privacy torts Archives - Defamation & Business Litigation Lawyers Toronto | Grigoras Law

Personal Information Protection in Canada: A Privacy Lawyer’s Guide to Safeguarding Your Data in the Private Sector

Grigoras Law — Fri, 16 Aug 2024 05:16:43 +0000

In today’s digital age, safeguarding personal information has become a crucial responsibility for organizations operating in the private sector. The importance of privacy cannot be overstated, especially as businesses increasingly rely on data to drive their operations. For individuals and companies alike, understanding the legal framework that governs personal information protection is vital. This blog post will provide an in-depth exploration of how personal information is protected in Canada’s private sector, with a particular focus on the role of privacy lawyers in Toronto, the implications of privacy breaches, and the protection of privacy rights.

The Legal Framework Governing Personal Information Protection

Canada’s private sector is governed by a robust legal framework designed to protect personal information. The cornerstone of this framework is the Personal Information Protection and Electronic Documents Act (PIPEDA). This federal law applies to most private sector organizations across Canada, including those operating in Toronto. PIPEDA sets out the rules for how businesses must handle personal information, from collection to use and disclosure.

However, not all provinces are solely governed by PIPEDA. Alberta and British Columbia have enacted their own privacy laws, which are considered substantially similar to PIPEDA. These laws govern organizations operating within these provinces, while PIPEDA continues to apply to interprovincial and international transactions. Understanding these nuances is essential for any business operating across different Canadian jurisdictions.

For businesses and individuals in Toronto, seeking advice from a privacy lawyer in Toronto can be invaluable. These legal professionals are well-versed in PIPEDA and other applicable privacy laws, ensuring that organizations comply with their legal obligations and that individuals’ privacy rights are protected.

Your Rights to Access and Amend Personal Information

Under PIPEDA, individuals have the right to access their personal information held by private sector organizations. This right is crucial for maintaining transparency and accountability in how personal data is handled. When you request access to your personal information, the organization must provide you with details about the information they hold, how it is used, and to whom it has been disclosed.

If you discover that the information is inaccurate or incomplete, you have the right to request corrections. Organizations are legally required to correct any errors promptly and notify any third parties who may have received the incorrect information within the past six months. This process ensures that your data remains accurate and up-to-date.

In cases where an organization refuses to grant access or correct the information, consulting with a privacy rights lawyer can help you navigate the legal avenues available to enforce your rights. These lawyers specialize in privacy law and can guide you through the process of filing complaints or taking legal action if necessary.

The Process for Requesting Access to Your Information

Making a formal request to access or correct your personal information is a straightforward process, but it’s important to be specific. Your request should clearly identify the information you seek and provide enough detail for the organization to locate it. Once the request is submitted, the organization has a legal obligation to respond within 30 days, though this period can be extended under certain circumstances.

If the organization does not respond adequately or within the specified timeframe, you can escalate the matter by filing a complaint with the Office of the Privacy Commissioner of Canada. In some cases, you may need the expertise of a breach of privacy lawyer to address more complex issues, such as data breaches or unauthorized disclosures.

The Importance of Consent in Data Collection

Consent is a foundational principle in the collection and use of personal information. Under PIPEDA, organizations must obtain your consent before collecting, using, or sharing your personal data, except in specific situations where the law provides exemptions. This consent can be either explicit or implied, depending on the context and the sensitivity of the information.

For example, if you sign up for a service that requires your email address, the organization must inform you how your email will be used and obtain your consent to do so. If the organization later wants to use your email for a different purpose, such as marketing, they must seek additional consent from you.

Ensuring that businesses adhere to these consent requirements is critical. If you believe that an organization has collected or used your personal information without proper consent, a privacy lawyer in Toronto can provide the legal advice needed to address the issue.

The Purpose Behind Data Collection and Its Implications

When organizations collect personal information, they must do so with a clear and specific purpose in mind. This purpose must be communicated to you at the time of collection, and the data can only be used for that stated purpose unless additional consent is obtained.

For instance, a business may collect customer data to process orders and provide customer service. If the company decides to use this data for a new initiative, such as launching a targeted marketing campaign, it must first obtain consent from its customers. Failure to do so could result in legal action, especially if the use of the data leads to a privacy breach.

