A Supreme Court of Canada decision shows that federal privacy provisions will not always be a bar to some sensitive information being disclosed, depending on the factual circumstances.
The ruling in Royal Bank of Canada v. Trang is also one of only a handful of times the country’s highest court has been asked to interpret the Personal Information Protection and Electronic Information Act since it became law in 2000.
Where there is a range of opinion, though, is whether the Supreme Court’s analysis in Trang will have a broader application and potentially impact other areas such as the “Do Not Call” and “anti-spam” regulations that currently apply to businesses.
Kirsten Thompson, a partner at McCarthy Tétrault LLP in Toronto, says the decision “sets out the fence posts” of what will be permissible in terms of disclosure of private information under the federal statute on the basis of implied consent.
“You can’t just shelter behind PIPEDA,” says Thompson, who heads the firm’s cybersecurity, privacy and data protection group.
The Office of the Privacy Commissioner of Canada was appointed as amicus curiae in the hearing since the Trangs did not participate in the litigation.
Patricia Kosseim, its senior general counsel and director general, agrees with Thompson that the decision provides guidance on how to approach issues such as whether there has been implied consent.
“The most helpful thing in this decision is the analytical framework,” says Kosseim.
The path that ended up at the Supreme Court began in 2008 when the Royal Bank lent $35,000 to the Trangs.
They defaulted on the loan and in 2010 the bank obtained a judgment against the couple. RBC filed a writ of seizure and sale with the sheriff in Toronto.
The sheriff, however, refused to sell the property without obtaining a mortgage discharge statement from Scotiabank. It refused to provide the statement on the basis that it was not permitted to do so under PIPEDA, without the approval of the Trangs.
RBC was unsuccessful in Ontario Superior Court and the Court of Appeal in motions to compel Scotiabank to produce the mortgage discharge statement. Scotiabank was a named respondent, but it did not participate in the litigation.
The Ontario Court of Appeal, in a 3-2 decision, concluded that a mortgage discharge statement is “personal information” for the purposes of the federal privacy legislation.
As well, it found that the Trangs did not provide an implied consent to the information being disclosed. The majority decision suggested that RBC could have obtained consent with a term in its original loan agreement or through a specific rule of Civil Procedure (60.18(6) (a)) to examine a representative of Scotiabank.
The Supreme Court, in its ruling, sided with the dissenting decision in the Court of Appeal that was issued by Justice Alexandra Hoy.
She stated that someone taking out a mortgage would reasonably expect the mortgagee was entitled to provide a mortgage discharge statement based on the facts of this case.
PIPEDA governs the collection and disclosure of personal information by organizations in the course of commercial activities. The Supreme Court decision, written by Justice Suzanne Côté, referred to a published guide about the provisions that refer to them as consumer protection legislation for the digital economy.
“PIPEDA does not set out a blanket prohibition on disclosure without knowledge and consent,” wrote Côté.
She stated that financial information is generally private, but whether there has been implied consent to its disclosure depends on the factual circumstances.
Mortgage principal, rate of interest, payment periods and the due date are already publicly available through land registration searches.
“I find that the information at issue is less sensitive than other financial information,” wrote Côté.
“Here, RBC is seeking disclosure regarding the very asset it is entitled to, and intends to, realize on. It would be unreasonable for a borrower to expect that as long as he refused to comply with his obligation to provide information, his creditor would never be able to recover the debt.”
Martin Sclisizzi, a partner at Borden Ladner Gervais LLP in Toronto, says the Supreme Court was correct in not reading too much into the privacy legislation.
“A creditor is entitled to enforce without too many hoops to have to jump through. For debtors, you can run, but you cannot hide,” says Sclisizzi, a commercial litigator who has acted for clients on privacy-related issues.
The Supreme Court stressed that RBC was exercising its legal rights and that a financial institution should not disclose a mortgage discharge statement to an entity without a legal interest in the property.
The privacy commissioner argued at the Supreme Court that there was not implied consent to release the mortgage information.
However, the ruling makes it clear that each case will turn on its facts, says Kosseim.
“This is a highly context-sensitive analysis,” she says.
The ruling “gives us considerations to help infer the sensitivity of the information” in future cases, she adds. Thompson agrees that whether to disclose certain information will always be a balancing act.
