|
Privacy - PIPEDA (Personal Information Protection and Electronic Documents Act)
MORE CASES
Part 2 | Part 3 | Part 4
. Royal Bank of Canada v Trang
In Royal Bank of Canada v Trang (Ont CA, 2014) the Court of Appeal set out some basic principles respecting the PIPEDA (Personal Information Protection and Electronic Documents Act), in the context of deciding whether a bank was prevented by PIPEDA from providing another bank with a mortgage discharge statement. The court extensively considered several privacy issues, including whether there was implicit consent to such release under the Act, and it's earlier ruling on a similar issue in Citi Cards Canada Inc. v. Pleasance (Ont CA, 2011):C. PIPEDA
[10] PIPEDA is a federal statute, enacted nearly 15 years ago in recognition of the era of technology in which we now live. It is, as this court said in Royal Bank of Canada v. Welton,[4] a “privacy statute.” Subject to specified exemptions, it protects individuals’ right to privacy in their personal information, defined simply and very broadly as “information about an identifiable individual”. Part 1 of PIPEDA, which is the part of the Act relevant to this appeal, deals with “protection of personal information in the private sector.”
[11] Although PIPEDA is federal legislation, it applies across Canada unless it has been displaced by provincial legislation that the Governor-in-Council by order has declared is substantially similar to PIPEDA. Ontario has not enacted a substantially similar privacy law of general application in the private sector. Thus PIPEDA governs the commercial activities of all Ontario lending institutions, whether provincially regulated or federally regulated as are RBC and Scotiabank.
[12] Section 3 of PIPEDA sets out the purpose of Part 1:3. The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances. [13] The Supreme Court of Canada has recognized the important role of privacy in our society. In commenting on the similarly worded purpose of Alberta’s Personal Information Protection Act, S.A. 2003, c. P-6.5, the court said:The focus is on providing an individual with some measure of control over his or her personal information: Gratton, at pp. 6 ff. The ability of individuals to control their personal information is intimately connected to their individual autonomy, dignity and privacy. These are fundamental values that lie at the heart of a democracy. As this Court has previously recognized, legislation which aims to protect control over personal information should be characterized as “quasi-constitutional” because of the fundamental role privacy plays in the preservation of a free and democratic society. See Alberta (Information and Privacy Commissioner) v. United Food and Commercial Workers, Local 401, 2013 SCC 62 (CanLII), [2013] 3 S.C.R. 733, at para. 19.
[14] The overarching purpose of Part 1 of PIPEDA, set out in s. 3, is reproduced as an express requirement in s. 5(3) of the Act:5. (3) An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. [15] In other words, PIPEDA seeks to balance individuals’ right to privacy in their personal information with organizations’ need to collect, use and disclose that information in their commercial activities. See Englander v. Telus Communications Inc., 2004 FCA 387 (CanLII), [2005] 2 F.C.R. 572, at paras. 38-40.
[16] Consent is a cornerstone of PIPEDA. Collection, use or disclosure of personal information ordinarily requires an individual’s knowledge and consent. An organization may collect, use or disclose personal information without an individual’s knowledge or consent only in the limited circumstances enumerated in s. 7 of the Act. So, for example, s. 7(3) sets out the circumstances in which an organization may disclose personal information without an individual’s knowledge or consent. The exemptions in ss. 7(3)(c) and (i) were the two exemptions argued in Citi Cards:7. (3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is
…
(c) required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;
…
(i) required by law. These limited exceptions in s. 7 attempt to strike the appropriate balance, reflected in s. 3, between privacy rights and organizational needs.
[17] The provisions of the Act must be read together with Schedule 1, which lists ten key principles for the protection of personal information.[5] The principles contain both obligations and recommendations for organizations. Under s. 5(1) of the Act, and subject to ss. 6 to 9, organizations must comply with the obligations set out in the Schedule.