Understanding the intended purpose of data collection is crucial for both businesses and individuals. For businesses, this ensures compliance with privacy laws and helps avoid potential legal pitfalls. For individuals, it provides transparency and control over how their personal information is used.

How Personal Information Is Used and Shared

Once personal information is collected, it is subject to strict usage guidelines. Organizations are required to use the data only for the purposes for which it was collected. If they wish to use the information for a new purpose, they must obtain fresh consent from the individual.

Moreover, sharing personal information with third parties is also tightly regulated. An organization can only disclose your information to third parties if you have consented to such disclosure or if it is legally permitted. For example, data may be shared with government authorities during a legal investigation.

If you suspect that your personal information has been improperly used or shared without your consent, it’s essential to seek the guidance of a privacy rights lawyer. These legal professionals can help you understand your rights and pursue any necessary legal action to protect your privacy.

Security Measures for Safeguarding Personal Information

Organizations must implement appropriate security measures to protect personal information from unauthorized access, loss, or misuse. The level of security should correspond to the sensitivity of the information. For example, financial data and medical records typically require higher levels of protection, such as encryption and secure access controls.

In Toronto, businesses are advised to regularly review and update their security protocols to stay compliant with PIPEDA and other relevant privacy laws. This proactive approach not only protects the organization from legal risks but also builds trust with customers.

In the event of a data breach, the organization must take immediate steps to mitigate the damage, including notifying affected individuals and reporting the breach to the Privacy Commissioner. If you are affected by a data breach, consulting with a breach of privacy lawyer can help you understand your legal options and seek compensation if necessary.

What to Do When Privacy Is Compromised

Despite the best efforts of organizations, privacy breaches can still occur. Whether due to human error, technical failure, or malicious attacks, these breaches can have serious consequences for individuals whose personal information is exposed.

If you believe your privacy has been compromised, it is important to act quickly. Start by contacting the organization to find out what happened and what steps they are taking to address the breach. You should also consider consulting a privacy lawyer in Toronto who can advise you on the appropriate legal steps to take.

In some cases, you may need to file a complaint with the Office of the Privacy Commissioner or even pursue legal action. A breach of privacy lawyer can guide you through this process, ensuring that your rights are protected and that you receive any compensation you may be entitled to.

Legal Recourse and Protecting Your Privacy Rights

Protecting your privacy rights is not just about responding to breaches; it’s also about being proactive in understanding your rights and the legal protections available to you. In Canada, individuals have the right to expect that their personal information will be handled with care and respect. If an organization fails to meet these expectations, there are several legal avenues you can pursue.

Filing a complaint with the Privacy Commissioner is often the first step. The Commissioner’s office has the authority to investigate complaints, make findings, and recommend corrective actions. In more severe cases, individuals may also seek legal remedies through the courts, particularly if they have suffered harm due to a privacy breach.

Engaging with a privacy rights lawyer is crucial in these situations. These legal experts can provide you with the guidance needed to navigate the complexities of privacy law and ensure that your rights are fully protected.

Conclusion: The Ongoing Importance of Privacy Protection

In an increasingly digital world, the protection of personal information is more important than ever. For businesses, complying with privacy laws is not just a legal requirement but a critical component of building and maintaining trust with customers. For individuals, understanding your rights and knowing how to protect your privacy is essential in navigating the modern data landscape.

Whether you are a business looking to enhance your privacy practices or an individual seeking to safeguard your personal information, the role of privacy lawyers cannot be overstated. Privacy lawyers in Toronto are equipped with the expertise needed to guide you through the legal landscape, ensuring that your privacy rights are upheld.

As technology continues to evolve, so too must our approach to privacy. By staying informed and proactive, both businesses and individuals can work together to create a safer, more secure environment for personal information. If you ever find yourself facing a privacy issue, don’t hesitate to reach out to a privacy lawyer in Toronto or a breach of privacy lawyer who can help you protect your rights and navigate the complexities of privacy law in Canada.

The post Personal Information Protection in Canada: A Privacy Lawyer’s Guide to Safeguarding Your Data in the Private Sector appeared first on Defamation & Business Litigation Lawyers Toronto | Grigoras Law.

