Date: 20230403
Docket: T-1797-21
Citation: 2023 FC 456
Ottawa, Ontario, April 3, 2023
PRESENT: Madam Justice St-Louis
BETWEEN: |
ELSA JOSEPH |
Applicant |
and |
ATTORNEY GENERAL OF CANADA |
Respondent |
JUDGMENT AND REASONS
I. Introduction
[1] By way of an Application for judicial review, Ms. Elsa Joseph challenges two of the seven issues addressed in the final report of findings [the Report] the Office of the Privacy Commissioner of Canada [the Privacy Commissioner] made pursuant to section 35 of the Privacy Act, RSC, 1985, c P-21 [the Act].
[2] The Report, issued on October 28, 2021, followed the Privacy Commissioner’s investigation of the allegedly inappropriate disclosure of Ms. Joseph’s personal information on several occasions.
[3] As a brief context, in 2019, Ms. Joseph filed several complaints with the Privacy Commissioner, alleging that her employer, the Canada School of Public Service [the School] made several inappropriate disclosures of her personal information on multiple occasions. Essentially, Ms. Joseph submitted that the School contravened the Act when it disclosed her personal information to the Ottawa Police Service [the Ottawa Police], the Royal Canadian Mounted Police [the RCMP], the Bank of Canada and the School’s security, human resources and employees.
[4] The Privacy Commissioner investigated the complaints and made his Report. In his Report, he found five of Ms. Joseph’s seven complaints were either well-founded or partially well-founded, while he conversely found that two of Ms. Joseph’s complaints, those labelled Issue 1 and Issue 7 in the Report, were not well-founded. In regards to these two issues that were not well-founded, the Privacy Commissioner found (1) in regards to Issue 1, that the School disclosed Ms. Joseph’s personal information to the Ottawa Police for a use consistent with the purpose for which the information was obtained, per paragraph 8(2)(a) of the Act and as interpreted by the Supreme Court of Canada in Bernard v Canada, 2014 SCC 13 at paragraph 31 [Bernard]; and (2) in regards to Issue 7, first that the School’s ombudsman disclosed Ms. Joseph’s personal information to the School security for the purpose for which it was obtained, and second, that he could not confirm that a disclosure related to Ms. Joseph’s workplace violence complaint had occurred.
[5] In her Application before the Court, Ms. Joseph submits, essentially, that (1) the correctness standard applies; (2) her right to procedural fairness was violated; (3) the disclosures violated the Act; and (4) there was an unreasonable search and seizure contrary to section 8 of the Canadian Charter of Rights and Freedoms, Part I of the Constitution Act, 1982, being Schedule B to the Canada Act 1982 (UK), 1982, c 11 [the Charter].
[6] The Attorney General of Canada [the AGC] responds that (1) there was no violation of procedural fairness; (2) the reasonableness standard applies to the Privacy Commissioner’s findings on Issues 1 and 7; (3) the Privacy Commissioner’s findings in regards to those two issues are reasonable; and (4) Ms. Joseph’s allegation of Charter breach was not before the Privacy Commissioner at the time the Report was prepared and the Court should therefore not entertain this argument.
[7] For the reasons detailed below, I will dismiss the Application for judicial review.
II. Context
[8] From 2018 to 2020, Ms. Joseph was an employee of the School; she was thus an employee at the time of the disclosures.
[9] The two issues at play in this proceeding, hence Issue 1 and Issue 7 of the Report, pertain to two distinct sets of events that occurred during Ms. Joseph’s employment. The first set of events (Issue 1) occurred in the period of February-March 2019 and the second set of events (Issue 7) occurred in or around December 2019.
[10] In regards to the context relating to Issue 1, on February 14, 2019, the School’s fax machine was used to send a requisition form for purchasing firearm parts to an American firearm manufacturer. The requisition form was left on the fax machine and, shortly thereafter, was found by an employee of the School who reported it to the School’s security. The requisition form contained the name and address of the person making the requisition, who was not an employee of the School, and who was thus unknown to the School security. On February 15, 2019, the School security reported the situation to the Ottawa Police as a “suspicious occurrence”
.
[11] On March 4, 2019, the School identified Ms. Joseph as the sender of the fax, as her address was found to be the same as the address that appeared on the requisition form, and the School also identified the name on the requisition form as Ms. Joseph’s then partner. On the same day, the School security disclosed Ms. Joseph’s name, date of birth and address to the Ottawa Police.
[12] On March 12, 2019, the School conducted a security interview with Ms. Joseph, and shortly after, it suspended her security clearance, and initiated a Review for Cause investigation to determine if her security clearance should be revoked or maintained.
[13] On March 14, 2019, the Ottawa Police informed the School security that the firearm parts referred to in the fax were legal and that it considered the matter closed on their end.
[14] On March 20, 2019, Ms. Joseph was informed that the Review for Cause had been completed and that she could return to work. On March 24, 2019, her security clearance was reinstated.
[15] On March 17, 2020, Ms. Joseph submitted privacy infringement complaints against the School to the Privacy Commissioner, alleging that the School disclosed her personal information to the Ottawa Police without her consent or knowledge. Ms. Joseph then submitted that the Ottawa Police is not an investigative body as per Schedule II of the Act and that the disclosure was not in accordance with the Treasury Board Secretariat policies or paragraph 8(2)(e) of the Act.
[16] In regards to Ms. Joseph’s complaints, the School first responded that the disclosure was authorized pursuant to paragraph 8(2)(e) of the Act, but the Privacy Commissioner disagreed. The Privacy Commissioner indicated in an email to the School that, without further information, he could only conclude that such disclosure was both unnecessary and unauthorized pursuant to paragraph 8(2)(e). The School later submitted that the disclosure was done for the purpose for which the information was obtained i.e., to ensure the security of the School and its employees.
