2011 FC, 2011 FC 1070

Federal Court Cour fédérale Date: 20110913 Docket: T-1687-10 Citation: 2011 FC 1070 Ottawa, Ontario , September 13, 2011 PRESENT: The Honourable Mr. Justice Mosley BETWEEN: YOLANDA GIRAO Applicant and ZAREK TAYLOR GROSSMAN HANRAHAN LLP Respondent REASONS FOR JUDGMENT AND JUDGMENT [ 1 ] The applicant, Mrs. Yolanda Girao, seeks remedies for a breach of privacy arising from the disclosure of her personal information contained in a letter and Report of Findings issued by the Privacy Commissioner of Canada which the respondent law firm posted on the firm’s website. Among other things, Mrs.

Girao seeks compensation in the amount of $5,000,000.00 for public humiliation and emotional damage. [ 2 ] This is an application under s.14 of the Personal Information Protection and Electronic Documents Act (“ PIPEDA ”), SC 2000, c 5 with regard to a complaint made to the Privacy Commissioner of Canada (“PCC”) on January 26, 2010. BACKGROUND: [ 3 ] Mrs. Girao represented herself on this application. She has been engaged in a long-standing dispute with the Allstate Insurance Company of Canada (“Allstate”) over entitlements to accident benefits arising from a 2002 automobile accident. Mrs.

Girao had received payment from Allstate under the Statutory Accident Benefits

Schedule - Accidents on or After November 1, 1996 (SABS), O Reg 403/96 to the Insurance Act , RSO 1990, c I.8, as amended, for various benefits and coverage of limited duration.

[ 4 ] Mrs. Girao sought a determination that she had suffered catastrophic impairment as a result of the accident which, if conferred, would have entitled her to extended benefits and increased coverage. An evaluation in June 2006 concluded that she did not meet the medical criteria for a catastrophic designation as defined in the SABS. Allstate denied payment of the catastrophic level benefits. Mrs. Girao applied for mediation before the Financial Services Commission of Ontario (“FSCO”) to resolve this and some related issues. The mediation was unsuccessful and Mrs. Girao applied for arbitration through FSCO.

The respondent law firm Zarek Taylor Grossman Hanrahan LLP (“ZTGH”) represents Allstate in those proceedings. [ 5 ] In preparation for the arbitration, a series of assessments were obtained by Mrs. Girao and Allstate from Ontario based medical professionals which disagreed as to the extent of the injuries she had suffered as a result of the accident. Allstate then sent the assessments to medical consultants in the United States for review as the criteria for assessing catastrophic impairment in Ontario are based on American Medical Association guidelines. In December 2007 Mrs.

Girao filed a complaint with the PCC against Allstate for disclosing her personal information to the consultants without her consent. [ 6 ] On February 23, 2009, the then Assistant Privacy Commissioner issued a Report of Findings declaring that the complaint was not well-founded (“the 2009 Report”). The report found that in the context of the FSCO proceedings, Allstate did not disclose the applicant’s personal information in a reckless manner.

By initiating an arbitration proceeding in which she put her personal medical history at issue, the complainant gave her implied consent for the collection, use and disclosure of her personal information. [ 7 ] The 2009 Report was mailed to Allstate’s solicitor ZTGH and to the applicant with a cover letter (“the 2009 decision letter”). At some time, thereafter, the PCC posted a

summary of the 2009 Report on its website to permit public access to the “lessons learned” from the claim without identifying the complainant or Allstate. [ 8 ] On or about February 28, 2009, Eric Grossman, a partner at ZTGH, directed his assistant to instruct ZTGH’s webmaster to post the 2009 Report on the ZTGH website containing his profile under the heading “Recent Decisions”. Mr. Grossman states in his affidavit that he did this because the decision was relevant and of interest to ZTGH’s clients. The webmaster posted both the 2009 Report and the 2009 decision letter to Allstate on the website.

