for intrusion on seclusion 5. Pending class actions alleging intrusion on seclusion based on unauthorized access to personal health information may determine whether the Court’s conclusion in this regard is correct.
On the third factor, the Court’s decision was influenced by the representations of the IPC in relation to how he intends to exercise his discretion to investigate and make orders. The IPC intervened on the appeal in support of the plaintiff’s position that an action in tort is available where a privacy breach involves personal health information. The IPC submitted that granting him exclusive jurisdiction over claims of individuals for breach of their privacy would impair his ability to focus on “prevention, containment, investigation and the systemic remediation of contraventions of PHIPA”.6 The Court decided that it cannot and should not ignore the IPC’s advice about how he intends to exercise his discretion. The Court concluded that it is likely that many individual complaints that could give rise to a claim in tort, will not be investigated or be the subject of an order of the IPC. The Court also concluded that even where the IPC elects to investigate, his objective is to address systemic issues, rather than provide an individual complainant with redress for the harm caused through the misuse of personal health information.
Broad Ranging Implications Of The Decision
The Court’s decision is significant on a number of levels. It permits civil actions in Ontario for breach of privacy involving personal health information, despite the avenue of redress specifically provided by the legislature in PHIPA. More particularly, it permits an action where the plaintiffs have not suffered actual damages as a result of a privacy breach, although the scope and limits on this new action remain to be determined.
More broadly, the decision raises questions about the type and amount of insurance that health care providers carry, the appropriate allocation of health care dollars and human resources in a publicly funded health care system, and the liability of health care providers for the intentional misconduct of staff members for personal motives if not gain. Some of these issues fall outside of the mandate of the IPC and jurisdiction of the courts. In this regard, the Court of Appeal’s decision is a significant addition to the ongoing discussion about the future of health care in Ontario and a decision of interest to all stakeholders in Ontario’s health care system.
1 2015 ONCA 112.
2 2012 ONCA 32. The supreme Court of Canada has yet to rule on whether the tort exists.
3 Supra note 1, para. 35.
4 1999 NSCA 159.
5 The three key elements of the tort of intrusion upon seclusion as stated by the Court of Appeal are: intentional (which includes recklessness) conduct by the defendant; the invasion, without lawful justification, by the defendant of the plaintiff’s private affairs or concerns; and a reason- able person would regard the invasion as highly offensive, causing distress, humiliation or anguish. Proof of actual harm is not an element.
6 Supra, note 1, para. 56.