[18] Clause 4.3 of the Schedule deals with principle three – consent. This principle and the other nine principles are not written in typically legal language. Clause 4.3.1 provides that consent is required for the disclosure of personal information and that usually an organization will seek that consent at the time of collection:4.3.1 Consent is required for the collection of personal information and the subsequent use or disclosure of this information. Typically, an organization will seek consent for the use or disclosure of the information at the time of collection. In certain circumstances, consent with respect to use or disclosure may be sought after the information has been collected but before use (for example, when an organization wants to use information for a purpose not previously identified). [19] Clause 4.3.5 provides that “[i]n obtaining consent, the reasonable expectations of the individual are also relevant.”
[20] Clause 4.3.6 is the clause of the Schedule RBC relies on in this court. That clause distinguishes between “sensitive” and “less sensitive” information and introduces the notion of implied consent for less sensitive information:4.3.6 The way in which an organization seeks consent may vary, depending on the circumstances and the type of information collected. An organization should generally seek express consent when the information is likely to be considered sensitive. Implied consent would generally be appropriate when the information is less sensitive. Consent can also be given by an authorized representative (such as a legal guardian or a person having power of attorney). I will return to this provision when I discuss RBC’s main ground of appeal.
..........
E. Analysis
[31] In this court, apart from its submission on the Execution Act, RBC does not rely on either of the two exemptions in s. 7(3) of PIPEDA, which were at issue in Citi Cards. Instead it relies mainly on cl. 4.3.6 of Schedule 1 and s. 3 of the Act to authorize Scotiabank to disclose the mortgage discharge statement. It also argues that Citi Cards is distinguishable because unlike the judgment creditor in that case, RBC has pursued all of its alternative remedies. And it first contends that the mortgage discharge statement is not even “personal information” of the debtors.
First Issue: Is the mortgage discharge statement “personal information” of the debtors?
[32] In oral argument, RBC took the position that the mortgage discharge statement it seeks was not even “personal information” of the Trangs. It pointed out that all the details of the Trangs’ mortgage – the principal amount, the rate of interest, the payment periods and the due date – were made publicly available when the mortgage was registered. Therefore the Trangs could not claim a privacy interest in the mortgage discharge statement as that statement would simply set out the current principal and interest owing on the mortgage at the time RBC asked the Sheriff to sell the property.[7]
[33] I do not agree with RBC’s position. I accept that the financial details of the Trangs’ mortgage, when it was registered, are on the public record in the Ontario Land Registry System. That they are is authorized both by Ontario regulation and by PIPEDA. The Ontario legislature decided to make the details of a mortgage publicly available at the time a mortgage is registered, that is at the beginning of the mortgagor/mortgagee relationship: see O. Reg. 19/99 (Electronic Registration), s. 6, passed under the Land Registration Reform Act.[8]
[34] In turn, s. 7(3)(h.1) of PIPEDA recognizes that consent is not required for the disclosure “of information that is publicly available and is specified by the regulations.” But under s. 1(c) of the Regulations Specifying Publicly Available Information,[9] the only information that is considered publicly available for the purpose of s. 7(3)(h.1) of the statute is “personal information that appears in a registry collected under a statutory authority and to which a right of public access is authorized by law”.
[35] Thus mortgagors, such as the Trangs, cannot claim a privacy interest in the financial details of their mortgage at the time their mortgage is registered. Provincial regulation requires those financial details be made publicly available, and their public availability is authorized by PIPEDA and the regulations under it.
[36] Current mortgage balances, however, are not publicly available information in the Ontario Land Registry System or under PIPEDA. Yet it can hardly be denied that a current mortgage balance is, under PIPEDA, personal information of a mortgagor – it is “information about an identifiable individual.” Nor can it be said that the Trangs have waived any privacy interest in their current mortgage balances simply because the details of their mortgage at the time of registration are on the public record. For these reasons, RBC’s argument that the mortgage discharge statement is not personal information of the Trangs must fail.
Second Issue: Does cl. 4.3.6 of Schedule 1 to PIPEDA permit Scotiabank to provide a mortgage discharge statement to RBC?