[17] In his Report, the Privacy Commissioner seemingly agreed with the School that the information was obtained to ensure the security of the School and its employees. However, the Privacy Commissioner did not agree with the School that the information was disclosed “for the purpose”
for which the information was obtained, but he found that the disclosure was made for a use “consistent with”
the purpose for which it was compiled, that is, reporting the issue to the police. The Privacy Commissioner relied on the Supreme Court of Canada’s decision in Bernard for the interpretation of the use “consistent with”
exception of paragraph 8(2)(a) of the Act. He indicated that the Supreme Court had set the test and he stated that the question, when assessing whether the use was, or not, “consistent with”
, was to determine whether there was a sufficiently direct connection between the purpose for which the information was compiled and the use for which it was disclosed (Bernard at para 31).
[18] Ultimately, having found that the disclosure was made for a use “consistent with”
the purpose for which it was compiled, per paragraph 8(2)(a) of the Act, the Privacy Commissioner found the complaint with respect to Issue 1 not well-founded.
[19] Regarding Issue 7, on December 11, 2019, an employee came to the School’s ombudsman with information about Ms. Joseph’s mental health. The employee alleged that Ms. Joseph made comments referring to “suicide”
and made statements of potential violence towards another employee of the School. The School’s ombudsman, stating that the situation was outside of his mandate, then relayed the information to the School security.
[20] The School security suspended Ms. Joseph’s security clearance and initiated a Review for Cause investigation in response to both the alleged threats made by Ms. Joseph to other School employees and the concerns about her own security as well.
[21] On March 17, 2020, Ms. Joseph submitted a privacy infringement complaint against the School to the Privacy Commissioner. She alleged that the School’s ombudsman inappropriately disclosed her personal medical information and the opinion that Ms. Joseph is a “threat”
to the School security without her consent or knowledge and that, on a separate occasion, the School’s ombudsman also disclosed information about her workplace violence complaints. Ms. Joseph alleged that those disclosures were not in accordance with Treasury Board Secretariat policies or the Act.
[22] The School submitted to the Privacy Commissioner that paragraph 8(2)(e) of the Act applied. Again, the Privacy Commissioner advised the School in an email that he disagreed and offered an opportunity to respond to his concerns (Tab 33A). In his Report, the Privacy Commissioner found confirmation that the ombudsman did disclose sensitive personal information to the School security, but the Privacy Commissioner found that the disclosure was authorized under paragraph 8(2)(a) of the Act. The Privacy Commissioner noted that, within his statement, the ombudsman had recounted an incident where a colleague of Ms. Joseph informed him that Ms. Joseph had made various threats. As such, the Privacy Commissioner found that the information suggested the potential for a security incident at the School and that the ombudsman needed to inform School security.
[23] The Privacy Commissioner noted that the ombudsman had collected the information from the other employee in order to address the issues raised by the said employee, and acknowledged that the appropriate channel to address the issues that had been raised was through the School security. The Privacy Commissioner found that the ombudsman disclosed the information for the purpose for which the information was obtained and that the disclosure was consistent with paragraph 8(2)(a) of the Act.
[24] With respect to the alleged inappropriate disclosure of information by the ombudsman to the School security in relation to Ms. Joseph workplace complaints, the Privacy Commissioner stated having reviewed all final reports prepared by the School with respect to Ms. Joseph, as well as the annexes and statements referred to by Ms. Joseph, and could not confirm that any such disclosure occurred.
[25] The Privacy Commissioner found the complaint with respect to Issue 7 not well-founded.
[26] On September 23, 2020, Ms. Joseph’s security clearance was revoked and, as a result, her employment was terminated.
III. Issues
[27] In light of the arguments raised by Ms. Joseph, I will examine first, the breach of procedural fairness allegations; second, the challenge on the merits of the Privacy Commissioner’s findings; and third, the Charter violation allegation.
A. Breach of procedural fairness allegations
(1) Parties’ position
[28] Preliminarily, Ms. Joseph submits that the correctness standard applies to this argument.
[29] First, Ms. Joseph submits that the judicial review process before this Court was unfair for the following reasons: (1) apprehension of bias by the Federal Court; (2) the Privacy Commissioner’s motions (motion for a confidentiality order over the contents of the Certified Tribunal Record, which was denied, and a motion to be removed as a respondent, which was granted by the Court) caused the Court process to take an excessive amount of time (more than five months) and no penalty was imposed on the Privacy Commissioner; and (3) Ms. Joseph requested a sample Notice of Constitutional Question from Federal Court Registry Staff on June 15, 2022, and only received the records on July 7, 2022; and the Court denied her the possibility to submit a constitutional question.
[30] Second, Ms. Joseph submits that the Privacy Commissioner completely disregarded the material before him and conducted his investigation with a closed mind and implicit bias. The factors she identifies as indicating the above include: (1) Ms. Joseph was not given the opportunity to provide evidence or submissions for Issue 1 since filing complaint PA-055744 in July 2019; (2) Ms. Joseph was not provided the opportunity to make comments about the omissions in the draft report, and the Privacy Commissioner did not address the Charter questions; (3) Ms. Joseph was not given the opportunity to respond to allegations of Issue 7 due to the refusal by the Privacy Commissioner investigator to provide employer submissions; (4) there is no neutrality in the titles which shows implicit bias; (5) the Privacy Commissioner mocks the complainant in his Report for the language she uses in describing her position, such as “investigations against”
her and “fatal impact”
; (6) the Report shows a lack of transparency by the Privacy Commissioner as he mentions Ms. Joseph’s submission, but fails to address its applicability; and (7) in the Report, the Privacy Commissioner shows conscious bias and fails to comply with his preamble mission of neutrality, impartiality, and objectivity.