The link to the page containing those documents identified the matter as “Girao v. Allstate Insurance” and referred to it as a “Privacy Complaint”. [ 9 ] In June 2009, Mrs. Girao filed a complaint with the PCC about surveillance conducted by a contractor retained by Allstate. In March 2010, the PCC issued a second decision in favour of Allstate finding that the surveillance did not exceed what would normally be expected in an insurance dispute. [ 10 ] On January 26, 2010, the PCC received a complaint from the applicant with respect to the posting of the 2009 Report and 2009 decision letter.

The applicant’s husband, Victor Mesta, had found the information on a commercial website based in the United States , www.docstoc.com, which collects and distributes documents related to a wide range of businesses including medical professionals. Mr. Mesta had visited the site in May 2009 looking for information about other cases involving Allstate’s U.S. consultants and the issue of catastrophic impairment. [ 11 ] Mr. Grossman learned of the complaint on or about February 26, 2010 upon receiving a call from a representative of the PCC .

He issued instructions for the immediate removal of the information from the firm’s web site. That was done within two hours of the matter being brought to his attention. [ 12 ] While the 2009 Report and letter were on the ZTGH website, the page received 247 unique visitors, that is from different web addresses, some of whom were from members of the firm. As of the date of the hearing, it appeared that the information remained on the American site. At that location, the page had been viewed some fourteen times prior to November 2010, including visits by the applicant’s husband and members of ZTGH.

There is no evidence of broader distribution or interest in the content. [ 13 ] In a decision dated September 28, 2010, Assistant Privacy Commissioner Chantal Bernier concluded that the applicant’s complaint against ZTGH was well-founded and resolved. In the Report of Findings (“the 2010 Report”) which accompanied the decision letter, the PCC noted that the 2009 decision letter sent to Ms. Girao and to Allstate contained her name. While the 2009 Report did not identify Mrs.

Girao by name, it did contain what the 2010 Report describes as her “personal information including details about various processes she had been involved in over the years to resolve a benefits dispute with Allstate.”

[ 14 ] The 2010 Report cited ZTGH’s explanation that its decision to post the 2009 Report was based on the belief that a report of finding issued by the PCC was a public document and was not any different than decisions made by tribunals. Paragraph 7 of the 2010 Report states that ZTGH was informed that Reports of Findings are not public documents to be accessed by the general public upon request and the complainant had not consented to disclosure of her personal information. [ 15 ] The issue before the PCC was whether ZTGH disclosed the complainant’s personal information without her consent.

At paragraph 11, the 2010 Report states the following: Although this Office does not consider the report of finding to be a public document, neither does the Act stipulate that the document is specifically to be treated as confidential. In my view, what is clear from the case at hand is that the report of finding sent to the two parties did contain the complainant’s personal information, whether appearing alongside the cover letter or not (the latter patently identifying her by name).

As ZTGH did not have the complainant’s consent to disclose her personal information, as required by Principle 4.3, it was in violation of this principle by posting the documents on its web site, where they could be read by anyone with access to the Web. [ 16 ] The PCC found that the complaint was resolved by the removal of the 2009 decision letter and the 2009 Report from the website. ISSUES: [ 17 ] Much of the applicant’s written and oral representations relates to the substance of Mrs. Girao’s first complaint to the PCC against Allstate.

The Notice of Application in this matter solely addresses the September 28, 2010 decision and Allstate was not a party to these proceedings. Accordingly, it is outside the scope of this Court’s jurisdiction under s. 14 of PIPEDA to revisit that matter at this time. [ 18 ] This application raises the following issues: 1. Did ZTGH breach the applicant’s privacy rights by posting the PCC ’s Report of Findings and cover letter on its website? 2. If so, is the applicant entitled to remedies including an award of damages? RELEVANT STATUTORY PROVISONS: [ 19 ]

Section 14 of the PIPEDA allows an individual to file an application in the Federal Court after having received a report from the PCC concerning a complaint: 14.