Shedding Light on the False Light Tort

Grigoras Law — Wed, 24 May 2023 12:59:23 +0000

In 2019, Ontario recognized “publicity which places an individual in a false light” – the “false light tort” – as a part of the common law. Despite its relatively straightforward definition, the false light tort remains puzzling due to its ambiguous parameters, unique elements, and potential utility. This blog post aims to shed some light on the false light tort, looking at its origins, its differences from defamation, and its potential future in privacy litigation.

The Birth of False Light Tort in Ontario

The first notable mention of the false light tort in Ontario was in the 2012 decision of the Court of Appeal for Ontario, Jones v Tsige. The court drew upon the work of renowned US law professor William L. Prosser to recognize the common law privacy tort of “intrusion upon seclusion.” The court didn’t formally recognize the false light tort, but referenced it as a potential cause of action within Prosser’s “four-tort catalogue.”

Fast forward to 2019, the last of Prosser’s torts – the false light tort – was recognized in the case of Yenovkian v Gulian, an atypical family law case with a mix of family law issues and multiple civil causes of action against the father for his extraordinary cyber-bullying. The court found the father guilty of making several false allegations about the mother, spreading these allegations online, and causing distress. This led to the recognition of the false light tort in Ontario, awarding the mother $100,000 in damages for “invasion of privacy.”

While Ontario took the lead in recognizing the false light tort, no other Canadian jurisdiction has yet to adopt it. (For example, as of the date of this blog, some of the recent extra-provincial case law on this tort includes ES v. Shillington (Alberta), Durkin v. Marlan (B.C.), Roque v. Peters (Manitoba), Candelora v. Feser (Nova Scotia), S.B. v. D.H. (Saskatchewan).)

Nonetheless, although the American treatment of this tort isn’t the subject of this blog, the false light tort has been available in numerous American jurisdictions for decades.

This is Not Defamation

A fundamental challenge regarding the false light tort is whether it serves a distinct and valuable purpose apart from defamation. While the two torts indeed overlap, there are four key distinctions.

Firstly, the two torts aim to protect different interests: defamation guards an individual’s reputation, whereas false light protects an individual’s privacy. Secondly, false light requires a plaintiff to prove falsity, which isn’t a requirement for defamation. Thirdly, while defamation is a strict liability tort, the false light tort necessitates an element of intentionality or recklessness from the defendant. Finally, the two torts differ in their requirement of information dissemination: defamation requires publication, while the false light tort requires publicity.

Shedding Further Light into the False Light Tort

To understand the false light tort better, look at its elements: publicity, falsehood, identification of the plaintiff, offensiveness to the reasonable person, and knowledge or reckless disregard as to falsity. The publicity requirement is met by disseminating information to a large number of people, falsehood needs to be proven by the plaintiff, the plaintiff needs to be identifiable in the defendant’s representation, the misrepresented information must be highly offensive to a reasonable person, and the defendant must have acted with knowledge or recklessness.

Defences for the false light tort are similar to those in defamation suits. Absolute privilege defences, including consent, apply to privacy torts, and conditional privilege defences are also applicable, unless the plaintiff can prove malice or bad faith on the defendant’s part.

False Light and Defamation: Similar but not Identical

Despite their differences, false light and defamation do overlap in two main areas. First, American jurisprudence suggests that the same defences to defamation will likely apply to the false light tort. Secondly, the two torts share the approach to calculating general damages.

The introduction of the false light tort in Ontario provides individuals with an added layer of protection against being wrongfully portrayed in a manner that is highly offensive. This legal avenue affords people the ability to fight back against false publicity that may tarnish their image or infringe on their privacy.

Predicting the Future of False Light Tort

The future of false light tort in Ontario, and perhaps across Canada, is somewhat uncertain. As it stands, no other Canadian jurisdiction has expressly adopted this tort. However, some provinces with statutory “invasion of privacy” torts may be more receptive to its potential use.

Globally, the false light tort remains largely unrecognized. It has yet to be officially accepted in other Commonwealth jurisdictions such as New Zealand, Australia, and the United Kingdom. Yet, it is a common cause of action in many American states, indicating its potential for broader acceptance over time.

In the end, the future of the false light tort may be shaped by how effectively it can be applied in cases of online defamation, harassment, and other internet-related disputes. With the growing incidence of online cyberbullying and other forms of online misrepresentation, the false light tort could serve as a tool for protecting individuals’ privacy rights.