[31] Third, Ms. Joseph alleges that the threshold of thoroughness is not met. She submits that (1) the Report lacks dates and details to confuse the reader into thinking there was only one investigation; (2) the primary Privacy Commissioner investigator did not speak French, while all of the School evidence and crucial pieces of evidence that he needed to scrutinize for Issue 7 were written in French, which impacted his ability to catch important inconsistencies in the School evidence. The review of this evidence was improperly delegated; and (3) the Privacy Commissioner only relied on the transcript of the ombudsman’s interview about the disclosure to the School’s security and failed to obtain the audio recordings which are the direct words of the individual, not hearsay. The audio recordings, she says, were necessary for due diligence purposes, i.e., to verify the accuracy of the ombudsman’s hearsay statements.
[32] Finally, Ms. Joseph submits the following material omissions by the Privacy Commissioner: (1) the Charter rights were ignored in the Report (see email in Tab 68A); (2) the Privacy Commissioner failed to meet his duty to notify Ms. Joseph’s partner as he was an affected party in the investigation (29(3) of the Act); (3) the School did not comply with its duty to notify the Privacy Commissioner in advance when it disclosed the information to the RCMP under subsection 8(5) of the Act (see paragraphs 8(2)(b) and 8(2)(m)(i) of the Act); and (4) there is no scrutiny of the School’s representations. For example, she submits, inter alia, that the Report vaguely refers to sources of authority that the Privacy Commissioner relied on, although these sources were either non-existent or not in effect at the time of these incidents; and the School initially relied on paragraph 8(2)(e) of the Act to justify releasing the complainant’s personal information without consent, but it was not addressed in the Report.
[33] The AGC responds that Ms. Joseph was provided a full and fair opportunity to present her allegations and evidence to the Privacy Commissioner, and who conducted his investigation in a thorough and unbiased manner. The AGC submits that the record demonstrates the Privacy Commissioner investigator was in frequent communication with Ms. Joseph to clarify allegations and respond to questions, and that Ms. Joseph was informed of her right to make any further submissions she deemed appropriate (see for example CTR Tabs 24B, 31 and 51). The AGC also contends that the record shows the primary Privacy Commissioner investigator tasked another Privacy Commissioner investigator with reviewing French reports to substantiate some of Ms. Joseph’s allegations, and there is no requirement that a Privacy Commissioner investigation be conducted by a single investigator (see CTR Tabs 53A, RR, Tab B-53A, p 831; CTR Tab 56A, RR, Tab B-56A, p 1004).
[34] With respect to the alleged bias, the AGC asserts that Ms. Joseph has failed to point to any evidence that would meet the test of showing that an informed person, viewing the matter realistically, being fully informed of all the facts and having thought the matter through, would conclude that the decision-maker was biased. The AGC also submits that there is no inferable bias from the language used in the report of findings.
[35] In regards to the allegations against the Privacy Commissioner and this Court, the AGC submits that there is no basis to claim that the Privacy Commissioner committed obstruction by filing procedural motions with the Court in accordance with the Federal Courts Rules, SOR/98-106 [the Rules].
(2) Standard of review
[36] The standard applicable to issues of procedural fairness is whether, having regard to all of the circumstances and focusing on the nature of the substantive rights involved and the consequences for the individual affected, the procedure followed by the decision-maker was fair (Canadian Pacific Railway Company v Canada (Transportation Agency), 2021 FCA 69 at paras 46-47 [Canadian Pacific]; Gulia v Canada (Attorney General), 2021 FCA 106 at para 9 [Gulia]; Demitor v Westcoast Energy Inc (Spectra Energy Transmission) 2019 FCA 114 at para 26).
[37] The Court’s review of procedural fairness issues involves no deference to the decision-maker (Li v Canada (Citizenship and Immigration), 2022 FC 542 at para 11). The question is whether the procedure was fair having regard to all of the circumstances, focusing on the nature of the substantive rights involved and the consequences for the individual affected (Canadian Pacific at paras 45-46; Akhtar v Canada (Immigration, Refugees and Citizenship), 2022 FC 595 at para 13). The applicant bears the burden of showing that procedural fairness was breached.
[38] As the Federal Court of Appeal stated at paragraph 56 of Canadian Pacific Railway Company v Canada (Attorney General), 2018 FCA 69:
No matter how much deference is accorded administrative tribunals in the exercise of their discretion to make procedural choices, the ultimate question remains whether the applicant knew the case to meet and had a full and fair chance to respond. It would be problematic if an a priori decision as to whether the standard of review is correctness or reasonableness generated a different answer to what is a singular question that is fundamental to the concept of justice – was the party given a right to be heard and the opportunity to know the case against them? Procedural fairness is not sacrificed on the altar of deference.
(3) Decision
[39] The first argument advanced by Ms. Joseph is that she encountered procedural issues in the judicial process before this Court due to the Privacy Commissioner’s motions and this Court’s conduct. With respect to the Privacy Commissioner’s motions, I agree with the AGC that there is no basis for this allegation under the Rules. Additionally, an allegation that a party’s conduct unnecessarily lengthens the duration of a proceeding before the Court (e.g., by bringing a motion) may have cost implications under Rule 400(3)(i) of the Rules, but is not relevant to the determination of whether there were procedural defects in the Privacy Commissioner’s decision-making process. I also find Ms. Joseph’s allegations of bias and obstruction against the Court to be unfounded and note that she did not challenge the oral direction given by the Court on February 13, 2023.
[40] The second argument advanced by Ms. Joseph is that the Privacy Commissioner completely disregarded the material before him and conducted his investigation with a closed mind and implicit bias. She points to a number of conducts that will be discussed in turn.