(1) A complainant may, after receiving the Commissioner’s report or being notified under subsection 12.2(3) that the investigation of the complaint has been discontinued, apply to the Court for a hearing in respect of any matter in respect of which the complaint was made, or that is referred to in the Commissioner’s report, and that is referred to in clause 4.1.3, 4.2,4.3.3, 4.4, 4.6, 4.7 or 4.8 of

Schedule 1, in clause 4.3, 4.5 or 4.9 of that

Schedule as modified or clarified by Division 1, in subsection 5(3) or 8(6) or (7) or in

section 10. 14.

(1) Après avoir reçu le rapport du commissaire ou l’avis l’informant de la fin de l’examen de la plainte au

titre du paragraphe 12.2(3), le plaignant peut demander que la Cour entende toute question qui a fait l’objet de la plainte — ou qui est mentionnée dans le rapport — et qui est visée aux articles 4.1.3, 4.2,4.3.3, 4.4, 4.6, 4.7 ou 4.8 de l’annexe 1, aux articles 4.3, 4.5 ou 4.9 de cette

annexe tels qu’ils sont modifiés ou clarifiés par la

section 1, aux paragraphes 5(3) ou 8(6) ou (7) ou à l’article 10. [ 20 ]

Section 16 of the PIPEDA gives the Court the authority to grant the applicant remedies, including damage awards, should the Court deem it just:

16. The Court may, in addition to any other remedies it may give, (

a) order an organization to correct its practices in order to comply with sections 5 to 10; (

b) order an organization to publish a notice of any action taken or proposed to be taken to correct its practices, whether or not ordered to correct them under paragraph ( a ); And (

c) award damages to the complainant, including damages for any humiliation that the complainant has suffered. 16. La Cour peut, en sus de toute autre réparation qu’elle accorde :

a) ordonner à l’organisation de revoir ses pratiques de façon à se conformer aux articles 5 à 10;

b) lui ordonner de publier un avis énonçant les mesures prises ou envisagées pour corriger ses pratiques, que ces dernières aient ou non fait l’objet d’une ordonnance visée à l’alinéa a );

c) accorder au plaignant des dommages- intérêts, notamment en réparation de l’humiliation subie. [ 21 ] Clause 4.3 in Principle 3 of

Schedule 1 of the PIPEDA sets out the principles in the national standard entitled Model Code for the Protection of Personal Information , CAN/CSA-Q830-96. Clause 4.3 is entitled “Consent” and reads as follows: The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

Toute personne doit être informée de toute collecte, utilisation ou communication de renseignements personnels qui la concernent et y consentir, à moins qu’il ne soit pas approprié de le faire. [ 22 ] A note following this Principle recognizes certain situations in which it may be legitimate to disclose information without an individual’s express consent:

Note: In certain circumstances personalinformation can be collected, used, ordisclosed without the knowledge and consentof the individual. For example, legal,medical, or security reasons may make itimpossible or impractical to seek consent.When information is being collected for thedetection and prevention of fraud or for lawenforcement, seeking the consent of theindividual might defeat the purpose ofcollecting the information. Seeking consentmay be impossible or inappropriate when theindividual is a minor, seriously ill, ormentally incapacitated.

In addition,organizations that do not have a directrelationship with the individual may notalways be able to seek consent. For example,seeking consent may be impractical for acharity or a direct-marketing firm that wishesto acquire a mailing list from anotherorganization. In such cases, the organizationproviding the list would be expected to obtainconsent before disclosing personalinformation. Note : Dans certaines circonstances, il estpossible de recueillir, d’utiliser et decommuniquer des renseignements à l’insu dela personne concernée et sans sonconsentement.

Par exemple, pour des raisonsd’ordre juridique ou médical ou pour desraisons de sécurité, il peut être impossible oupeu réaliste d’obtenir le consentement de lapersonne concernée. Lorsqu’on recueille desrenseignements aux fins du contrôled’application de la loi, de la détection d’unefraude ou de sa prévention, on peut aller àl’encontre du but visé si l’on cherche àobtenir le consentement de la personneconcernée. Il peut être impossible ouinopportun de chercher à obtenir leconsentement d’un mineur, d’une personnegravement malade ou souffrant d’incapacitémentale.

