Focus On

Supreme Court opens door on privacy a crack

Thursday, December 01, 2016 @ 7:00 PM | By Cristin Schmitz

The Supreme Court has given its first guidance on when organizations may disclose an individual’s “less sensitive” personal information to others based on that individual’s “implied consent.”

The 9-0 judgment of the court delivered by Justice Suzanne Côté on Nov. 17 arguably offers businesses and other organizations more statutory scope than was formerly believed to exist to depart from the general rule in the Personal Information Protection and Electronic Documents Act (PIPEDA) that personal information may only be disclosed, with the knowledge and express consent of the affected individual: Royal Bank of Canada v. Trang 2016 SCC 50.

Notably, the court sheds new light on one of a number of exceptions to the express consent rule — that exception being that consent may be implied when the personal information is “less sensitive” (schedule 1, cl. 4.3.6 of PIPEDA).

The Supreme Court held that a mortgage discharge statement fell into that category, in the case at bar. It allowed the appeal of the Royal Bank of Canada from Ontario decisions below which held that PIPEDA barred Scotiabank from disclosing to the Royal Bank the mortgage discharge statement of two Scotiabank customers, Phat and Phuong Trang.

The Royal Bank had been trying to execute a judgment against the Trangs for more than $26,000, but the sheriff declined to sell the Trangs’ property mortgaged to Scotiabank, without first getting a mortgage discharge statement from Scotiabank, in order ascertain the interests, and rights, as between the two banks. Scotiabank asserted it was barred by PIPEDA from making the disclosure, unless the Trangs consented, and the Ontario courts agreed.

However the Supreme Court ruled the Trangs’ consent to disclosure should be implied in the circumstances, and ordered Scotiabank to produce the mortgage statement. “Here, RBC is seeking disclosure regarding the very asset it is entitled to, and intends to, realize on,” Justice Côté reasoned. “A reasonable person borrowing money knows that if he defaults on a loan, his creditor will be entitled to recover the debt against his assets. It follows that a reasonable person expects that a creditor will be able to obtain the information necessary to realize on its legal rights,” she said. “Obtaining a writ of seizure and sale, and filing it with the sheriff, makes operational the consent to disclosure given by the Trangs concurrent with their giving a mortgage to Scotiabank. In my view, consent for the purpose of assisting a sheriff in executing a writ of seizure and sale was implicitly given at the time the mortgage was given.”

Teresa Scassa, Canada research chair in information law at the University of Ottawa, said the court arguably took a “lenient” approach to implied consent — one that could be used to “backfill” the lack of express consent in cases where privacy policies haven’t adequately addressed certain types of disclosure, or collection of particular kinds of information or particular uses of information.

“The issue of implied consent is obviously an interesting and important one for many businesses,” Scassa said. “I do think [the court] shows a tendency towards an openness toward implied consent…It creates this opening to say: ‘Well there wasn’t explicit notice given [to the individual] about this particular use, and consent was not expressly sought, but gosh it makes everybody’s life difficult if we don’t imply consent so let’s do it.’…So the risk is that expediency may simply be allowed to trump transparency in other circumstances [beyond this case] so it does have the potential to open into something larger.”

Scassa cautioned privacy lawyers “to take note of the risks that may come from too readily jumping to implied consent…I think there has be concern that consent is not so easily and readily implied into agreements that it essentially does away with that notice and transparency element” in PIPEDA.

In deciding whether implying consent was appropriate in the circumstances, Justice Côté said the sensitivity of the financial information in question had to be assessed in the context of the related financial information already in the public domain; the purpose served by making the related information public; and the nature of the relationship between the mortgagor, mortgagee and directly affected third parties.

“The legitimate business interests of other creditors are a relevant part of the context which informs the reasonable expectations of the mortgagor,” she said. “Also relevant is the identity of the party seeking disclosure and its purpose for doing so.”

Tobi Cohen, spokeswoman for the Office of the Privacy Commissioner, which instructed counsel as amicus curiae in the case, said the decision “contains helpful language concerning PIPEDA and the concept of implied consent. It underlines the foundational nature of informed consent under PIPEDA. While this consent will normally be express, it can be implied in ‘strictly defined circumstances’ ” according to the court.

Cohen noted by e-mail while the court reiterated “the generally extremely sensitive nature of financial personal information, it considered the information at issue less sensitive because of the fact that other mortgage-related data is made public in registries at the outset of the mortgage relationship and because of the nature of the relationship between the mortgagor, mortgagee and directly affected third parties. As for the reasonable expectations of the mortgagors, the court assessed these in light of the identity of the intended recipient of the disclosure as well as the purpose for which the information was sought — here disclosure to a person who requires the information to exercise an established legal right.”

In the privacy commissioner’s amicus brief to the court, Ottawa counsel Barbara McIsaac and Kate Wilson argued for “the importance of resisting the temptation to solve this case by means of a finding of ‘implied consent,’ a finding which may be tempting for the sake of expediency, but which would distort the cornerstone concept of consent under PIPEDA, with potentially far-reaching implications for the protection of privacy…It is not within the reasonable expectations of the mortgagor that his or her mortgagee would voluntarily hand over a [mortgage discharge] statement to a third party judgment creditor, especially in the absence of any significant arrears or default on the mortgage.”

The Supreme Court also allowed the Royal Bank’s appeal on the alternative ground that disclosure was “required to comply with…an order made by a court” (s. 7(3)(c) PIPEDA).

The Royal Bank’s counsel, Peter Hogg and Catherine Beagan Flood of Toronto’s Blakes, did not comment when contacted by The Lawyers Weekly.