At What Point Does The Failure Of An Organization's Security Safeguards Amount To Recklessness?

The tort of intrusion upon seclusion, as set out by the Ontario Court of Appeal in Jones v Tsige, requires the defendant's conduct to be intentional, or, at a minimum, reckless. The question is: at what point does the failure of an organization's security safeguards amount to recklessness? This was the question addressed by the Ontario Superior Court of Justice in the recent case, Wilson-Flewelling v Queensway Carleton Hospital, 2019 CanLII 65155 (ON SCSM) ("Queensway Carleton Hospital").

The facts

The court heard that the Plaintiff, Ms. Wilson-Flewelling, had attended the defendant hospital ("Hospital") to book a surgical procedure, that the Hospital's medical office administrator had left a completed surgical booking package in the Hospital's dedicated, locked drop box, and that the Plaintiff had unexpectedly received the package in the mail a week later. None of the hospital staff could account for how the package ended up being returned to the Plaintiff. The Plaintiff claimed for intrusion upon seclusion. The Hospital denied both that it had received the package in its drop box, and that it had improperly disclosed the Plaintiff's personal health information.

The decision

The Judge found, on the balance of probabilities, that the Hospital had received the records. Nevertheless, the Judge dismissed the Plaintiff's claim for intrusion upon seclusion, noting that the mysterious disappearance and reappearance of the package was a "single act of inadvertence" insufficient to prove recklessness. The Judge also took the Hospital's protocol for handling booking records into account, noting that the protocol did not create an obvious and serious risk, was not a marked departure from the norm, and otherwise worked well for the 50 to 60 doctors using it on a regular basis.

The recklessness threshold

Canadian courts have struggled to identify at what point the failure of an organization's security safeguards amounts to recklessness. With that said, the decision in Queensway Carleton Hospital follows a number of class action certification decisions that provide some insight. These decisions should be read with the caveat that the threshold in a certification motion is a low one; the court may only dismiss a motion if it is plain and obvious that the plaintiff's claim fails to disclose a reasonable cause of action.

In Condonv Canada, 2014 FC 250 an unencrypted hard drive containing the personal information of over 500, 000 student loan applicants...