[37] This is the main issue in this appeal. RBC’s submission on this issue has two branches: the first branch is that this court’s decision in Citi Cards was per incuriam because it did not consider cl. 4.3.6 of Schedule 1. Therefore stare decisis does not bind us to follow Citi Cards; we are free to come to a different decision. The second branch is that even if the per incuriam exception to stare decisis does not apply, Citi Cards is wrong because it failed to give effect to cl. 4.3.6 of Schedule 1. RBC argues that in accordance with that clause, Scotiabank had the Trangs’ implied consent to disclose the mortgage discharge statement to a judgment creditor. We should therefore overrule our court’s previous decision. I am not persuaded by either branch of RBC’s submission.
.....
(b) Scotiabank does not have the Trangs’ implied consent to disclose a mortgage discharge statement to RBC
[41] RBC makes two arguments why we should find that the Trangs impliedly consented to disclose a mortgage discharge statement: the statement contains “less sensitive” information; and to refuse disclosure would frustrate, inconvenience and unnecessarily increase the cost of enforcing a lawfully obtained judgment.
[42] Amicus responds by arguing that a mortgage discharge statement contains sensitive financial information for which express consent for disclosure is required, that implied consent to disclose is not within the reasonable expectations of the mortgagor, and that RBC had other means to obtain the statement.
(i) Implied consent
[43] Under cl. 4.3.1 of Schedule 1, consent is required for the disclosure of personal information. The Trangs have not expressly consented to disclosure of a mortgage discharge statement to RBC. Clause 4.3.6 of Schedule 1, however, includes the notion of implied consent for the disclosure of personal information. For convenience, I reproduce the clause:4.3.6 The way in which an organization seeks consent may vary, depending on the circumstances and the type of information collected. An organization should generally seek express consent when the information is likely to be considered sensitive. Implied consent would generally be appropriate when the information is less sensitive. Consent can also be given by an authorized representative (such as a legal guardian or a person having power of attorney). [44] To determine whether an individual impliedly consents to disclosure, two considerations are relevant: the sensitivity of the information in question; and the reasonable expectations of the individual. The first consideration is found in cl. 4.3.6 itself; the second consideration is found in cl. 4.3.5.[10]
(ii) Sensitivity of the information
[45] PIPEDA does not define “sensitive” and “less sensitive” information, or the circumstances in which consent may be implied. Clause 4.3.6 of Schedule 1 does, however, establish a link between the sensitivity of the information and the appropriate form of consent.
[46] Where information is likely sensitive, an organization should seek express consent. And under cl. 4.3.4 of Schedule 1, any information can be sensitive depending on the context:4.3.4 The form of the consent sought by the organization may vary, depending upon the circumstances and the type of information. In determining the form of consent to use, organizations shall take into account the sensitivity of the information. Although some information (for example, medical records and income records) is almost always considered to be sensitive, any information can be sensitive, depending on the context…. [47] Where information is less sensitive, consent may be implied. But even less sensitive information may, depending on the context, require express consent. The important point, however, is that the sensitivity of the information must be assessed in the overall context of the relationship between the organization and the individual – here, between Scotiabank and the Trangs. In assessing that sensitivity, the relationship between the Trangs and RBC has no role to play. As Blair J.A. said in Citi Cards, at para. 23, “[t]he Act does not contemplate a balancing between the privacy rights of the individual and the interests of a third-party organization”.
[48] Nonetheless, RBC submits that the information in a mortgage discharge statement is less sensitive information. Therefore the Trangs can be taken to have impliedly consented to its disclosure. RBC contends that as the details of the mortgage at the beginning of the mortgagor/mortgagee relationship are publicly available, the details during the course of that relationship can hardly be considered sensitive information.
[49] It is tempting to agree with RBC’s submission and conclude that any mortgagor must be taken to have impliedly consented to the disclosure to a judgment creditor of the money owing on one of the mortgagor’s assets. After all, as RBC points out, earlier disclosure is mandated by regulation. Disclosure at a later time would reflect the balance owing on the same asset; only the amount would differ. And not to imply consent would seem to serve no purpose other than to assist the Trangs, and mortgagors in their position, in avoiding payment of a lawfully obtained judgment against them.
