NICOLE LANDRY Applicant v. ROYAL BANK OF CANADA, 2011 FC 687

Federal Court Cour fédérale Date: 20110614 Docket: T-245-10 Citation: 2011 FC 687 [UNREVISED ENGLISH CERTIFIED TRANSLATION] Ottawa, Ontario, June 14, 2011 PRESENT: The Honourable Mr. Justice Scott BETWEEN: NICOLE LANDRY Applicant and ROYAL BANK OF CANADA Respondent REASONS FOR JUDGMENT AND JUDGMENT [ 1 ] This is an application for an order to pay damages under sections 14 and 16 (

c) of the Personal Information Protection and Electronic Documents Act , SC 2000, c 5 (the “Act”), by Nicole Landry (the “applicant”), following the disclosure of information concerning her personal accounts at a branch of the Royal Bank of Canada (the “respondent”). Under

section 14 of the Act, this is a trial de novo ( Nammo v TransUnion of Canada Inc. , 2010 FC 1284 , at paragraph 28 [ Nammo ] ). A. FACTS [ 2 ] The applicant was with the respondent’s branch at 1875 Notre-Dame Street, L’Ancienne-Lorette, Quebec. On December 3, 2007, in connection with the applicant’s divorce proceeding, the respondent received a subpoena duces tecum from Julie Arsenault, counsel for the applicant’s husband, Jean-Paul Racine.

The subpoena ordered Josette Bouchard, an employee of the applicant’s L’Ancienne-Lorette branch, to appear personally before the court and to bring certain documents concerning the applicant’s personal accounts. [ 3 ] The subpoena was given to the respondent’s Client Support Centre so that the necessary research could be carried out and the requested documents could be compiled. Under the respondent’s internal policies and procedures, consent is required from the account holder before the bank can disclose personal and confidential information.

The requested documents were forwarded to the branch, with the instructions not to disclose them before having obtained the applicant’s consent. The instructions sent to the branch also

specified that should consent not be received from the account holder, the person named in the subpoena would have to appear before the court and bring the required documents. The respondent allegedly sent the applicant a consent form on December 4, 2007. The applicant submits that she never received the form. [ 4 ] On December 5, 2007, Ms. Bouchard, a clerk for the respondent, faxed the copies of the applicant’s itemized bank statements to Ms. Arsenault, despite not having received the applicant’s consent.

The applicant’s credibility was called into question during the divorce proceeding before the Superior Court, given her inability to answer questions about her personal accounts at the Royal Bank. The applicant claims that she complained about this situation to Ms. Bouchard, who denies any knowledge of the incident despite subsequent evidence to the contrary.

She allegedly also told her that she would file a complaint about the matter. [ 5 ] On April 23, 2009, the respondent received a letter from Joan Riznek, an investigator with the Office of the Privacy Commissioner of Canada, informing it of the complaint filed by the applicant. The respondent claims that it only found out that information had been sent to Ms. Arsenault upon receipt of this letter. The respondent then allegedly conducted an internal investigation. A branch employee had sent the information to Ms.

Arsenault; the respondent allegedly only found out who the employee—namely, Ms Bouchard—was when it received the applicant’s affidavit, together with the fax cover page. The latter document clearly establishes that the respondent’s clerk, Ms. Bouchard, had sent the information to Ms. Arsenault, thereby directly breaching Bank policy and procedure. [ 6 ] Since its internal investigation had not identified the employee at fault, the respondent held a refresher session for the employees responsible for [ translation ] “processing requests from third parties”.

The respondent gave the Office of the Privacy Commissioner of Canada a letter describing its policies and procedures applicable upon receipt of a subpoena, the investigation it conducted into the applicant’s case, and the corrective measures it took to prevent such an incident from happening again. [ 7 ] The report of the Office of the Privacy Commissioner dated January 13, 2010, found that the applicant’s complaint was well founded and that it had been resolved. B. RELEVANT PROVISIONS [ 8 ] The following sections of the Act are relevant: Application 14.

