Privacy Breaches - Compensable Under Law
Personal injury comes in many forms. Victims of intentional or unintentional wrongs can suffer a range of physical and emotional harms. Where such harms are suffered, the law permits compensation. For example, when a pedestrian is hit by a car while crossing a crosswalk, and is injured, he or she can seek damages from the driver. A victim of a sexual assault, who suffers emotional consequences like depression, is entitled to compensation from his or her attacker.
Entitlement to compensation for some injuries is less obvious. One such example is an invasion of privacy. Victims of privacy breaches often suffer emotional consequences, such as embarrassment, loss of confidence and degradation. A couple of months ago, the Ontario Court of Appeal released a decision that clarified whether such injuries, stemming from a breach of privacy, are compensable under law.
The defendant was a bank employee. Over a four year period she accessed the plaintiff's banking records more than 174 times. The accessed information included not only transaction details, but also address, date of birth, and marital status. No information had been published, distributed, or recorded by the defendant in any way. Other than the defendant being in a relationship with the plaintiff's ex-husband, it was not clear why she was viewing these records. She acted in breach of bank policy.
The plaintiff brought a claim for invasion of privacy and sought general and exemplary damages.
The Ontario Court of Appeal concluded that the plaintiff was entitled to damages for having suffered an invasion of privacy. The Court of Appeal confirmed the existence of a right of action for intrusion upon seclusion, stating:
For over one hundred years, technological change has motivated the legal protection of the individual's right to privacy. In modern times, the pace of technological change has accelerated exponentially. Legal scholars such as Peter Burns have written of "the pressing need to preserve 'privacy' which is being threatened by science and technology to the point of surrender" ... The internet and digital technology have brought an enormous change in the way we communicate and in our capacity to capture, store and retrieve information. As the facts of this case indicate, routinely kept electronic data bases render our most personal financial information vulnerable. Sensitive information as to our health is similarly available, as are records of the books we have borrowed or bought, the movies we have rented or downloaded, where we have shopped, where we have travelled, and the nature of our communications by cell phone, e-mail or text message.
The Court described the analysis that must be entered into in assessing the viability of a claim for intrusion upon seclusion:
I would essentially adopt as the elements of the action for intrusion upon seclusion the Restatement (Second) of Torts(2010) formulation which, for the sake of convenience, I repeat here:
One who intentionally intrudes, physically or otherwise, upon the seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the invasion would be highly offensive to a reasonable person.
The key features of this cause of action are, first, that the defendant's conduct must be intentional, within which I would include reckless; second that the defendant must have invaded, without lawful justification, the plaintiff's private affairs or concerns; and third, that a reasonable person would regard the invasion as highly offensive causing distress, humiliation or anguish. However, proof of harm to a recognized economic interest is not an element of the cause of action. I return below to the question of damages, but state here that I believe it important to emphasize that given the intangible nature of the interest protected, damages for intrusion upon seclusion will ordinarily be measured by a modest conventional sum.The Court found, on the facts of the case, the claim was made out - the intrusion was intention and it would be highly offensive to the reasonable person. In determining the level of damages the Court said:
Favouring a higher award is the fact that Tsige's actions were deliberate and repeated and arose from a complex web of domestic arrangements likely to provoke strong feelings and animosity. Jones was understandably very upset by the intrusion into her private financial affairs. On the other hand, Jones suffered no public embarrassment or harm to her health, welfare, social, business or financial position and Tsige has apologized for her conduct and made genuine attempts to make amends. On balance, I would place this case at the mid-point of the range I have identified and award damages in the amount of $10,000.
This recent decision is expected to have wide-reaching consequences in civil litigation, particularly in the area of class actions where company decisions can have privacy implications for large populations of people. The case represents the recognition of a common law privacy tort in Canada's largest province and is significant milestone in the development of this area of the common law.