[41] I agree with the AGC that the duty of procedural fairness was not violated. First, section 33 of the Act ensures the person who made the complaint and the head of the government institution concerned are given an opportunity to make representations to the Privacy Commissioner. The record demonstrates that the Privacy Commissioner was in frequent communication with Ms. Joseph to clarify her allegations and to give her the opportunity to state her position. Second, the Privacy Commissioner was under no obligation, as a matter of natural justice, to share the draft of the Report (Oleinik v Canada (Privacy Commissioner), 2011 FC 1266 at para 12 [Oleinik]). Third, section 33 of the Act explicitly limits the right for anyone to access to or comment on representations made to the Privacy Commissioner by another person, which ensures that every investigation of a complaint is conducted in private. Accordingly, the aspect of procedural fairness that requires the applicant be given a meaningful opportunity to be heard has been met.
[42] Ms. Joseph has not convinced me that the tone and the wording used in the Report show inferable bias. Likewise, I have not been convinced the titles of the Report show implicit bias. As pointed out by the AGC, the Privacy Commissioner’s use of point-first descriptive headings throughout the Report is a common writing technique, and the same style of headings were used for all issues, including the five issues that were decided in Ms. Joseph’s favor and found well-founded. Likewise, I have not been convinced that the Privacy Commissioner intended to mock Ms. Joseph when, in the course of describing her position, he quoted Ms. Joseph’s allegation that the disclosure of her information had a “fatal impact”
on her reputation.
[43] Ms. Joseph also advances under her second argument that the Report shows a lack of transparency by the Privacy Commissioner as he mentions Ms. Joseph’s submission but fails to address its applicability. This does not establish the Privacy Commissioner breached his duty of procedural fairness. Unless no reasons are provided, an inadequacy of reasons, as asserted by Ms. Joseph, is insufficient to ground a breach of procedural fairness and the decision-maker is not obliged to address every submission presented (Newfoundland and Labrador Nurses’s Union v Newfoundland and Labrador (Treasury Board), 2011 SCC 62 at paras 14, 16, 22 [Newfoundland Nurses]). The adequacy and transparency of reasons are therefore subsumed into the analysis of the reasonableness of the decision as a whole (Newfoundland Nurses at paras 14, 22; Mun v Canada (Citizenship and Immigration), 2019 FC 246 at para 11). I will thus address Ms. Joseph’s argument in the next section.
[44] Lastly, Ms. Joseph advances that the Privacy Commissioner’s conducts show implicit bias. In my view, Ms. Joseph has not established that the investigation process or the investigation was biased or otherwise conducted in a procedurally unfair manner. There is a strong presumption that decision-makers carry out their duties impartially (Zündel v Citron (CA), [2000] 4 FC 225 at 242; Gulia at para 23) and Ms. Joseph points to no evidence that would meet the test for bias, being whether an informed person, viewing the matter realistically, being fully informed of all of the facts and having thought the matter through, would conclude that the decision-maker was biased (Oleinik at para 15; Committee for Justice and Liberty et al v National Energy Board et al, [1978] 1 SCR 369 at 394; Azubuike v Canada (Attorney General), 2020 FC 911 at para 54 [Azubuike]).
[45] With respect to Ms. Joseph’s third argument, i.e., that the threshold of thoroughness is not met, I am satisfied that (1) the Report is not confusing the reader; (2) proper consideration was given to the documents in French and there is nothing to substantiate the allegation that delegation violated fairness; and (3) Ms. Joseph has not established that the Privacy Commissioner had an obligation under procedural fairness to obtain the audio recordings of the ombudsman’s interview concerning the disclosure to the School’s security.
[46] First, I agree with the AGC that Ms. Joseph has not pointed to any specific relevant information that was overlooked by the investigator or establishes that the Privacy Commissioner’s approach led to any unfairness. Second, the Act does not require that an investigation be conducted by a single investigator. Third, the Privacy Commissioner has broad discretion in carrying out investigations (EW v The Privacy Commissioner of Canada, 2015 FC 1420 at para 20 [EW]; section 34 of the Act), and the duty of procedural fairness does not mandate the investigator to interview each and every witness or to obtain all the evidence that Ms. Joseph would have liked. Further, the Privacy Commissioner had a copy of the transcription of the interview of the witnesses or their “voluntary statement form”
(Tab 27A, Tab 27D) and he can rely on “hearsay”
(paragraph 34(1)(c) of the Act). Ms. Joseph failed to demonstrate that the Privacy Commissioner did not render his Report in accordance with the principles of procedural fairness.
[47] In regards to the fourth argument raised by Ms. Joseph, she points to four “material omissions”
by the Privacy Commissioner, which will be examined in turn.
[48] I am satisfied that Ms. Joseph’s argument that the Privacy Commissioner breached procedural fairness as he did not address whether the School’s communication with the Ottawa Police engaged or breached her section 8 Charter rights is unsubstantiated. To support her position, Ms. Joseph refers in her Memorandum of Fact and Law to an email sent to the investigator on November 3, 2021 while at the hearing, Ms. Joseph also pointed to emails found at pages 794 and 1364 of her record. The evidence reveals that Ms. Joseph raised the Charter issue for the first time on November 3, 2021, hence after the final Report was released on October 28, 2021. Pursuant to section 33(2) of the Act, Ms. Joseph has the right to make representations to the Privacy Commissioner before a finding is made in the matter. The Charter argument was therefore not submitted to the Privacy Commissioner in a timely manner. Ms. Joseph has not demonstrated a breach of procedural fairness.
[49] Ms. Joseph’s other arguments are without merit as (1) Ms. Joseph’s partner is not a party in the present Application; (2) the disclosure of the information to the RCMP is not relevant to Issue 1; and (3) whether or why the Privacy Commissioner preferred the School’s arguments does not fall under procedural fairness.
[50] In conclusion, Ms. Joseph has not established that her right to procedural fairness was breached by the Privacy Commissioner.