(1) A complainant may, after receiving the Commissioner’s report or being notified under subsection 12.2(3) that the investigation of the complaint has been discontinued, apply to the Court for a hearing in respect of any matter in respect of which the complaint was made, or that is referred to in the Commissioner’s report, and that is referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 or 4.8 of

Schedule 1, in clause 4.3, 4.5 or 4.9 of that

Schedule as modified or clarified by Division 1, in subsection 5(3) or 8(6) or (7) or in

section 10. Demande 14.

(1) Après avoir reçu le rapport du commissaire ou l’avis l’informant de la fin de l’examen de la plainte au

titre du paragraphe 12.2(3), le plaignant peut demander que la Cour entende toute question qui a fait l’objet de la plainte - ou qui est mentionnée dans le rapport - et qui est visée aux articles 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 ou 4.8 de l’annexe 1, aux articles 4.3, 4.5 ou 4.9 de cette

annexe tels qu’ils sont modifiés ou clarifiés par la

section 1, aux paragraphes 5(3) ou 8(6) ou (7) ou à l’article 10.

Time of application

(2) A complainant must make an application within 45 days after the report or notification is sent or within any further time that the Court may, either before or after the expiry of those 45 days, allow. Délai

(2) La demande est faite dans les quarante-cinq jours suivant la transmission du rapport ou de l’avis ou dans le délai supérieur que la Cour autorise avant ou après l’expiration des quarante- cinq jours. For greater certainty

(3) For greater certainty, subsections (1) and (2) apply in the same manner to complaints referred to in subsection 11(2) as to complaints referred to in subsection 11(1). Précision

(3) Il est entendu que les paragraphes (1) et (2) s’appliquent de la même façon aux plaintes visées au paragraphe 11(2) qu’à celles visées au paragraphe 11(1). Remedies 16. The Court may, in addition to any other remedies it may give, Réparations 16. La Cour peut, en sus de toute autre réparation qu’elle accorde : (

a) order an organization to correct its practices in order to comply with sections 5 to 10;

a) ordonner à l’organisation de revoir ses pratiques de façon à se conformer aux articles 5 à 10; (

b) order an organization to publish a notice of any action taken or proposed to be taken to correct its practices, whether or not ordered to correct them under paragraph ( a ); and

b) lui ordonner de publier un avis énonçant les mesures prises ou envisagées pour corriger ses pratiques, que ces dernières aient ou non fait l’objet d’une ordonnance visée à l’alinéa a ); (

c) award damages to the complainant, including damages for any humiliation that the complainant has suffered.

c) accorder au plaignant des dommages-intérêts, notamment en réparation de l’humiliation subie. The Office of the Privacy Commissioner determined that the respondent had breached principle 4.3 of the

Schedule to the Act : 4.3 Principle 3 — Consent The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Note: In certain circumstances personal information can be collected, used, or disclosed without the knowledge and consent of the individual. For example, legal, medical, or security reasons may make it impossible or impractical to seek consent.

When information is being collected for the detection and prevention of fraud or for law enforcement, seeking the consent of the individual might defeat the purpose of collecting the information. Seeking consent may be impossible or inappropriate when the individual is a minor, seriously ill, or mentally incapacitated. In addition, organizations that do not have a direct relationship with the individual may not always be able to

seek consent. For example, seeking consent may be impractical for a charity or a direct-marketing firm that wishes to acquire a mailing list from another organization. In such cases, the organization providing the list would be expected to obtain consent before disclosing personal information. C. ISSUES [ 9 ] The applicant is asking the Court to make the following orders: 1. An order to compel the respondent [ translation ] “to change the practice of disclosing personal information without the authorization of the person concerned”. 2.

An order awarding the following damages: i. $50,000 for injury to the applicant’s reputation, honour and dignity; ii. $25,000 for moral prejudice, pain and suffering; and iii. $25,000 in exemplary damages. D. ANALYSIS (

a) The Bank’s practices Applicant’s submissions [ 10 ] The applicant submits that the respondent must comply with the statutes governing the disclosure of personal information and that it had to obtain her consent prior to transmitting any documents to a third party. [ 11 ] Even though she is asking the Court to issue an order to compel the respondent to change its practices regarding the disclosure of personal information to third parties, the applicant’s submissions do not clarify what she finds wrong with the respondent’s existing policy and procedures or what corrective measures she would like to be taken.

