Someone has been peeking at your private information: where you work, how much you make, your health records. How much will it cost to make you feel better about it? Can you put a dollar figure on breach of privacy?
Certainly there are more questions than answers in what legal experts say is an emerging — and murky — area of potential litigation.
"The courts are struggling with this as much as policy makers, businesses and individuals," says Janet Lo, a lawyer with the Public Interest Advocacy Centre in Ottawa. "The courts are now trying to figure out how to examine what type of remedy is appropriate where privacy has been aggrieved."
Privacy experts will attempt to shed light on the topic during a panel discussion at the Canadian Bar Association's Third Annual Access to Information and Privacy Law Symposium in September. The conference will explore recent developments and trends in privacy and access law.
"The real linchpin here is class actions and whether class actions would be used effectively to potentially get very large awards for consumers or individuals who suffer privacy breeches. This is not something our courts have typically done," Ms. Lo says.
New legal ground was broken in January when the Ontario Court of Appeal awarded $10,000 in damages to Bank of Montreal employee Sandra Jones and recognized a new common-law tort called Intrusion upon Seclusion. Ms. Jones successfully claimed her privacy had been breached in a precedent-setting case that recognized the need to protect people from unreasonable intrusion into their private lives.
Another BMO employee had looked at Jones' banking records at least 174 times over four years. That other employee was also involved in a common-law relationship with Ms. Jones' former husband.
Ms. Jones' claim for $90,000 in damages had previously been dismissed on the grounds that Ontario law does not recognize the tort of breach of privacy. However, the Court of Appeal partially upheld Ms. Jones' complaint, even though the personal information such as banking transactions, marital status, address and date of birth had not been published, distributed or recorded.
"The Jones case is significant in that it isn't every day that the court recognizes a new tort, so that's a major development," says Toronto lawyer Alex Cameron, who represented the defendant. He will also moderate the panel discussion entitled Privacy in the Courts: Damage Awards, Tort Claims and Class Actions at the September symposium.
"The incentive is now certainly there for plaintiffs to go to the court," Mr. Cameron says. "Now it is clear there is a cause of action in certain cases and on top of that you are going to be awarded damages in many cases. That was far from clear before."
Mr. Cameron says the Jones case also settles some uncertainty over a particular type of invasion of privacy – intrusion upon seclusion. He says it's only a matter of time before cases come along that will deal with what happens when people both look at private information without justification and also publish it.
Mr. Cameron says the panel discussion will examine how Canadian courts are showing an increasing tendency to protect privacy interests, particularly through damage awards and class-action litigation.
It will also look at what is happening in the U.S. through speakers Daniel Kaufman with the Federal Trade Commission in Washington and Jenna Karadbil with the New York legal firm of Pillsbury Winthrop Shaw Pittman.
Mr. Cameron says the Jones case is a landmark because the court not only recognized the tort but it also "said explicitly harm is not an element of the tort," awarding damages even though Jones had lost no money.
"The court ruled that proof of harm to a recognized economic interest is not an element of the tort but that it may nevertheless award ‘symbolic' or ‘moral' damages of up to $20,000 to ‘mark the wrong'," Mr. Cameron says, which is significant because plaintiffs in other jurisdictions have often been unable to show a loss resulting from a breach of privacy.
"This is widely expected to have a major impact in privacy-related class actions because ‘symbolic' damages, even in a modest amount, may be substantial where there are thousands or even millions of individuals affected by a privacy breach."
Mr. Cameron acknowledges that some might question whether, by capping the award at $20,000, the court has sufficiently protected privacy. Take, for example, the phone-hacking scandal in the U.K., he says. "Would an award of more than $20,000 be appropriate to mark the wrong in that case?"
Janet Lo says the courts have had to "open the door" and set out a framework in Canada for what type of scenario they would actually consider damage awards to be appropriate. But she also questions whether the awards adequately reflect the crime.
"My view is that the damage awards are still quite nominal. You know, $5,000 for a breach by a credit reporting agency. That's financial information that's fairly sensitive personal information. I believe that in that case they didn't even award costs," she says.
She also points out that the Federal Court has recently awarded damages under the Personal Information Protection Electronic Documents Act (PIPEDA), but not substantial damages. (Nammo v. TransUnion of Canada Inc., $5,000). An individual who believes there has been a breach of privacy under PIPEDA can make a complaint to the Privacy Commissioner, who can investigate and issue a report. The individual can then apply to the Federal Court for a hearing, where damages could be awarded.
"We've certainly been critical for a while for the lack of enforcement powers under PIPEDA and this particular route for an individual to receive any type of monetary remedy," Ms. Lo says. "It is very challenging especially because we're talking about businesses that see personal information as a form of currency. So we do question whether the threat of litigation or the threat of individuals pursuing their rights is enough to incent appropriate business behaviours from the get-go."
Becky Rynor is a freelance journalist in Ottawa.