De plus, les organisations qui nesont pas en relation directe avec la personneconcernée ne sont pas toujours en mesured’obtenir le consentement prévu. Parexemple, il peut être peu réaliste pour uneoeuvre de bienfaisance ou une entreprise demarketing direct souhaitant acquérir une listed’envoi d’une autre organisation de chercherà obtenir le consentement des personnesconcernées. On s’attendrait, dans de tels cas,à ce que l’organisation qui fournit la listeobtienne le consentement des personnesconcernées avant de communiquer desrenseignements personnels.

ANALYSIS: Did ZTGH breach the applicant’s privacy rights by posting the Report of Findings and cover letter on its website? [23] The hearing in the Federal Court of an application under subsection 14(1) of the PIPEDA made after receipt of a report by thePCC is a de novo review of the Commissioner’s findings and recommendations: Randall v Nubodys Fitness Centres, 2010 FC 681 atpara 32; Mirza Nammo v Transunion of Canada Inc., 2010 FC 1284 at para 28.

What is at issue is not the Commissioner’s report, but theconduct of the party against whom the complaint is filed: Englander v Telus Communications Inc., 2004 FCA 387 at paras 47-48. [24] Here the applicant submits that the respondent has breached her privacy rights as they are protected under the PIPEDA.Generally speaking, privacy “connotes concepts of intimacy, identity, dignity and integrity of the individual”: Canada (Information Commissioner) v Canadian Transportation Accident Investigation & Safety Board, 2006 FCA 157, [2007] 1 FCR 203, 49 CPR (4th) 7 atpara 52.

Privacy may also be understood as “the right of the individual to determine for himself when, how, and to what extent he willrelease personal information about himself”: R. v Duarte, (SCC), [1990] 1 SCR 30, 1990 CarswellOnt 77 at para 27. [25] The information contained in the 2009 Report included the following: • The complaint that Allstate had disclosed the applicant’s personal information to a third party without her consent; • A

summary of the PCC investigation which outlined the background to the proceedings in which the complainant sought extendedbenefits and coverage; • A

summary of the medical assessments obtained for the mediation and arbitration proceedings; • A discussion of the PIPEDA principles which applied to the complaint; • The findings and conclusion which held the complaint to be “not well-founded”. [26] Much of this information also appears in the

summary posted by the PCC on its website, presumably with the consent of the

applicant. [ 27 ] The respondent submits that the only i nformation which was posted on their website that is personal information is the applicant’s name. No other identifying information such as her address was posted. The respondent submits that the applicant’s consent was not required for the posting of the 2009 Report and letter because such documents should be considered to be public in nature.

If consent was required, the respondent submits, it should be implied given the applicant’s involvement in related litigation in which the same and even more information about the applicant’s history has been made public on several occasions. [ 28 ] The respondent submits that the posting of the documents involved the disclosure of information which a reasonable person would consider appropriate in the circumstances.

This, the respondent submits, is consistent with Section 5(3) of PIPEDA : An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. L’organisation ne peut recueillir, utiliser ou communiquer des renseignements personnels qu’à des fins qu’une personne raisonnable estimerait acceptables dans les circonstances. [ 29 ] The respondent filed evidence of a Decision and Order concerning the applicant’s arbitration in the FSCO.

The FSCO published the Decision and Order on its website without redacting the applicant’s personal information including her medical history, details of the legal proceedings in which she is engaged or her name. In the present application, the applicant has also filed information of a more sensitive nature than that which appears in the 2009 Report, including a psychiatric report, without requesting that it be kept confidential. When asked about this, Mrs.