Respondent’s submissions [ 12 ] The respondent reminds the Court that the appellant did not cross-examine it on its affidavits. The respondent argues that it adopted internal policies and procedures to protect its clients’ confidential information and to prevent the disclosure of that information to third parties without obtaining prior consent from account holders.

It also pointed out that it held a refresher session for its employees as soon as it noticed the breach in this case. [ 13 ] The respondent also notes that it did not challenge the applicant’s allegations during the Office of the Privacy Commissioner of Canada’s investigation. The respondent submits that the applicant did not provide any evidence to support its claim that the Bank’s internal policies and procedures were insufficient to protect the confidential information of its clients. Consequently, the order sought by the applicant to compel the respondent to modify its disclosure practices is without merit.

Analysis [ 14 ] The Court recognizes that the applicant did not file any evidence other than the factual allegations in this case to establish that the Bank’s policies and procedures do not properly protect its clients’ personal information. It is not disputed that the Bank held a refresher session for its employees to prevent this type of mistake from happening again. The applicant did not specify what changes to the Bank’s practices she would like the Court to order. In the circumstances, given the lack of specific evidence demonstrating a flaw in

the respondent’s policies and procedures, the Court cannot issue the order sought by the applicant. (

b) Damages Applicable law [15] In Randall v Nubodys Fitness Centres, 2010 FC 681 [Randall], Justice Richard Mosley had the following to say aboutdamages awarded under

section 16 of the Act: [55] Pursuant to

section 16 of the PIPEDA, an award of damages is not be made lightly. Such an award should only be made in themost egregious situations. I do not find the instant case to be an egregious situation. [56] Damages are awarded where the breach has been one of a very serious and violating nature such as video-taping and phone-linetapping, for example, which are not comparable to the breach in the case at bar: Malcolm v. Fleming (B.C.S.C.) , Nanaimo Registry No.S17603, [2000] B.C.J. No. 2400; Srivastava c.

Hindu Mission of Canada (Québec) Inc. (Q.C.A.), (QC CA), [2001]R.J.Q. 1111, [2001] J.Q. no 1913. [16] The alleged injury must result directly from the misconduct. In Stevens v SNF Maritime Metal Inc., 2010 FC 1137 [Stevens],Justice Michael Phelan of this Court refused to award damages following the unlawful disclosure of confidential information to theapplicant’s employer even though the disclosure resulted in the applicant’s dismissal: [28] The source of the Applicant’s complaint is the loss of his employment. He even claims for loss due to loss of a second job.

But allof his loss claimed is tied directly to his termination for cause. While the termination might not have occurred if there had not beendisclosure, the nexus to the claimed loss is termination of employment for which Stevens had, but gave up, the right to claim wasunlawful. [29] The PIPEDA right of action is not an end run on existing rights to damages. It is a right to a different type of damages claim –breach of the right to privacy. [17] Indeed, in La responsabilité civile [Civil Liability] by Jean-Louis Baudouin (a former judge of the Court of Appeal ofQuebec) and Patrice Deslauriers, 7th ed, Vol.

II (Cowansville, Quebec: Yvon Blais, 2007), at paragraphs 2-450, 458, as cited by therespondents, the authors point out as follows: [translation] The duty of confidentiality or of discretion (article 1434 C.C.Q.) does not absolutely prohibit an institution from providing informationon its clients to third parties. An institution cannot abuse that right without being held contractually liable towards its client to the extentthat the client suffers injury as a result. . . .

Naturally, the wrongful disclosure of information must be causally connected to the injury suffered by the third party. [18] In Nammo, Justice Russell W. Zinn explained that awarding damages under paragraph 16(

c) of the Act is discretionary.

Applicant’s submissions [19] In her written submissions, the applicant described in detail the problems she experienced following the disclosure of herinformation to counsel for her ex-husband. She claimed that she had been exhausted and lost during the divorce trial when counselquestioned her about the personal accounts she had with the respondent bank. She alleged that her rights had been violated by therespondent’s wrongful disclosure. It had done great harm to her personal life.

