Articles 2019

The Federal Court of Canada recently affirmed the application of PIPEDA to a foreign-based website operator. While PIPEDA has been applied to foreign companies before, the decision in A.T. v Globe24h.com and Sebastien Radulescu is the most explicit statement on the issue of extraterritorial application to date.

Recent landmark legislative amendments, regulatory activity, and an unprecedented increase in privacy litigation, damage awards, and class action certifications are among the key trends and legal risks in the Canadian cybersecurity environment. In this must-read article, Alex Cameron examines these trends and key developments to watch in the coming year.

In its recent decision in RBC v. Trang, the Supreme Court of Canada provided guidance to financial institutions holding otherwise “highly sensitive” information on how to determine when that information is somewhat less sensitive, such that it can be disclosed.

in December 2016, the Ontario Superior Court of Justice released Patel v. Sheth, the next in a series of cases sprouting from the 2012 recognition of a tort of intrusion upon seclusion. While Patel is deeply planted in a messy matrimonial context the analysis and finding of an invasion of privacy is worth addressing from a business risk perspective as well.

The OBA Privacy and Access to Information section has struck a working group to explore the creation of a LSUC Certified Specialist Program in privacy and access to information law. The executive invites section members to join and participate in the working group.

The first Compliance and Enforcement Decision under Canada’s Anti-Spam Law was issued on October 27, 2016. Among other insights, the decision provides clarification on the "conspicuous publication" ground of implied consent to receive commercial electronic messages and the application of the factors relevant to the quantum of an administrative monetary penalty under CASL.

The Ontario Superior Court of Justice recently dismissed a claim for spoliation of evidence resulting from the efforts of an employee of the defendant company to delete the browsing history on his computer before turning it over in compliance with a court order. Although the Court accepted that the employee did not intentionally destroy evidence relevant to the case, the decision is a reminder of the boundaries of employee expectations of privacy.

The decision in Lozanski v The Home Depot, Inc. by the Ontario Superior Court of Justice is one of the few court-approved privacy breach class action settlements in Canada. The decision provides some much needed guidance in this area: the Court suggests that actual harm is needed for class members to receive financial compensation and that companies should adopt a proactive approach to mitigate liability when faced with a privacy breach.

In a recent decision, the Divisional Court set aside an order of the IPC mandating that certain confidential information of the applicant union was to be disclosed to a representative of a rival union. The Court held that the applicants need not show that harm had actually occurred, but that the context of the disclosure request was enough to demonstrate a reasonable risk of harm.