[50] This temptation, however, runs up against the very broad protection the Act affords to the privacy of an individual’s personal information. Undoubtedly, the amount the Trangs owe on their mortgage is, to them, personal information, even though it seems to be just a number.
[51] Yet it is not just a number. The balance owing on a person’s mortgage can be an important piece of private information that opens a window to many aspects of that person’s financial profile. It indicates financial worth. It measures how a person deals with financial liabilities. It opens a portal to a person’s financial stability or instability. In many contexts, the disclosure of this seemingly innocuous information to a third party without consent may affect a person’s interests adversely. Even the timing of the disclosure could be sensitive.
[52] And, how is Scotiabank to assess the sensitivity of the information so that it can say its customers, the Trangs, impliedly consented to disclosure to another bank? It is one thing for Scotiabank to invoke implied consent to advance its own needs. It is quite another for Scotiabank to invoke implied consent to advance the needs of a third party.
[53] This temptation to find implied consent also runs up against the language and scheme of the Act. The language of the consent principle in the Schedule does not support RBC’s position. For example, as is evident from cl. 4.3.4, income records of an individual are almost always considered sensitive information. A mortgage discharge statement is like an income record in the sense that it contains personal financial information of the mortgagor, often of a significant financial asset. And, as I have said, both express and implied consent under the Schedule focus on the relationship between the organization and the individual, not on a stranger to that relationship.
[54] Thus I do not agree with RBC’s submission. It seems to me that the information in a mortgage discharge statement is sensitive information for which the mortgagee would need the mortgagor’s express consent to disclose to a third party, such as a judgment creditor. And, Scotiabank does not have the Trangs’ express consent to do so.
[55] A current mortgage balance is not publicly available information. Just because the legislature chose to make the details of a mortgage publicly available at the beginning of the mortgage relationship does not strip a mortgage balance during the course of a mortgage relationship of the sensitivity it would ordinarily have – a sensitivity for which implying consent to disclosure would be inappropriate. As the Supreme Court said in the Alberta (Information and Privacy Commissioner) case: “The ability of individuals to control their personal information is intimately connected to their individual autonomy, dignity and privacy.”
[56] Moreover, the context in which disclosure is sought increases the sensitivity of the information. Disclosure is not sought by the “organization”, in this case by the mortgagee, Scotiabank, but by a stranger to the mortgage relationship: RBC, a third party judgment creditor. In that context, information about the state of the Trangs’ mortgage is sensitive information. In reality it is information about the debtors themselves and about their financial situation. To disclose that information to a judgment creditor without a court order requires their express consent.
(iii) Reasonable expectations of the individual
[57] Clause 4.3.5 of Schedule 1 provides that “[i]n obtaining consent, the reasonable expectations of the individual are also relevant.” Even if a current mortgage balance can be considered “less sensitive” information, disclosure of a discharge statement to a judgment creditor is not within the reasonable expectations of a mortgagor.
[58] An individual’s reasonable expectations must be assessed objectively. That objective assessment flows from s. 5(3) of the statute, which provides that an organization may “disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.” But, to repeat what Blair J.A. noted in Citi Cards, that assessment must focus on the relationship between the individual and the organization – here between the Trangs and Scotiabank. The reasonable expectations of RBC, a stranger to that relationship, are irrelevant in deciding whether implying consent to disclosure is appropriate.
[59] What then are the reasonable expectations of a mortgagor who gives a mortgage to a bank? I think the Trangs could reasonably expect two things from Scotiabank. First, they could expect the protection of their personal information afforded by the common law. And the common law has long recognized that a bank owes a duty to keep a customer’s personal information confidential. A bank ought not to disclose that information without the customer’s consent, unless required to do so by law, court order or some overriding public duty,[11] or unless the bank’s own interests require disclosure. See M.H. Ogilvie, Bank and Customer Law in Canada, 2d ed. (Toronto: Irwin Law, 2013), at pp. 324-38; Tournier v. National Provincial and Union Bank of England, [1924] 1 K.B. 461 (C.A.).