B. Challenge to the Privacy Commissioner’s findings on Issue 1 and Issue 7
(1) Standard of review
[51] Ms. Joseph asserts that the correctness standard applies, while the AGC asserts that the reasonableness standard applies. Review of the Privacy Commissioner’s determination that the complaint was not well-founded has previously been held to be reviewable on the reasonableness standard (EW at paras 33-36; Daley v Canada, 2016 FC 1154 at para 31), which is also in conformity with the presumption of reasonableness set out in the Supreme Court of Canada’s decision in Canada (Minister of Citizenship and Immigration) v Vavilov, 2019 SCC 65 [Vavilov] (Azubuike at para 31). Nothing rebuts this presumption in this case (Vavilov at para 10). Although the issues are important to Ms. Joseph, the Privacy Commissioner’s Report does not give rise to any general questions of law of central importance to the legal system as a whole (Vavilov at para 53). The questions raised do not have significant legal consequences for the justice system as a whole or for other institutions of government nor need a “uniform and consistent answers”
(Vavilov at para 59). As a result, the standard to be applied in reviewing the Privacy Commissioner’s decision is reasonableness.
[52] When the applicable standard of review is reasonableness, the reviewing court must examine the reasons given by the decision-maker and determine whether the decision was based on “an internally coherent and rational chain of analysis”
and is “justified in relation to the facts and law that constrain the decision maker”
(Vavilov at para 85; Canada Post Corp v Canadian Union of Postal Workers, 2019 SCC 67 at paras 2, 31). The Court must therefore consider the “outcome of the administrative decision in light of its underlying rationale in order to ensure that the decision as a whole is transparent, intelligible and justified”
(Vavilov at para 15). In other words, the decision must be internally coherent and responsive to the legal constraints that bear on the decision.
[53] In conducting a reasonableness review of factual findings, deference is warranted and it is not the role of the Court to reweigh the evidence or the relative importance given by the decision-maker to any relevant factor (Vavilov at para 96). Instead, it must consider the decision as a whole, in the context of the record (Agraira v Canada (Public Safety and Emergency Preparedness), 2013 SCC 36 at para 53; Cotirta v Canada (Attorney General), 2021 FC 211 at para 30), and simply determine whether the findings are irrational or arbitrary. The party challenging the decision bears the burden of showing that the decision under review is unreasonable (Vavilov at para 100). Respect for the role of the administrative decision-maker requires a reviewing court to adopt a posture of restraint on review (Vavilov at paras 24, 75).
(2) The legislative framework
[54] The Act regulates disclosure of personal information once it has been gathered or obtained by a government institution “subject to any other Act of Parliament”
. In this context the Act regulates what might be regarded as the residual expectation of privacy in material which has lawfully come into the possession of the government institution.
[55] Section 26 of the Act prohibits a government institution from disclosing personal information about other individuals except in certain circumstances. Personal information may be disclosed if the other individuals give consent, or if it is permissible under subsection 8(2) of the Act, which authorizes disclosure in limited and specific situations without consent. Section 8 of the Act is reproduced in Annex.
[56] For example, and relevant to this proceeding, under paragraph 8(2)(a) of the Act, personal information under the control of a government institution may be disclosed for the purpose for which it was obtained or for a use consistent with that purpose. In Bernard, the Supreme Court of Canada confirmed the test for a use to be consistent with the purpose of the disclosure. It stated that to fall within paragraph 8(2)(a) of the Act, the use need not be identical to the purpose for which the information was obtained; it need only be consistent with that purpose in that there need only be a sufficiently direct connection between the purpose and the proposed use, such that an employee would reasonably expect that the information could be used in the manner proposed (Bernard at para 31).
[57] Under paragraph (8)(2)(e) of the Act, personal information may be disclosed to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed; it “authorizes a government institution to disclose personal information without the involved individual’s consent when so requested by an investigative body”
(Savard v Canada Post Corporation, 2008 FC 671 at para 28).
[58] Hence, what the Act guards against is indiscriminate disclosure of private information in a manner not permitted under subsection 8(2).
[59] Complaints from individuals who allege that personal information held by a government institution has been collected, used or disclosed improperly are investigated by the Privacy Commissioner’s investigator (sections 29 and 54 of the Act; Azubuike at para 39). When investigating, the Privacy Commissioner must be impartial, independent and non-partisan (HJ Heinz Co of Canada Ltd v Canada (Attorney General), 2006 SCC 13 at paras 33-36).
[60] The Privacy Commissioner has broad discretion in carrying out investigations as he sees fit, or put differently, “the Commissioner is a master of [his] own proceedings”
(EW at para 20; see also sections 32-34 of the Act).
[61] At the end of an investigation, the Privacy Commissioner’s investigator prepares an investigation report (EW at para 21). After considering that report and the evidence in the record, the Privacy Commissioner issues a final report (EW at para 21). His findings and recommendations are not legally binding and the Privacy Commissioner does not have any order-making powers (section 35 of the Act).
[62] The Privacy Commissioner’s role is thus to “resolve disputes in an informal manner, effectively serving as an ombudsman and creating an alternate, non-judicial avenue to address privacy concerns”
(EW at para 22). Consequently, it is only where “the report had material omissions, reached unreasonable conclusions, contained unsustainable inferences, misconstrued the factual and legal context or evinced a bias or pre-disposition on the part of the investigator, the Court could intervene”
(Oleinik at para 11).
(3) Was it reasonable for the Privacy Commissioner to find that the School’s disclosure of Ms. Joseph’s information to the Ottawa Police was a use consistent with the purpose for which the information was obtained, per paragraph 8(2)(a) of the Act?
