Making Private Information Public: The Continued Expansion Of Privacy Class Action Liability

Introduction

Privacy class actions are a growing field in Canada. Historically, such actions were not pursued by plaintiffs, largely due to a perception that they were difficult to prosecute on a class-wide basis, given the diverse and individualised nature of loss arising from privacy breaches. However, that trend has changed.

Over the past few years, Canada has seen a considerable increase in privacy actions regarding data breaches and unauthorised use of personal information. This trend has been driven by the active enforcement activities of Canadian privacy regulators, increased media interest in privacy issues and the recognition of the tort of "intrusion upon seclusion" in Ontario.1 In addition, developments in class action jurisprudence have arguably lowered the bar for class certification.

Although challenges remain for plaintiffs in certifying privacy claims, a recent decision of the Federal Court suggests that there may be another potential ground upon which to base a privacy class action - "publicity given to private life."

John Doe v Her Majesty the Queen - a novel claim for "publicity given to private life"

In John Doe and Suzie Jones v Her Majesty the Queen,2 two anonymous plaintiffs alleged that Health Canada had wrongfully identified them as participants in a federal program for access to medical marihuana. In November 2013, Health Canada sent oversized envelopes marked "Marihuana Medical Access Program" through Canada Post to about 40,000 people registered in the program. The plaintiffs alleged that by identifying on the envelopes the participants' names together with the name of the program, Health Canada had breached their privacy and exposed them to security risks. They claimed that a reasonable person would conclude from the envelopes that the addressees were associated with the federal program, suffered from serious medical conditions, and possessed or consumed marihuana.

The mailings were contrary to past practice and shortly afterwards the Deputy Minister of Health Canada acknowledged that the envelopes were the result of an administrative mistake. In response to 339 complaints, the Privacy Commissioner subsequently concluded that the mailings violated the Privacy Act by referring to the program together with the individuals' names.

In the context of the low evidentiary threshold on a certification motion, the court certified, for the first time in a Canadian class action, the novel claim of "publicity given to...