Girao stated that she was not concerned about the details of her personal history being made public but with the appropriation and use of her personal information by ZTGH without her consent. [ 30 ] Mrs. Girao acknowledges that what is published on the FSCO website and other litigation in which she is involved, including the public record of this proceeding, reveals much more about her than does the PCC report that was posted on the respondent’s website.

The difference, she submits, is that she went into the other litigation and this application knowing that her personal information would be publicly accessible and consented to its disclosure in those forums. She gave no similar consent to the disclosure of the 2009 Report regarding her complaint against Allstate to ZTGH. [ 31 ] The applicant contends that it is irrelevant that she has willingly disclosed the information about her dispute with Allstate and her medical history in other proceedings that are public in nature including this application.

She says that the 2009 Report and 2009 decision letter contained her personal information and her consent was required to disclose it in any other forum or context. [ 32 ] The scope of what constitutes “personal information” is not clear from the Act and the jurisprudence. The meaning of the term was discussed by the Federal Court of Appeal in Canada (Information Commissioner) v Canada (Transportation Accident Investigation and Safety Board) 2006 FCA 157 at paragraph 43 in the context of proceedings under the Privacy Act and the Access to Information Act .

What I draw from that decision and the authorities cited therein, is that information is personal if it is “about” an identifiable individual. A person will be identifiable if the information disclosed, together with other publicly available information, would tend to or possibly identify them. Here there could be no doubt that the information in the 2009 Report was “about” Mrs. Girao and her complaint against Allstate as she was named in the decision letter.

In that respect, it was personal information falling within the scope of PIPEDA , as the PCC found. [ 33 ] It was suggested during the hearing by counsel for the respondent that this application constituted a collateral attack by Mrs. Girao on ZTGH and, in particular, Mr. Grossman, because of their defence of Allstate’s interests in the insurance litigation. While the tone of Mrs. Girao’s representations indicate that there may be some substance to that concern, the motivation of the applicant in a PIPEDA review is not relevant: Waxer v J.J.

Barnicke Limited , 2009 FC 170 at para 28 ; Wyndowe v Rousseau , 2008 FCA 39 at para 9 . If a breach of the statute is made out, she is entitled to redress regardless of her motivation. [ 34 ] The respondent submits that the Commissioner’s position that its reports are confidential is inconsistent with the open court principle and the duty to give reasons as it is applied in judicial and quasi-judicial proceedings. It is apparent that ZTGH treated the report as a decision similar to those made by tribunals in adversarial proceedings.

Such reports, the respondent contends, should be publicly accessible to inform those subject to PIPEDA , and their legal advisors, of the scope of the statute’s reach so they may govern their affairs or advise their clients accordingly. The respondent relies on the PCC’s acknowledgment at paragraph 11 of the 2010 Report that there is nothing in PIPEDA stating that PCC reports are confidential and are to be withheld from the public. [ 35 ] The 2009 Report was a matter of some significance in the area of insurance litigation. The PCC posted a three-page

summary of the report on its website to inform the public about the operation of the statute and the work of the office. That does not mean that the inquiry conducted by the PCC involves the type of openness that is characteristic of the work of courts and tribunals in our system.

Indeed, s. 20(1) of the PIPEDA requires that the Commissioner and her staff not disclose any information that comes to their knowledge in the exercise of their duties, subject to certain specified exceptions including the duty to report to the audited organizations. [ 36 ] What can then be done with those reports is unclear. As noted, PIPEDA does not deal with that question. I expect that they receive fairly wide distribution within the audited organizations and the legal community to improve compliance and inform legal advice.

The reports are written by the PCC staff without reference to personal identifiers such as name and address. But the information contained in the reports, together with other publicly available information, may lead to the identification of the complainant and to the disclosure of the complainant’s personal information without consent. [ 37 ] The non-consensual disclosure of personal information respecting complainants under PIPEDA is inconsistent with the intent of the legislation to promote privacy interests.