The ruling in Royal Bank of Canada v. Trang is also one of only a handful of times the country’s highest court has been asked to interpret the Personal Information Protection and Electronic Information Act since it became law in 2000.
Where there is a range of opinion, though, is whether the Supreme Court’s analysis in Trang will have a broader application and potentially impact other areas such as the “Do Not Call” and “anti-spam” regulations that currently apply to businesses.
Kirsten Thompson, a partner at McCarthy Tétrault LLP in Toronto, says the decision “sets out the fence posts” of what will be permissible in terms of disclosure of private information under the federal statute on the basis of implied consent.
“You can’t just shelter behind PIPEDA,” says Thompson, who heads the firm’s cybersecurity, privacy and data protection group.
The Office of the Privacy Commissioner of Canada was appointed as amicus curiae in the hearing since the Trangs did not participate in the litigation.
Patricia Kosseim, its senior general counsel and director general, agrees with Thompson that the decision provides guidance on how to approach issues such as whether there has been implied consent.
“The most helpful thing in this decision is the analytical framework,” says Kosseim.
The path that ended up at the Supreme Court began in 2008 when the Royal Bank lent $35,000 to the Trangs.
They defaulted on the loan and in 2010 the bank obtained a judgment against the couple. RBC filed a writ of seizure and sale with the sheriff in Toronto.
The sheriff, however, refused to sell the property without obtaining a mortgage discharge statement from Scotiabank. It refused to provide the statement on the basis that it was not permitted to do so under PIPEDA, without the approval of the Trangs.
RBC was unsuccessful in Ontario Superior Court and the Court of Appeal in motions to compel Scotiabank to produce the mortgage discharge statement. Scotiabank was a named respondent, but it did not participate in the litigation.
The Ontario Court of Appeal, in a 3-2 decision, concluded that a mortgage discharge statement is “personal information” for the purposes of the federal privacy legislation.
As well, it found that the Trangs did not provide an implied consent to the information being disclosed. The majority decision suggested that RBC could have obtained consent with a term in its original loan agreement or through a specific rule of Civil Procedure (60.18(6) (a)) to examine a representative of Scotiabank.
The Supreme Court, in its ruling, sided with the dissenting decision in the Court of Appeal that was issued by Justice Alexandra Hoy.
She stated that someone taking out a mortgage would reasonably expect the mortgagee was entitled to provide a mortgage discharge statement based on the facts of this case.
PIPEDA governs the collection and disclosure of personal information by organizations in the course of commercial activities. The Supreme Court decision, written by Justice Suzanne Côté, referred to a published guide about the provisions that refer to them as consumer protection legislation for the digital economy.
“PIPEDA does not set out a blanket prohibition on disclosure without knowledge and consent,” wrote Côté.
She stated that financial information is generally private, but whether there has been implied consent to its disclosure depends on the factual circumstances.
Mortgage principal, rate of interest, payment periods and the due date are already publicly available through land registration searches.
“I find that the information at issue is less sensitive than other financial information,” wrote Côté.
“Here, RBC is seeking disclosure regarding the very asset it is entitled to, and intends to, realize on. It would be unreasonable for a borrower to expect that as long as he refused to comply with his obligation to provide information, his creditor would never be able to recover the debt.”
Martin Sclisizzi, a partner at Borden Ladner Gervais LLP in Toronto, says the Supreme Court was correct in not reading too much into the privacy legislation.
“A creditor is entitled to enforce without too many hoops to have to jump through. For debtors, you can run, but you cannot hide,” says Sclisizzi, a commercial litigator who has acted for clients on privacy-related issues.
The Supreme Court stressed that RBC was exercising its legal rights and that a financial institution should not disclose a mortgage discharge statement to an entity without a legal interest in the property.
The privacy commissioner argued at the Supreme Court that there was not implied consent to release the mortgage information.
However, the ruling makes it clear that each case will turn on its facts, says Kosseim.
“This is a highly context-sensitive analysis,” she says.
The ruling “gives us considerations to help infer the sensitivity of the information” in future cases, she adds. Thompson agrees that whether to disclose certain information will always be a balancing act.