[60] Under this last exception, Scotiabank could collect, use and disclose personal information concerning the Trangs to administer and, if necessary, enforce its mortgage. In doing so, Scotiabank would be legitimately protecting its own interests.
[61] Second, the Trangs could also reasonably expect that if Scotiabank were going to disclose their personal information for a purpose unrelated to the administration or enforcement of the mortgage, it would obtain the Trangs’ consent. In other words, personal information legitimately collected for one purpose should not be disclosed for an entirely different purpose without the individual’s consent. Indeed, cl. 4.2.4 of Schedule 1 to PIPEDA so provides:4.2.4 When personal information that has been collected is to be used for a purpose not previously identified, the new purpose shall be identified prior to use. Unless the new purpose is required by law, the consent of the individual is required before information can be used for that purpose…. [62] Thus I agree with Blair J.A.’s comment, at para. 23 of his reasons in Citi Cards: “This information is collected and used by the Banks for purposes of administering the mortgage; it is not collected or used for purposes of facilitating another judgment creditor’s execution on its judgment.”
[63] In summary, both the sensitivity of the information and the Trangs’ reasonable expectations supported Scotiabank’s refusal to disclose the mortgage discharge statement to RBC without the Trangs’ express consent.
(iv) Costs, inconvenience and other means to obtain the discharge statement
[64] RBC had two ways to obtain the mortgage discharge statement from Scotiabank: by a term in its loan agreement with the Trangs or by a court-ordered examination under rule 60.18(6)(a) of the Rules of Civil Procedure. The first would have eliminated any costs or inconvenience to RBC; the second would impose some modest costs and inconvenience. I will discuss these two alternatives in more detail after addressing RBC’s other grounds of appeal.
Third Issue: Does s. 3 of PIPEDA permit Scotiabank to provide a mortgage discharge statement to RBC?
[65] RBC relies on s. 3 of the Act, which for convenience I reproduce here:3. The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances. [66] RBC emphasizes the concluding words of s. 3 – “for purposes that a reasonable person would consider appropriate in the circumstances.” And as I have said, those words also appear in s. 5(3) of the Act. RBC submits that “a reasonable person would believe it to be reasonable to order the disclosure of the balance owing on a mortgage when the alternative would be frustrating the enforcement of a judgment which has been lawfully obtained through court process.”
[67] Even if one were to accept the “reasonableness” of RBC’s position, its submission on s. 3 or s. 5 cannot succeed. Neither is an independent basis for authorizing disclosure under PIPEDA. Section 3 emphasizes that the purposes for which an organization may collect, use or disclose information are those that a reasonable person would consider appropriate in the circumstances. And s. 5(3) obligates an organization to collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.
[68] Indeed, by its wording, s. 5(3) applies in addition to the requirement of consent. But neither s. 3 nor s. 5(3) is an alternative to obtaining consent or an exception to the need for consent. An organization that collects, uses or discloses personal information for a purpose consistent with ss. 3 and 5(3) will nonetheless contravene PIPEDA if it fails to obtain the affected individual’s consent, unless an exception to the requirement for consent applies.
[69] I would not give effect to this ground of appeal.
......
Fifth Issue: Is Citi Cards distinguishable?
[73] In Citi Cards, the motion judge held, and Blair J.A. agreed, that the judgment creditor had not exhausted its alternate remedies because it had not tried to examine the debtor’s wife. In this appeal, RBC submits that it has exhausted its alternate remedies because it has twice tried to examine the Trangs, each time without success. It therefore submits that because it took reasonable steps to obtain the mortgage statement from the debtors, it should be entitled to that statement from Scotiabank.
[74] The motion judge rejected this submission. In his view, that RBC had exhausted other means to obtain the statement did not add to its substantive argument that it was entitled to the statement under PIPEDA. Although I agree with the motion judge, as Blair J.A. noted in Citi Cards, and as I will discuss, where a judgment creditor has exhausted other means to obtain a mortgage statement, that will be a relevant consideration when a court decides whether to exercise its discretion to order the mortgagee to produce the statement on a motion under rule 60.18(6). Subject to this caveat, I would not give effect to this ground of appeal.