That intent is compatible with the legitimate interest of the public to obtain information about PCC decisions. Those interests can be accommodated by the preparation of anonymized summaries such as the PCC posted on its website. [ 38 ] In choosing to publish the 2009 Report to provide information to the industry and profession, the onus was on the respondent to ensure that they did not disclose personal information about the complainant without her consent. They were reckless in failing to ensure that Mrs.

Girao was not identifiable in the posting. [ 39 ] I conclude, therefore, that the PCC properly found that there had been a breach of the statute by the publication of the applicant’s personal information on the respondent’s website without her consent. Is the applicant entitled to remedies including an award of damages? [ 40 ] The applicant seeks the following remedies: • That the respondent be required to post an apology to the applicant on its website for one year for not complying with principle 4.3 under

Schedule 1 of the PIPEDA ; • That the respondent be required to post on its website for one year the 2010 Report and cover letter; • That the respondent pay to the applicant $5,000,000.00 in compensation for the public humiliation suffered and for the emotional damage she has suffered as a result of the breach. [ 41 ] Mrs. Girao contends that Mr. Grossman posted the 2009 Report and decision letter for ZTGH’s and his personal economic gain, that the action was deliberate, that it caused her great public humiliation and put her mental health in jeopardy.

She submits that ZTGH should compensate her by an amount roughly equivalent to the firm’s earnings for the length of time during which her personal information was posted on their website. [ 42 ] In Randall , above at paragraph 55 , I expressed the view that an award of damages under s. 16 of PIPEDA should only be made in the most egregious situations. In that case, I was satisfied that the breach which occurred was the result of an unfortunate misunderstanding between the parties that had been resolved by the remedial action taken by the respondent and did not call for damages.

In Nammo , above, Justice Russell Zinn awarded damages of $5000.00 for a breach that was serious in nature involving financial information of high personal and professional importance. [ 43 ] In determining the damages to be awarded, Justice Zinn acknowledged the quasi-constitutional nature of privacy rights in Canada and referred to the Supreme Court’s recent damages analysis from Vancouver (City) v Ward, 2010 SCC 27 .

In that case the Supreme Court pointed to three rationales for awarding damages for breaches of The Canadian Charter of Rights and Freedoms : compensation, deterrence and vindication. [ 44 ] With respect to the compensatory rationale, the Supreme Court observed at paragraph 48 of Ward that “ the concern is to restore the claimant to the position she would have been in had the breach not been committed … As in a tort action, any claim for compensatory damages must be supported by evidence of the loss suffered.” According to this rationale, demonstrable losses suffered by the applicant as a result of the disclosure of her personal information could be compensated by an award of damages under s. 16 of PIPEDA .

[45] The Court in Ward went on in paragraph 51 to characterize an award of damages pursuant to the deterrence and vindicationrationales as “an exercise in rationality and proportionality”. Chief Justice McLachlin observed at para 52 that “[a] principal guide to thedetermination of quantum is the seriousness of the breach, having regard to the objects of s. 24(1) damages.

The seriousness of thebreach must be evaluated with regard to the impact of the breach on the claimant and the seriousness of the state misconduct”. [46] At paragraph 76 of Nammo Justice Zinn sets out certain non-exhaustive factors that could be applied to PIPEDA applicationsfor damages before this Court: • Whether awarding damages would further the general objects of PIPEDA and uphold the values it embodies; • Whether damages should be awarded to deter future breaches; and • The seriousness or egregiousness of the breach. [47] In assessing the seriousness of the breach in question, Justice Zinn took into account the following considerations in hisanalysis at paragraphs 68-71 of Nammo: The impact of the breach on the health, welfare, social, business or financial position of the applicant;The conduct of the respondent before and after the breach;Whether the respondent benefited from the breach. [48] Other factors that may be relevant to the seriousness of the breach include: The nature of the information at stake;The nature of the relationship between the parties;Prior breaches by the respondent indicating a lack of respect for privacy interests. [49] In this case, the information was personal but not highly sensitive.