She now has problems with her family and her friends as aresult of the conduct of her ex-husband, who was using certain passages of the divorce judgment to harm her reputation. Respondent’s submissions [20] The respondent argues that the injury suffered by the applicant arises from the divorce judgment of the Superior Court and theuse her ex-husband made of it rather than the error made by the respondent.

The respondent refers to the following excerpt from theapplicant’s divorce judgment (Tab A-2, Respondent’s Record): [translation] [74] Regarding the administration of money, Nicole Landry changed in the last years of their life together. She became secretive: she hada nest egg unknown to Jean-Paul Racine; she opened a bank account without telling Jean-Paul Racine. The facts are silent not on theexistence of the nest egg, but on its current contents. The respondent points out that the judge described the contents of the applicant’s personal account and explained that Mr.

Racine learntof these accounts during the proceeding or shortly beforehand (paragraphs 95 to 96). The judge points out at paragraph 96 that during herexamination on November 9, 2007, the applicant denied several times that she had other bank accounts. [21] The respondent submits that this Court must determine what would have happened if the error had not been made (Parrot vThompson et al, (SCC), [1984] 1 SCR 57, at page 71). The respondent notes the legal obligation, in family matters, toprovide all one’s personal information, including one’s financial information.

In Rick v Brandsema, 2009 SCC 10, the Supreme Courtwrote as follows: [49] . . . Imposing a duty on separating spouses to provide full and honest disclosure of all assets, therefore, helps ensure that each spouseis able to assess the extent to which his or her bargain is consistent with the equitable goals in modern matrimonial legislation, as well asthe extent to which he or she may be genuinely prepared to deviate from them. [22] The respondent submits that the applicant had to disclose all her personal information, including all of her assets.

Since theBank was served a subpoena duces tecum, the documents and personal information pertaining to the applicant had been filed in theSuperior Court’s record, even though they were not directly disclosed to Ms. Arsenault. [23] The respondent points out that during her examination in the present case, the applicant acknowledged that she had beenrepresented by counsel during her divorce proceeding and admitted that she had denied the existence of her personal accounts, eventhough counsel for her ex-husband repeatedly asked her about them.

She did not want to produce itemized statements from her personalaccounts, but her counsel did not object to producing them. The applicant also admitted that the Superior Court had found that producingher itemized bank statements was relevant. Furthermore, the same statements are now part of the two court records accessible to thepublic (both of this Court and the Superior Court of Quebec). [24] The respondent submits that the applicant’s affidavit clearly states that the problems caused by the applicant’s ex-husbandarise from certain excerpts of the judgment of the Superior Court.

The respondent quotes from the excerpts of its examination of theapplicant at pages 63 to 64 (Respondent’s Record, Tab C), in which the applicant explains that her ex-husband [translation] “takes thedivorce judgment everywhere” and that he filed it with the small claims court when they went before it. [25] The respondent therefore concludes that the alleged injury arises from the divorce judgment. The injury suffered would be the

same if the respondent’s employee had not disclosed the documents directly to Ms. Arsenault, since the itemized statements would have been filed in the Superior Court’s record in any case, given the subpoena duces tecum ordering her to appear before the Court with the documents. There is therefore no direct link between the wrongful disclosure of the documents and the injury suffered by the applicant.

Instead, according to the respondent, the applicant feels injured because of the negative comments made about her in the divorce judgment. [ 26 ] If the applicant was humiliated during the proceeding, she alone was to blame, according to the respondent, since she attempted to hide the existence of her personal bank accounts despite her obligations to disclose them.

The respondent also submits that the Bank never acted in bad faith. [ 27 ] In the alternative, the respondent argues that if the Court awards damages to the applicant because of the premature disclosure of the documents, the amount should be lower than the $5,000 recently awarded in Nammo . In that case, the respondent disclosed false financial information to lending institutions from which the applicant was requesting a loan. The respondent submits that, unlike the applicant in Nammo , the hands of the applicant in the present case are not clean.