Conclusion: The Importance of Understanding False Light

Whether you’re a business owner, private individual, or legal professional, understanding the implications of false light is important in today’s hyper-connected world. The rise of social media and digital communication platforms has drastically increased the risk of being placed in a “false light.” As a result, it is more important than ever to be aware of the legal options available to protect your privacy and reputation.

The recognition of the false light tort in Ontario represents a significant step towards offering people protection against harmful and offensive misrepresentations. Its existence reinforces the notion that privacy is a fundamental right, one that is vital in preserving individual dignity and autonomy.

The false light tort provides an additional legal remedy for those whose privacy has been invaded through the widespread dissemination of false information about them. While its future and the extent of its adoption remain uncertain, this tort serves as an essential recognition of the need to protect individual privacy in the age of digital communication and misinformation.

In this rapidly evolving legal landscape, it is advisable to seek legal counsel (like us) if you believe you have been a victim of false light publicity. Understanding your rights and the remedies available to you is the first step towards ensuring that your privacy is duly respected and protected.

Example: Kaur v. Virk

Rashpinder Kaur sued Harvinder Virk (Taajveer Virk) for defamation or placing her publicly in a false light, seeking damages of $150,000. Virk, who was noted in default for not filing a defence, is alleged to have misrepresented her relationship with Kaur’s husband, Sadioura, in a TikTok video, refused to remove the video despite requests, filed a baseless police complaint against Kaur, and posted defamatory content about Kaur on social media.

Despite Virk being in default, Kaur was required to prove her claim through an uncontested trial, following which the court awarded Kaur general and special damages based on her evidence, including affidavits and oral testimony. The court, however, didn’t award the full amount sought due to insufficient evidence supporting all claims.

In the proceedings, the court emphasized the need for Kaur to prove defamation and the tort of portraying someone in a false light as defined by Canadian Jurisprudence, citing relevant case laws. It was determined that while not all videos were defamatory in a strict sense, it was reasonably foreseeable that they could place Kaur in a false light.

Kaur was awarded $5,000 for general damages for false publicity and $30,390 for special damages due to loss of income, but she failed to secure damages for the prospective loss of a higher-paying position due to insufficient evidence. No aggravated or punitive damages were granted, and Kaur was awarded $3,963.26 in fees and $1,814 in disbursements for costs on a substantial indemnity scale. The court found Virk’s actions in posting the video, either knowing it to be false or reckless as to its truthfulness, to be egregious conduct.

Believe you've been wrongfully portrayed online, or are you defending against such claims? The 'false light tort' in Ontario can have significant implications for both plaintiffs and defendants.

Talk to a Privacy Lawyer

INTAKE FORM

The post Shedding Light on the False Light Tort appeared first on Defamation & Business Litigation Lawyers Toronto | Grigoras Law.

Intrusion Upon Seclusion: The State of Mind Requirement

Grigoras Law — Sat, 07 Jan 2023 20:08:33 +0000

Overview of Jones v. Tsige

In the case of Jones v. Tsige, the Ontario Court of Appeal confirmed the existence of a tort of intrusion upon seclusion, a civil action for damages for invasion of privacy, at common law in Ontario. This decision stemmed from an incident in which Ms. Tsige, who was involved with Ms. Jones’ former husband, accessed Ms. Jones’ personal bank accounts 174 times over a four year period without Ms. Jones’ knowledge.

The court stated that this tort has three specific elements: (i) the defendant’s conduct must be intentional or reckless (the state of mind requirement); (ii) the defendant must invade, without lawful justification, the plaintiff’s private affairs (the conduct requirement); and (iii) a reasonable person would regard the invasion as highly offensive, causing distress, humiliation, or anguish (the consequence requirement). Invasions of privacy that would meet this reasonable person standard include: a ccess to information pertaining to one’s finances, place of employment, or health; access to information pertaining to one’s sexual practices and orientation; and, access to a diary or private correspondence. (A subjective sensitivity or concern about one’s privacy would not be sufficient.)

The court also noted that while proof of harm to a recognized economic interest is not an element of the cause of action, damages in cases of intrusion upon seclusion are generally described as “symbolic damages,” meant to recognize the harm caused to the plaintiff’s dignity and autonomy.