I accept that the breach here was an isolated incident.There is nothing on the record that suggests the documents were posted maliciously or with the intent to cause harm. See: Hill v Churchof Scientology of Toronto, (SCC), [1995] 2 SCR 1130 at para 196. Nor is there any evidence of repeated violations ofprivacy interests by the respondents.

However, the disclosure was in a form that implicates the statutory scheme itself in that it related toa PCC investigation and report of findings. [50] Parliament has ensured that Canadians have the right to file complaints with the PCC for investigation without fear of havingtheir personal information disclosed other than in certain constrained circumstances. That right should be protected by the Courts. Tothat end, an award of damages would further the general objects of PIPEDA and uphold the values it embodies.

A damage award wouldalso send the message to lawyers and individuals with increased public responsibility that they must proceed prudently when dealingwith private information. [51] In considering the relationship between the parties, there is an obvious imbalance between a self-represented litigant and a lawfirm. However, the applicant is not unfamiliar with the legal process. She has represented herself in a civil action before the SuperiorCourt of Justice since 2008. Mrs.

Girao previously had legal assistance to advance her insurance claims but informed the Court that sheno longer has confidence in the profession due to disputes with her former solicitors. [52] At the time the breach occurred, Mrs. Girao was engaged in adversarial proceedings with a third party represented by therespondent. Thus, while her motivation in making complaints to the PCC may be irrelevant in so far as her entitlement to remedies for abreach of her privacy interests is concerned, animus against the respondent may bear on the quantum of any damages that the Court mayaward.

I inferred from her impassioned oral representations that Mrs. Girao’s sense of grievance relates more to the actions of Allstate indenying coverage than to the disclosure of her personal information. But it was also clear that she bears considerable animus towardsZTGH and Mr. Grossman in particular, for their

part in denying her what she believes to be her rightful benefits. [53] Law firms providing advice to clients who deal with the personal information of their customers must be knowledgeableabout privacy law and the risks of disclosure. Lawyers also have a public duty to protect the integrity of the legal process. The failure oflawyers to take measures to protect personal information in their possession may justify a higher award than that which would beimposed on others who are less informed about such matters.

[ 54 ]

Section 16 of PIPEDA provides no guidance as to the quantum of damages that may be granted. Here the applicant is claiming that she suffered mental anguish as a result of the breach. In calculating what might be an appropriate amount to award for such harms, it may be useful to refer to relevant provincial legislation.

Section 65 of the Ontario Personal Health Information Act , 2004, SO 2004, c 3, Sch A , may be of assistance in this context as it deals with the protection of medical information. Under that provision, the Superior Court of Justice may award damages, not exceeding $10, 000.00 for mental anguish resulting from the willful or reckless contravention of the statute. [ 55 ] In some cases, such as Nammo , a damages award may also be used to compensate a complainant for economic loss and expense incurred in dealing with the consequences of the breach.

Here, the respondent points to the lack of any evidence in the applicant’s record that would support a finding that she had suffered any damages as a result of the posting. The respondent submits that the posting of the 2009 Report has not attracted adverse attention to the applicant in any way that would sustain a claim of damages. I agree that the record does not establish that the applicant suffered humiliation as a result of the breach. [ 56 ] The applicant asserts that her mental health was seriously affected.

The record before me does not make a connection between the treatment she is presently undergoing and the disclosure of the personal information. The one medical report filed is from a psychiatrist dated April 4, 2008; almost one year before the 2009 Report and letter were posted. The letter speaks to the applicant’s psychological condition and treatment as it related to the car accident, and not in any way to the subsequent disclosure of her personal information. [ 57 ] According to an exhibit attached to Mrs. Girao’s affidavit, her husband became aware of the ZTGH posting as early as May 2009. Mrs.