Consequently, any award for damages for more than a nominal amount would compensate the applicant even though she is largely responsible for the injury she claims to have suffered. Analysis [ 28 ] In Nammo , Justice Zinn adopted the findings in Randall , above, in which Justice Mosley lists the factors to be considered when the Court awards damages under paragraph 16 (

c) of the Act : [71] . . . In Randall v Nubodys Fitness Centres , 2010 FC 681 , Justice Mosley found that an award of damages under s. 16 is not to be made lightly and that such an award should only be made “in the most egregious situations.” This is such a situation.

In Randall , which involved the disclosure of how often the applicant used his gym membership to his former employer, Justice Mosley determined that the impugned disclosure of personal information was “minimal,” that there had been no injury to the applicant sufficient to justify an award of damages, that the respondent did not benefit commercially from the breach of PIPEDA , that the respondent did not act in bad faith, and, perhaps most importantly, that there was no link between the disclosure and the employer’s alleged retaliation against the applicant. The same cannot be said here.

Justice Zinn ordered the respondent to pay $5,000 to Mr. Nammo. The Court is of the opinion that, to some extent, the present case has something of both scenarios. It must be recognized that just as in Randall , the respondent did not benefit commercially from the error made by one of its clerks and that there is no evidence that the respondent acted in bad faith, except for Ms. Bouchard denying any knowledge of the file even though she herself was responsible for the wrongful disclosure.

The disclosure of personal information in the present case is not trivial; it is a major error, especially as the Bank’s employee tried to cover up her wrongful conduct. [ 29 ] The Court recognizes that the applicant suffered an injury in this case. However, she contributed to her own misfortune by attempting to conceal under oath the existence of her personal accounts even though she was obliged to disclose their existence. In her defence, the applicant claims that she was ill advised by her counsel.

Bank account holders do not expect their bank to disclose information on their personal accounts to a third party without their prior consent. The error committed remains serious even when one considers the subpoena duces tecum and the disclosure that would have followed albeit in a different context. [ 30 ] One must also recognize, however, that a large part of the injury suffered by the applicant is the result of her own actions.

The Bank is responsible for the direct disclosure of information to counsel for the applicant’s ex-husband, but it cannot be criticized for the fact that this information was filed in the Superior Court’s record. The subpoena duces tecum obliged the Bank’s employee to appear before the Superior Court with the relevant documents and information.

The judge drew conclusions from it, and the ex-husband used these conclusions to harm the applicant and destroy her relationship with her family and her friends. [ 31 ] In Stevens , Justice Phelan found that equitable principles applied to the awarding of damages and considered that Mr. Stevens “own actions contributed to his problems” (paragraph 24).

Justice Phelan applied the “clean hands” doctrine in that case. [ 32 ] Taking into account the contributory fault of the applicant, who was partially responsible for her own problems, and the serious breach committed by the respondent’s employee and its subsequent cover-up, the Court finds that the applicant suffered humiliation under paragraph 16(

c) of the Act and that the respondent’s negligence warrants the applicant being compensated but does not give rise to exemplary damages as requested. Consequently, we fix an amount of $4,500 with interest and costs to be paid to the

applicant by the respondent. JUDGMENT THE COURTS ORDERS AND ADJUDGES that, for the reasons stated above, the respondent pay the applicant the amount of $4,500 with interest and costs. “André F.J. Scott” Judge Certified true translation Johanna Kratz, Translator Federal Court SOLICITORS OF RECORD Docket: T-245-10 STYLE OF CAUSE: NICOLE LANDRY and ROYAL BANK OF CANADA PLACE OF HEARING: Québec DATE OF HEARING: June 2, 2011 REASONS FOR JUDGMENT AND JUDGMENT BY: SCOTT J. DATED: June 14, 2011 APPEARANCES :

Nicole Landry FOR THE APPLICANT (SELF-REPRESENTED) Louis Gratton FOR THE RESPONDENT SOLICITORS OF RECORD : Nicole Landry FOR THE APPLICANT (SELF-REPRESENTED) OGILVY RENAULT LLP Montréal, Quebec FOR THE RESPONDENT