The Case of Owsianik v. Equifax Canada Co.

In the case of Owsianik v. Equifax Canada Co., the Ontario Court of Appeal was asked to consider an appeal by Owsianik, who sought certification for an intrusion upon seclusion claim against Equifax Canada Co. and Equifax Inc. (collectively referred to as Equifax). Equifax is a credit reporting and credit protection company that operates worldwide and collects and aggregates financial and other information about millions of individuals and corporate entities.

The lawsuit originated from a data breach that took place in 2017, during which hackers got unauthorized access to sensitive financial information stored in Equifax’s database. This information included credit card numbers, Social Security numbers, and more. These details included people’s names, social security numbers, dates of birth, residences, driver’s license numbers, credit card numbers, email addresses, and passwords for their email accounts. In September 2017, Equifax disclosed the data breach to the public.

Owsianik alleged that Equifax’s failure to take appropriate steps to guard against this unauthorized access constituted an intentional or reckless intrusion upon her privacy. However, the court found that Equifax’s conduct could not be considered an invasion of, or an intrusion upon, the plaintiff’s privacy interests. The wrong done by Equifax arose out of its failure to meet its obligations to protect the privacy interests of its customers, rather than any direct invasion of privacy. In point of fact, the primary complaint levelled against Equifax was that the company did not adequately protect the information that it was obligated to protect.

The court also pointed out that if it were to impose extended liability on Equifax for the tortious conduct of the unknown hackers rather than for its failure to prevent the hackers from accessing the information, it would create a new and potentially very broad basis for finding liability for intentional torts. A defendant could potentially be held liable for any intentional tort committed by anyone if the defendant owed a duty to the plaintiff to protect them from the conduct amounting to the intentional tort.

Important Things to Draw From Owsianik: Clarity on the State of Mind Requirement

The Court of Appeal in Owsinik provided further clarity on the first element of the tort of intrusion upon seclusion: the state of mind requirement. The prohibited state of mind, whether intention or recklessness, must exist when the defendant engages in the prohibited conduct. The state of mind must relate to the doing of the prohibited conduct. The defendant must either intend that the conduct which constitutes the intrusion will intrude upon the plaintiffs’ privacy, or the defendant must be reckless that the conduct will have that effect.

Intention is established if the defendant meant to intrude upon the privacy of the plaintiff or knew that it was a substantially certain consequence of the act which constitutes the intrusion: see Piresferreira v. Ayotte, at paras. 72-75.

Recklessness, also a subjective state of mind, refers to the realization at the time the prohibited conduct is being done that there is a risk that the conduct will intrude upon the privacy of the plaintiffs, coupled with a determination to nonetheless proceed with that conduct: see Demme v. Healthcare Insurance Reciprocal of Canada, at paras. 62-64.

Otherwise, a defendant could be liable for any intentional tort committed by anyone, if the defendant owed a duty, under contract, tort, or perhaps under statute, to the plaintiff to protect the plaintiff from the conduct amounting to the intentional tort. For example, the security guard who fell asleep on the job, recklessly allowing an assailant to assault the person who the security guard was obliged to protect, would become liable for battery. The garage operator who negligently, and with reckless disregard to the risk of theft, left the keys in a vehicle entrusted to his care, would become a thief if an opportunistic stranger stole the car from the garage parking lot. This would create a new and potentially very broad basis for a finding of liability for intentional torts.

As such, if the defendant does not engage in conduct that amounts to an invasion of privacy, the defendant’s recklessness with respect to the consequences of some other conduct, for example the storage of the information, cannot fix the defendant with liability for invading the plaintiffs’ privacy.

The post Intrusion Upon Seclusion: The State of Mind Requirement appeared first on Defamation & Business Litigation Lawyers Toronto | Grigoras Law.

Ontario Privacy Torts: Monetary Damages in Revenge Porn Cases

Grigoras Law — Sat, 05 Jun 2021 17:38:04 +0000

Revenge Porn – Publication of Private Facts

Sadly, the colloquial term “revenge porn” doesn’t need a definition. It’s considered a crime under the Criminal Code (see s. 162.1 – Publication, etc., of an intimate image without consent).