(a) Parties’ position
[63] Ms. Joseph first lays out the School’s mandate and states that it is responsible for (1) providing training and educational services to help ensure that all public service employees have the knowledge and skills they need to deliver results for Canadians; and (2) developing, delivering and regularly updating, in collaboration with Treasury Board Secretariat and lead security agencies, courses and programs that meet the needs of the functional security and identity management communities, assessing whether participants successfully complete them and reporting the results to Treasury Board Secretariat on an annual basis.
[64] Ms. Joseph submits that this Application concerns the disclosure of the information without the consent of the individual in question pursuant to subsection 8(2) of the Act. She points out that the initial representation of the School cited paragraph 8(2)(e) for authorizing its disclosure to the Ottawa Police and submits that the Ottawa Police is not under the classes of investigation of the Privacy Regulations.
[65] At the hearing, she further opined that the Privacy Commissioner erred when he relied on paragraph 8(2)(a) of the Act to justify the disclosure. More specifically, Ms. Joseph alleged that (1) the information was compiled for a staffing purpose, rather than for security purpose; and (2) the Treasury Board Secretariat Standard of Security Screening policy defines what is a “consistent use”,
and per its definition, it does not authorize the disclosure for criminal investigation purposes without consent.
[66] The AGC responds that the Privacy Commissioner reasonably determined that the School did not contravene the Act when the School security provided Ms. Joseph’s name, date of birth, and address to the Ottawa Police in relation to the fax incident. He asserts that the disclosure was consistent with the purpose for which the information was obtained in accordance with paragraph 8(2)(a) of the Act. The AGC opines that the Privacy Commissioner correctly applied the “consistent use”
test set out by the Supreme Court of Canada in Bernard, and that the information was not collected solely for staffing purposes. The AGC thus submits that it was reasonable to expect that the School security would follow up with the Ottawa Police and provide them with the identity of the sender once that information came to light. The AGC submits there is no basis to interfere with the Privacy Commissioner’s determination on this issue.
(b) Decision
[67] In brief, guided by the Supreme Court of Canada’s teachings in Bernard, the Privacy Commissioner found that (1) Ms. Joseph’s information (name, date of birth, address) was collected by the School to ensure the security of the School and its employees; (2) the disclosure of Ms. Joseph’s personal information was made to report the issue to the police; and (3) the disclosure was consistent with the School’s internal investigation, and there was a sufficiently direct connection between the purpose for which this information was compiled, and the use for which it was disclosed by the School such that it was reasonable to expect that such a disclosure would occur.
[68] With respect to the direct connection between the purpose for which the information was collected and the use for which it was disclosed, the Privacy Commissioner outlined that:
The above provides that an institution must ensure it investigates suspected criminal activity and report it to the appropriate law enforcement authority as required. Given that the weapons parts were in fact legal in Canada, in retrospect CSPS was perhaps overly cautious when reporting this matter to the OPS. However, in light of the fact that many different weapons are either prohibited or restricted in Canada, we are of the view that CSPS was acting in good faith when reporting what it believed to be a potential criminal offence to the proper authorities and that this was consistent with its internal investigation. Indeed, the disclosure to OPS permitted CSPS to subsequently conclude its investigation and to reinstate the complainant’s security clearance. In our view, given the nature of the fax, it is reasonable to expect that CSPS would take steps to determine whether it was evidence of a criminal offence, including sharing the information with the police.
[69] Considering the Report and the evidence before this Court, I agree with the AGC that there is no basis to interfere with the Privacy Commissioner’s determination on this issue. Ms. Joseph has not shown that the Privacy Commissioner’s finding is unreasonable, per paragraph 8(2)(a) of the Act and given the record.
[70] First, with respect to the purpose for which the information was collected, I disagree with Ms. Joseph that the Privacy Commissioner erred in determining that the information at play, hence, her name, date of birth and address, were collected strictly for staffing purposes. Indeed, it is conceivable that one of the reasons an employer seeks this information is for staffing purposes. However, it is equally clear, as the AGC outlined, that the reasons for which an employer collects the name, date of birth, and address of an employee are numerous and are not limited to staffing purposes, and it was reasonable for the Privacy Commissioner to focus on the security aspect particularly in the context of this case.
[71] Second, I see nothing unreasonable in the Privacy Commissioner’s conclusion that Ms. Joseph’s information was disclosed in order to report the issue to the police. The fax left unattended pertained to a requisition for firearms parts and the record thus supports the Privacy Commissioner’s conclusion.
[72] Third, the Privacy Commissioner properly applied the “use consistent with”
test set out by the Supreme Court of Canada in Bernard. The Privacy Commissioner considered both Ms. Joseph and the School’s submissions, and reasonably determined that there was a sufficiently direct connection between the purpose for which the personal information was compiled (security) and the use for which it was disclosed by the School (report the issue to the police), such that it was reasonable to expect that such a disclosure would occur.
[73] When read as a whole, in conjunction with the record, the reasons must allow the Court to conclude that they provide the justification, transparency and intelligibility required of a reasonable decision and are justified in relation to the relevant factual and legal constraints that bear on that decision (Vavilov at paras 15, 99), and in this case, I agree that they do.
[74] The argument raised by Ms. Joseph that paragraph 8(2)(e) should apply and has been left unaddressed by the Privacy Commissioner is not a sufficient ground to warrant the Court’s intervention. Reasons need not be fulsome or perfect, and need not address all of the arguments put forward by a party or in the record. As the Supreme Court noted, “[r]easons may not include all the arguments, statutory provisions, jurisprudence or other details the reviewing judge would have preferred, but that does not impugn the validity of either the reasons or the result under a reasonableness analysis”
(Newfoundland Nurses at para 16). Additionally, a judicial review is not a “line-by-line treasure hunt for error”
(Communications, Energy and Paperworkers Union of Canada, Local 30 v Irving Pulp & Paper, Ltd, 2013 SCC 34 at para 54). The Court must examine the reasons by reading them “with a view to understanding, not to puzzling over every possible inconsistency, ambiguity or infelicity of expression”
(Canada (Minister of Citizenship and Immigration) v Ragupathy, 2006 FCA 151 at para 15).