Means to obtain the mortgage discharge statement
[75] RBC could have obtained the mortgage discharge statement in one of two ways: either by a term in its loan agreement with the Trangs or by a motion under rule 60.18(6)(a) of the Rules of Civil Procedure.
(a) The loan agreement
[76] With foresight, RBC could have obtained the Trangs’ consent to the disclosure of a mortgage discharge statement by a term in its loan agreement. For example, the term might have provided that if the Trangs defaulted on their loan and RBC obtained a judgment against them, then for the purpose of enforcing the judgment, the Trangs would agree that any mortgagee of their property could deliver a mortgage discharge statement to RBC. The Trangs’ express consent to disclosure of the discharge statement in the loan agreement would be sufficient to meet the requirements of PIPEDA and for Scotiabank to deliver the discharge statement to RBC. However, RBC did not obtain the Trangs’ consent in its loan agreement.
(b) A motion under rule 60.18(6)(a)
[77] Although RBC did not obtain the Trangs’ consent in its loan agreement, it can still seek to obtain the mortgage discharge statement by a motion under rule 60.18(6)(a) of the Rules of Civil Procedure. That rule states:60.18(6) Where any difficulty arises concerning the enforcement of an order, the court may,
(a) make an order for the examination of any person who the court is satisfied may have knowledge of the matters set out in subrule (2). Under rule 1.03(1), an order includes a judgment. To obtain an order under rule 60.18(6), the party seeking the order must show a “difficulty” in enforcing its judgment. What is a “difficulty” for the purpose of the rule? I think “difficulty” will have to be assessed case by case. But the refusal of the Sheriff to sell without a discharge statement is not a “difficulty” that entitles the execution creditor to go directly to rule 60.18(6) before at least attempting other means to obtain the information. In exercising their discretion under rule 60.18(6), courts should be reticent to require strangers to the litigation to appear on a motion.
[78] Our court has already endorsed this approach in commenting on Rule 591, the predecessor to rule 60.18(6). In Canadian Imperial Bank of Commerce v. Sutton (1981), 1981 CanLII 1886 (ON CA), 34 O.R. (2d) 482, at p. 484, Lacourcière J.A. wrote:Caution, however, should be exercised by a judge before whom an application is made so that persons who are strangers to the litigation are not unduly harassed by examinations. The relatives of a judgment debtor or a stranger should not be ordered to be examined unless the judgment creditor has exhausted all means available before resorting to an application of this kind. However, the wording of the Rule leaves it to the discretion of the court to make an order where a difficulty arises in the execution or enforcement of a judgment. [79] Here, RBC can show “difficulty” in enforcing its judgment, both because the Trangs failed to appear for two judgment debtor examinations and because Scotiabank will not produce a discharge statement. Therefore, RBC can resort to a rule 60.18(6)(a) motion. It can seek an order to examine a representative of Scotiabank.
[80] Moreover, under rules 34.10(2)(b) and (3), Scotiabank would be required to bring to the examination and produce a discharge statement:34.10(2) The person to be examined shall bring to the examination and produce for inspection,
…
(b) on any examination, including an examination for discovery, all documents and things in his or her possession, control or power that are not privileged and that the notice of examination or summons to witness requires the person to bring.
(3) Unless the court orders otherwise, the notice of examination or summons to witness may require the person to be examined to bring to the examination and produce for inspection,
(a) all documents and things relevant to any matter in issue in the proceeding that are in his or her possession, control or power and are not privileged; or
(b) such documents or things described in clause (a) as are specified in the notice or summons. [81] An order made under rules 60.18(6)(a) and 34.10 is an order that would permit Scotiabank to disclose the mortgage discharge statement to RBC without the Trangs’ consent. It would satisfy the exemption in s. 7(3)(c) of PIPEDA.[12] The motion that RBC twice brought to compel Scotiabank to produce a discharge statement would not satisfy that exemption.