Sometimes, engaging in the action may run afoul of a “morals clause” contained in a commercial agreement (typically contained in an endorsement contract between a company and a performer or athlete where the reputation of the company’s brand is involved). (An example consideration is Zigomanis v. 2156775 Ontario Inc (cob D’Angelo Brands), [2016] O.J. No 5841, 2016 ONSC 7053, affirmed on appeal.)

However, in a still-developing area of law in Ontario dealing with privacy torts, it may also trigger a monetary damages award in the context of a civil claim. In tort law, it falls within a category of privacy torts referred to as publication (or public disclosure) of private facts.

A few cases have set the stage for the elements of this cause of action in Ontario. In Jane Doe 464533 v. N.D., [2017] O.J. No. 60, 2017 ONSC 127, the plaintiff and the defendant had a close personal and romantic relationship for a period of time. After the 18-year-old plaintiff went off to university, the defendant pressured her to provide him with an intimate video of herself and assured her that only he would see it. Unfortunately, she believed him and provided him with the video, albeit reluctantly.

What did he do? The same day he received it, he posted the video to a pornographic website without her knowledge or consent. As if that wasn’t enough, he also watched the video with some of his buddies who were acquaintances of the plaintiff. The existence of the video became known to some of the plaintiff’s friends, and it was removed from the adult website about 3 weeks later. Obviously, there was no way of knowing how many times the video was seen or downloaded or copied.

The plaintiff was devastated and humiliated, she suffered emotional harm from the posting of the video, and she continued to live in fear that the video would resurface and adversely affect her employment, career, or future relationships. She sued her ex-boyfriend for damages and obtained damages in the amount of $50,000 for general damages, $25,000 for aggravated damages, and another $25,000 for punitive damages (note: her damages claim was limited to $100,000 as, at the time – in 2011 – she brought the action under simplified procedure).

The court held that a cause of action for invasion of privacy – in particular, public disclosure of embarrassing private facts about the plaintiff – was also made out:

“One who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of privacy if the matter publicized or the act of the publication (a) would be highly offensive to a reasonable person and (b) is not of legitimate concern to the public. The defendant posted on the Internet a privately shared and highly personal intimate video of the plaintiff. In doing so, he made public an aspect of the plaintiff’s private life. A reasonable person would find such activity to be highly offensive. It was readily apparent that there was no legitimate public concern in the defendant doing so.”

In a similar case on almost identical facts (they usually are), Jane Doe 72511 v. N.M., [2018] O.J. No. 5741, 2018 ONSC 6607, 143 O.R. (3d) 277, 53 C.C.L.T. (4th) 289, 2018 CarswellOnt 18310, the court once again recognized the availability of the tort of public disclosure of private facts. The plaintiff was also physically abused by the defendant, including while she was pregnant. On one of many documented occasions, while seven months pregnant, he dragged her down the stairs, choked her, threatened her with a knife, and forced her out of the house. On one such occasion he was arrested and convicted of assault.

That wasn’t enough for this guy. He later posted a sexually explicit video of the plaintiff without her knowledge or consent on a pornographic website. The video was entitled “yellow hoe sucking a big toe.” The plaintiff was clearly visible in the video and by the time she learned about it and persuaded the website administrator to remove it, the video was viewed over 60,000 times (again, it was impossible to know how may times it was otherwise downloaded or shared). When the plaintiff confronted him about the video, his response was “I have a criminal record for life, ur [sic] a[n] internet whore for kife [sic] … fair trade.”

The plaintiff successfully sued the defendant for various causes of action, including public disclosure of private information, for which she specifically obtained damages in the amount of $50,000 for general damages, $25,000 for aggravated damages, and $25,000 for punitive damages.

Publication (or Public Disclosure) of Private Facts – The Legal Test

These revenge porn cases have outlined a legal test for future plaintiffs when suing for publication (or public disclosure) of private facts; accordingly, a plaintiff must prove the following elements:

That the defendant publicized an aspect of the plaintiff’s private life;
That the plaintiff did not consent to the publication;
That the matter publicized (or the act of the publication) would be highly offensive to a reasonable person; and
That the publication was not of legitimate concern to the public (i.e. sexual relations normally being entirely private matters).

The post Ontario Privacy Torts: Monetary Damages in Revenge Porn Cases appeared first on Defamation & Business Litigation Lawyers Toronto | Grigoras Law.