Girao referred to it in a letter to a PCC investigator in August 2009, presumably while the first complaint was under review. No steps were taken to inform ZTGH of this prior to the PCC’s call to Mr. Grossman in February, 2010. The information thus remained on the ZTGH website for a much longer period than might have been the case if the firm had been notified in a timely manner. It is not clear when it first appeared on the US website. [ 58 ] The evidence is that 247 persons accessed the information on the ZTGH site prior to the filing of the complaint, including members of the firm itself.

I expect that most of those persons would have been interested in the legal issues arising from the case and not in Mrs. Girao’s personal information. While the 2009 Report may still be accessed at the U.S. site and could be disseminated further by visitors to that site, the evidence indicates that the traffic to that page was minimal.

In any event, there is nothing before me to indicate that there would be any broader interest in the applicant’s personal information or that it has been used in any way to cause any adverse effects to her health and welfare. [ 59 ] There is no evidence before me that the respondent posted the information for economic gain. Mr. Grossman saw the 2009 Report to be an important precedent in the domain of insurance defence litigation and posted it on his firm’s website to inform their clients and others about the development of the law in that field.

It is a common business practice for law firms to post such information. Success achieved by the firm in litigation may help to retain or attract clients. But there is no basis in law upon which Mrs.

Girao would be entitled to an accounting of any benefits that may have flowed to ZTGH from the publication of the 2009 Report even if the value of such benefits could be calculated, which is unlikely. [ 60 ] The nature of this breach fits somewhere at the low end between the breach committed in Randall : “the result of an unfortunate misunderstanding”; and that which was committed in Nammo : a “serious breach involving financial information of high personal and professional importance”. That is not the case here.

While the information related to her claim for increased benefits, there was no disclosure of her financial status. The applicant submitted evidence of her current limited income on this application, but there is no evidence that this is due to the disclosure of her personal information or that she has missed opportunities to earn income as a result. [ 61 ] The respondent was careless in posting but did not act in bad faith. ZTGH deleted from its website all references to the applicant as soon as it became aware that there was a concern.

The law firm was negligent in not taking steps to ensure that any personal information about an identifiable complainant was removed before it posted the report. In the result I consider it appropriate to make an award of $1500.00. [ 62 ] As for the other remedies sought by the applicant, I see no present purpose in requiring the respondent to post an apology or the PCC 2010 decision on the firm’s website. I note that this decision will be posted on the Court’s website and will be accessible indefinitely. That may have a greater effect in promoting adherence to the objects of the legislation.

[ 63 ] The applicant seeks her costs of this application. There is no evidence before me of any expenses incurred by the applicant other than that disclosed by the Court record, or, of foregone remuneration. I note that a motion to proceed in forma pauperis was denied because no evidence of assets was filed. Nonetheless, I think it appropriate to award the applicant a modest lump sum of $500.00 to cover her out of pocket expenses. See AZ Bus Tours v. Tanzos 2009 FC 1134 at para.49.

JUDGMENT THIS COURT’S JUDGMENT is that 1. the application for review of the Report of Findings by the Privacy Commissioner of Canada is granted; 2. the respondent shall pay the applicant $1500.00 in damages for the disclosure of her personal information ; and 3. the respondent shall pay the applicant $500.00 for her costs in bringing this application. “Richard G. Mosley” Judge FEDERAL COURT SOLICITORS OF RECORD DOCKET: T-1687-10 STYLE OF CAUSE: YOLANDA GIRAO and ZAREK TAYLOR GROSSMAN HANRAHAN LLP PLACE OF HEARING: Toronto, Ontario DATE OF HEARING: June 14, 2011 REASONS FOR JUDGMENT AND JUDGMENT: MOSLEY J.

DATED: September 13, 2011

APPEARANCES : Yolanda Girao FOR THE APPLICANT (Self-represented litigant) Dennis O’Leary FOR THE RESPONDENT SOLICITORS OF RECORD : YOLANDA GIRAO Mississauga , Ontario FOR THE APPLICANT (Self-represented litigant) DENNIS O’LEARY Aird & Berlis LLP Toronto, Ontario FOR THE RESPONDENT