[75] Moreover, Ms. Joseph has not shown that this omission was material. Notably, the record shows that the Privacy Commissioner considered Ms. Joseph’s argument and agreed with her that paragraph 8(2)(e) was inapplicable given that the Ottawa Police is not an “investigated body”
per the Schedule of the Act.
[76] Finally, while Ms. Joseph points out to minor factual discrepancies and omissions in the Report (e.g., some dates), none of these issues are central to the Privacy Commissioner’s findings and they cannot be viewed as material omissions (Oleinik at para 11).
[77] I thus conclude that Ms. Joseph has not shown it was unreasonable for the Privacy Commissioner to find that the School’s disclosure of Ms. Joseph’s information to the Ottawa Police was a use consistent with the purpose for which the information was obtained, per paragraph 8(2)(a) of the Act.
(4) Was it reasonable for the Privacy Commissioner to find that the ombudsman’s disclosure of Ms. Joseph’s information to the School security was for the purpose for which it was obtained, per paragraph 8(2)(a) of the Act?
(a) Parties’ position
[78] In regards to the Privacy Commissioner’s first finding under Issue 7, hence that the ombudsman disclosed the information “for the purpose”
for which the information was obtained and that the disclosure was consistent with paragraph 8(2)(a) of the Act, Ms. Joseph submits that section 28 of the Act and the Privacy Regulations, SOR/83-508 [the Regulations] require her to request access to her own physical and mental health records. To determine whether disclosure would be against the individual’s best interests, she says the Regulations limit disclosure of this information only to qualified medical practitioner or psychologist. In this case, Ms. Joseph submits that the disclosure was unauthorized by the Act as neither the School’s ombudsman or the School security is qualified medical practitioners or psychologists, and she did not request her medical information. Hence, Ms. Joseph contends that the Act does not authorize such disclosure.
[79] Moreover, Ms. Joseph points out that the School’s initial representation referred to paragraph 8(2)(e) as the basis for the disclosure of the information by the ombudsman to the School security, while, Ms. Joseph insists, the School security is not an investigation body per the Schedule II of the Act.
[80] In regards to the Privacy Commissioner’s second finding under Issue 7, hence that he did not confirm that any such disclosure occurred, Ms. Joseph stated at the hearing that she is challenging this finding but she did not point to any evidence that contradicts the Privacy Commissioner’s finding that there was no disclosure of information related to Ms. Joseph’s workplace violence complaints.
[81] The AGC responds that the Privacy Commissioner reasonably determined that the School’s ombudsman did not contravene the Act by sharing Ms. Joseph’s personal information in a written statement to the School security. The AGC further submits that Ms. Joseph has failed to point to any material omissions in the investigation or Report, which could render the Privacy Commissioner’s determination unreasonable. Instead, the AGC says, Ms. Joseph raises new allegations about other School employees that were not before the Privacy Commissioner when the Report was prepared.
(b) Decision
[82] Ms. Joseph’s complaint alleged that the ombudsman disclosed to the School’s security her personal information relating to her medical information, the opinion that Ms. Joseph is a “threat”
to the School security, and the workplace violence complaints that she had filed.
[83] In regards to the first finding under Issue 7, the Privacy Commissioner concluded that (1) the ombudsman disclosed to the School’s security Ms. Joseph’s medical information and the allegation of “threat”
; (2) the information had been collected for the purpose of addressing the incidents raised by an employee; (3) the information was disclosed to the School security so that the issues raised could be addressed by the appropriate channel; and (4) accordingly, the ombudsman disclosed the information for the purpose for which the information was obtained and the disclosure was consistent with paragraph 8(2)(a) of the Act.
[84] First, I have not seen section 28 of the Act being discussed before the Privacy Commissioner. In any event, Ms. Joseph’s argument that the School’s ombudsman was not authorized to disclose the information because she never requested her medical information and that it would be contrary to the best interests of the individual pursuant to section 28 of the Act and the Regulations is without merit.
[85] The purpose of section 28 of the Act is to limit the general right of individuals under subsection 12(1) of the Act to request and obtain access to medical information about themselves under the control of a government institution. It reads as follows:
28 The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that relates to the physical or mental health of the individual who requested it where the examination of the information by the individual would be contrary to the best interests of the individual.
[86] Section 28 and the Regulations limit and prescribe the procedure to be followed with respect to the disclosure and examination of personal information relating to physical and mental health in the context of an access to information request; they do not address a government institution’s right to disclose such information to a third party. As explained above, section 8 of the Act deals with such disclosure.
[87] Again, section 8 permits a government institution to disclose personal information, including medical information per section 3 of the Act, without the individual’s consent for any of the purposes listed in subsection 8(2) of the Act, which does not limit the disclosure to a medical practitioner or a psychologist.
[88] I note that Ms. Joseph did not raise any argument regarding the reasonableness of the Privacy Commissioner’s finding that it was appropriate for the ombudsman to disclose her personal information to the School security under paragraph 8(2)(a) of the Act, and I agree with the AGC that this conclusion was reasonable. The Privacy Commissioner noted that the ombudsman had collected the information from the other employee in order to address the issues raised by the said employee, acknowledged that the appropriate channel to address the issues that had been raised was through the School security and thus reasonably found that the information had been disclosed “for the purpose”
for which the information was obtained. The ombudsman reasonably found the disclosure was consistent with paragraph 8(2)(a) of the Act.