[82] Section 7(3)(c) of PIPEDA authorizes an organization (Scotiabank) to disclose personal information (a mortgage discharge statement) without the individual's (Trangs') knowledge and consent if disclosure is required to comply with a court order or the rules of court relating to the production of records. By its wording, s. 7(3)(c) does not itself authorize disclosure. Instead, it authorizes disclosure without consent if the order for disclosure is based on an authority or rule separate from PIPEDA. This distinction is important because it gives effect to PIPEDA's objective: to protect an individual's right of privacy and to permit only narrow exceptions to that right.
[83] This important distinction is evident in this case. RBC did not obtain an order on a motion under rule 60.18(6)(a). Instead, it simply brought a motion – not once, but twice – to require Scotiabank to produce the discharge statement. It could succeed on that motion only if the exemption in s. 7(3)(c) authorized disclosure. But it does not. It is, as Blair J.A. wrote in Citi Cards, at para. 25, "circular" to say Scotiabank is required to disclose a discharge statement "because disclosure is required by an order not yet made."[13]
[84] In contrast, an order made on a motion under rules 60.18(6)(a) and 34.10 is a court order made on the basis of a separate authority or "rules of court" – our Rules of Civil Procedure. An order under these rules does not engage "circular" reasoning.[14] It is grounded in specific procedural rules, which satisfy the exemption in s. 7(3)(c) of PIPEDA. On a successful motion under rules 60.18(6)(a) and 34.10, Scotiabank would be required, in the words of the exemption, "to comply with ... an order made by a court ... to compel the production of information, or to comply with rules of court relating to the production of records".
[85] My colleague suggests that “[i]t would fly in the face of increasing concerns about access to justice in Canada to dismiss this appeal and require RBC to bring yet another motion." Respectfully, I do not agree that RBC's access to justice has been imperilled. PIPEDA is a privacy statute. By passing it, Parliament has recognized the high value Canadians place on the privacy of their personal information. Exceptions, which allow our personal information to be disclosed without our knowledge or consent, are carefully and narrowly tailored. A party seeking disclosure without consent must satisfy the court that one of the narrow exceptions applies.
[86] RBC, which is hardly an unsophisticated lender, had a procedural route available to come within the exception in s. 7(3)(c) and obtain the discharge statement. In Citi Cards, Blair J.A. identified that procedural route as a motion under rule 60.18(6)(a). Instead, however, RBC twice sought to short-circuit this route by bringing a motion Citi Cards had already said would not satisfy the exception. And when RBC finally sought to examine Scotiabank, it did not bring a rule 60.18(6)(a) motion to obtain a court order, which is a prerequisite to coming within the exception. Instead, it asked only that a representative of Scotiabank appear for an examination voluntarily. Although a Scotiabank representative did so, she properly indicated that PIPEDA prevented her from disclosing the discharge statement without a court order or the Trangs' consent.
[87] A motion under rule 60.18(6)(a) undoubtedly would increase RBC’s cost and inconvenience in enforcing its judgment. Because RBC failed to obtain the Trangs’ express consent, that cost and inconvenience seem to be a small price to pay for protecting the Trangs’ privacy rights.
[88] As important, under rule 60.18(6)(a), the court has discretion whether to make the order requested. Because of this discretion, the court can act as a gatekeeper for the disclosure of personal information. That it has this role is entirely appropriate because it is in the best position to balance the interests of the various affected parties and determine whether disclosure is justified.
[89] In exercising its discretion, the court may, for example, take into account whether, as between the execution creditor and the judgment debtor, the information is sensitive, and whether the judgment creditor has exhausted other means to enforce its judgment. Here, that RBC has twice sought without success to examine the Trangs would be a relevant consideration. In other cases – and Citi Cards is an example – the court may be concerned to protect the interests of a spouse or co-mortgagor who is not a debtor.
F. Conclusion
[90] RBC may still bring a motion for an order to examine a representative of Scotiabank under rule 60.18(6)(a). .....
|
