5 privacy laws and rights to damages

There are five pieces of legislation that govern the protection of the privacy of personal information in Ontario.

When an individual believes their rights under any of the five Acts have been violated, the primary remedy available to them is a complaint to the relevant Privacy Commissioner. Very limited statutory damage rights are available.

Privacy act

The Privacy Act is federal legislation that governs how federal institutions must protect personal information in its possession.

There is no explicit right to a civil action or damages if an individual’s rights under the Privacy Act are violated. There is actually an explicit prohibition against civil or criminal actions being brought against any head of a government institution for violations of the Privacy Act. As long as the institution or its agents were acting in good faith when they disclosed the information, section 74 of the Act protects them from a civil action.

Personal information protection and electronic documents act

PIPEDA is a federal act that governs the collection, use, and disclosure of personal information by commercial entities.

After a complaint has been made to the Privacy Commissioner, a complainant may apply to the Court for a hearing in respect to the issues covered in the Commissioner’s report. Under section 16(c) of PIPEDA, the Court can award damages to the complainant, which includes damages for any humiliation the complainant has suffered. However, Courts will typically only award damages in “the most egregious situations…such as videotaping or phone-line tapping” (Randall v. Nubodys Fitness Centres).

Freedom of information and protection of privacy act

FIPPA is provincial legislation that governs both privacy and access to information controlled by provincial government agencies, boards, commissions, and crown corporations, as well as entities such as universities.

It contains no explicit right to a civil action or damages.

Similar to the federal Privacy Act, FIPPA explicitly prohibits civil actions “against a head, or against a person acting on behalf of or under the direction of the head, for damages resulting from the disclosure or non-disclosure in good faith of a record…” in section 62(2).

Municipal freedom of information and protection of privacy act

MFIPPA is similar to FIPPA, but it applies to municipalities and other similar public entities.

Personal health information protection act

PHIPA is a provincial Act that establishes rules for the collection, use, and disclosure of personal health information by health care professionals.

Section 71 of PHIPA provides immunity for a health information custodian who exercises their powers under the Act in good faith, as well as immunity from allegations of neglect or default arising from good faith exercising of their powers.

However, PHIPA provides a statutory entitlement to damages if the Commissioner makes an order under the Act that has become final. Section 65 allows any individual affected by an order of the Commissioner to pursue damages in the Superior Court for actual damages suffered as a result of the breach of the Act. Section 65(3) also provides for an award of up to $10,000 for mental anguish if it is deemed that the defendants acted in willful or reckless behavior.

Bottom line

If the privacy of your personal information has been breached in Ontario by a government entity or a business, the primary recourse is a complaint to the applicable Privacy Commissioner. Damages are only available in limited circumstances, and only if the Commissioner has rendered a decision deciding there has been a breach.

David Canton is a business lawyer and trademark agent at Harrison Pensa with a practice focusing on technology, privacy law, technology companies and intellectual property. Connect with David on LinkedIn and Twitter.

Jacob Williams finished his articles at Harrison Pensa and joined the firm as a business lawyer. Connect with Jacob on LinkedIn.

Image credit: ©peach_adobe – stock.adobe.com