[89] Second, the reasoning I outlined in Issue 1 in regards to paragraph 8(2)(e) of the Act applies equally here. The Privacy Commissioner’s reasons need not address every single issue raised by the Applicant; and in any event, paragraph 8(2)(e) is inapplicable given that the School ombudsman is not an “investigating body”
per the Schedule of the Act.
[90] Ms. Joseph has not shown the Privacy Commissioner’s finding is unreasonable, per paragraph 8(2)(a) of the Act, and given the record.
[91] In regards to the Privacy Commissioner’s second finding under Issue 7, hence that he could not confirm that the disclosure about her workplace complaints had actually occurred, Ms. Joseph did not point to any evidence that contradicts the Privacy Commissioner’s finding. She has therefore not met her burden to establish this conclusion is unreasonable.
C. Violation of Section 8 of the Charter allegation
(a) Parties’ position
[92] First, Ms. Joseph notes that, according to R v Dyment, [1988] 2 SCR 417, a seizure is the act of taking something without consent. Ms. Joseph hence argues that the School and the Ottawa Police conducted a search and seizure without a warrant of exigent circumstances in this case. She adds that, as a result of the search and seizure, her private information was compromised, and that she thus has standing to raise a challenge under the Charter.
[93] She opines that (1) the School is a state actor and is thus subject to the Charter according to section 32 of the Charter; (2) she maintained reasonable expectations of privacy in her workplace; and (3) the search and seizure was unreasonable. At the hearing, she notably referred to the Supreme Court’s decisions R v Cole, 2012 SCC 53, R v Marakah, 2017 SCC 59, and Hunter et al v Southam Inc, [1984] 2 SCR 145.
[94] The AGC submits that there is no basis to interfere with the Privacy Commissioner’s determination of this issue. Contrary to Ms. Joseph’s submissions, the AGC submits that the Privacy Commissioner was not required to consider whether the School’s communication with the Ottawa Police engaged or breached her section 8 Charter rights, and notes that Ms. Joseph appears to have raised the Charter issue for the first time on November 3, 2021, after the Report had already been issued. Even had this argument been raised in a timely manner, it is the AGC’s opinion that the Privacy Commissioner’s jurisdiction in this case was limited to investigating and making non-binding finding and recommendations with respect to the allegations that a federal institution made disclosures that contravened the Act.
(b) Analysis
[95] Per the evidence on record, Ms. Joseph raised her Charter claim for the first time on November 3, 2021 (CTR, Tab 69A), hence after the final Report had already released on October 28, 2021. The documents Ms. Joseph referred to at the hearing do not show otherwise.
[96] Hence, Ms. Joseph is raising an issue that was not properly before the Privacy Commissioner and that was therefore not addressed in the Report. The general rule is that new issues which could have been raised before the administrative decision-maker should not be considered on judicial review (Alberta (Information and Privacy Commissioner) v Alberta Teachers’ Association, 2011 SCC 61 at paras 22-26 [Alberta Teachers]; Forest Ethics Advocacy Association v Canada (National Energy Board), 2014 FCA 245 at paras 37-47 [Forest Ethics]). This is notably the case for Charter issues (Forest Ethics at paras 37, 46; Benito v Immigration Counsultants of Canada Regulatory Council, 2019 FC 1628 at para 55 [Benito]).
[97] A reviewing court has a discretion to consider an issue raised for the first time on judicial review, but can refuse to do so where it would be inappropriate (Alberta Teachers at para 23). The general rule is that “this discretion will not be exercised in favour of an applicant on judicial review where the issue could have been but was not raised”
before the administrative decision-maker (Alberta Teachers at para 23). There are many reasons for this rule, including the administrative decision-maker’s role as fact-finder and merits-decider, its appreciation of policy considerations, and possible prejudice to other parties (Alberta Teachers at paras 23-26; Forest Ethics at para 57; Benito at para 56).
[98] Ms. Joseph has not provided any reason for the Court to depart from the rule, and I am satisfied it would not be appropriate to exercise my discretion in favour of considering the Charter issue for the first time on judicial review. I will therefore decline her invitation to consider this argument (Forest Ethics at paras 53-57; Benito at para 57).
IV. Costs
[99] The AGC seeks costs and proposes a lump-sum figure of $500.00.
[100] Considering the Court’s discretion to award costs pursuant to Rule 400, that Ms. Joseph is self-represented, the informal requests brought by Ms. Joseph a few days before the hearing, and the amounts of written material produced and oral argument time consumed in relation to the Application, I find that costs in the amount of $500, all-inclusive, is appropriate, and is granted.
V. Conclusion
[101] The Application for judicial review will be dismissed and cost will be granted in favor of the AGC.
JUDGMENT in T-1797-21
THIS COURT’S JUDGMENT is that:
The Application for judicial review is dismissed.
Costs are awarded to the Attorney General of Canada in the amount of 500.00$.
The style of cause is amended to show the Attorney General of Canada as the sole respondent per Rule 303(2) of the Federal Courts Rules (SOR/98-106).
"Martine St-Louis"
Judge
FEDERAL COURT
SOLICITORS OF RECORD
DOCKET:
|
T-1797-21 |
STYLE OF CAUSE:
|
ELSA JOSEPH V ATTORNEY GENERAL OF CANADA |
PLACE OF HEARING:
|
Ottawa, Ontario
|
DATE OF HEARING:
|
FEBRUARY 16, 2023
|
JUDGMENT AND REASONS: |
ST-LOUIS J.
|
DATED:
|
April 3, 2023
|
APPEARANCES:
Elsa Joseph |
For The Applicant (SELF REPRESENTED) |
Me Marshall Jeske |
For The Respondent |
SOLICITORS OF RECORD:
Elsa Joseph Ottawa (Ontario) |
For The Applicant (SELF REPRESENTED) |
Attorney General of Canada Ottawa (Ontario) |
For The Respondent |
ANNEX
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|