Common law privacy tort, Privacy Act, PIPA claims can coexist, judge finds
The Supreme Court of British Columbia recently allowed a plaintiff’s claims for privacy breaches under the Privacy Act and the Personal Information Protection Act to proceed on the basis that these claims were not bound to fail.
The plaintiff in this case served as an elected senior steward of a trade union for over a decade. After she lost her bid for re-election, she sued the union, its executive board, and an unnamed individual responsible for leaking a certain report.
The plaintiff claimed that the report – which investigated her use of a corporate credit card and contained sensitive information – was distributed widely within the union and was used to damage her reputation and to hinder her re-election efforts.
The plaintiff’s suit included allegations of breach of privacy under B.C.’s Privacy Act, 1996; breach of its obligations under B.C.’s Personal Information Protection Act, 2003 (PIPA); and the tort of public disclosure of private facts.
The defendants moved to strike the suit. Among other arguments, they argued that the plaintiff’s PIPA claim should be dismissed because the appropriate process for resolving PIPA complaints was through the Information and Privacy Commissioner, not through the courts.
In Moon v International Alliance of Theatrical Stage Employees (Local 891), 2024 BCSC 1560, the British Columbia Supreme Court denied the motion to strike. The court held that it was not plain and obvious that no common law privacy tort existed in BC. This claim had enough merit to proceed, the court said.
The court reviewed existing case law and noted that BC courts have traditionally refused to recognize a common law privacy tort, largely because the Privacy Act provided a statutory remedy for privacy violations.
The court cited the ruling in Tucci v. Peoples Trust Company, 2020 BCCA 246, which suggested that the British Columbia Court of Appeal might need to revisit the issue of whether such a tort existed in the province.
The court emphasized that the plaintiff’s allegations, assuming that they were true, met the necessary elements for a privacy tort – an intentional invasion of privacy that a reasonable person would find highly offensive and that caused distress or anguish.
Next, the court noted that, under s. 57 of the PIPA, an individual affected by an order of the privacy commissioner had the right to bring a claim for damages before the court if an organization breached the PIPA. In this case, the court found it proper to permit the plaintiff's PIPA claim to proceed.
The court found it plausible that the plaintiff could recover damages under the PIPA for any harm suffered due to the breach, considering that the commissioner had already issued an order determining that the union had violated PIPA by failing to protect her personal information.
Lastly, the court decided that the Privacy Act claim was not plainly bound to fail and was not an abuse of process. The court addressed whether the plaintiff’s claims under the Privacy Act and the PIPA could coexist with a potential common law privacy tort. The court found that these claims could proceed simultaneously as each had different requirements.
The court explained that the Privacy Act required a wilful breach of privacy, while the PIPA provided a statutory right to damages for actual harm. The court also noted that common law and statutory duties of care could coexist.
