|
Federal Court |
|
Cour fédérale |
Ottawa, Ontario, June 23, 2010
PRESENT: The Honourable Mr. Justice Mosley
BETWEEN:
And
REASONS FOR JUDGMENT AND JUDGMENT
[1] This is an application by Kevin Randall pursuant to section 14 of the Personal Information and Protection of Electronic Documents Act, S.C. 2000, c.5 (PIPEDA) in respect to the alleged failure of Nubody’s Fitness Centres, the respondent, to exercise their duties and responsibilities under the PIPEDA.
[2] This application follows a complaint made by Mr. Randall, to the Privacy Commissioner of Canada, whose office published a report dated May 26, 2009, concluding that the complaint against the respondent was well-founded. It was found that the respondent disclosed the applicant’s personal information without his knowledge or consent.
[3] Pursuant to section 16 of the PIPEDA, this Court may, in addition to any other remedies it may give, (a) order an organization to correct its practices in order to comply with sections 5 to 10 of the Act; (b) order an organization to publish a notice of any action taken or proposed to be taken to correct its practices, whether or not ordered to correct them under (a); and (c) award damages to the complainant, including damages for any humiliation that the complainant has suffered.
[4] These are my reasons for dismissing the application.
Background
[5] At the time of his original complaint, Mr. Randall was a salaried employee of Feed Nova Scotia where he worked as a research analyst and policy advisor. Feed Nova Scotia is a registered charity in the Province of Nova Scotia and primarily supplies food to food banks across the Province.
[6] In July 2007, Mr. Randall, became a member of one of the respondent’s Nubody’s Fitness Centres through a corporate gym membership program available through his employer, Feed Nova Scotia. Under the program, membership was available at a discounted rate and the employer paid half of the monthly subscription cost.
[7] At the relevant dates, Nubody’s Fitness Centres was a chain of fitness clubs with several locations in Atlantic Canada. In the early stages of this case, there was a change in the ownership and management structure of the club when it was sold to GoodLife Fitness Centres, a national chain.
[8] Mr. Randall entered into a one-year contract with Nubody’s by filing out a membership agreement form and a payroll deduction form.
[9] In August 2007, in the course of a staff meeting at the applicant’s workplace, his supervisor (the Executive Director) discussed the corporate membership program that Feed Nova Scotia had arranged with Nubody’s. The supervisor mentioned that some staff members, including her, had already taken advantage of the program. In doing so, the supervisor revealed the number of times each of those employees, including Mr. Randall, had visited the respondent’s facilities over the previous weeks.
[10] The applicant became upset that this information had been disclosed by the respondent to his employer. He did not, however, raise this concern with his supervisor.
[11] On August 9, 2007, the applicant emailed a representative of the respondent requesting that the respondent stop disclosing his personal information without his consent. He received an automated reply which indicated that the representative would be away for a few days and providing the name and contact particulars of the owner should more immediate attention be required. Mr. Randall did not contact the owner about his concern. Nor was he contacted when the representative presumably returned to her office on the date indicated.
[12] Mr. Randall believes that his e-mail was forwarded by the respondent to his employer as he was called in to his supervisor’s office on August 14, 2007 to discuss the matter. He was advised then that his employer needed to know the frequency with which employees with a corporate membership used the fitness centre. Mr. Randall says that he then agreed to the disclosure of this information to his employer under duress because he feared for his job. He says that he subsequently called the respondent’s head office, without disclosing his identity, to inquire about their privacy policy respecting corporate memberships. He believes that this inquiry was also relayed to his employer as he was the only person to have complained about disclosure of the information.
[13] Over the course of the next few months Mr. Randall remained at Feed Nova Scotia and continued to use the respondent’s fitness facilities. He says, however, that this made him uncomfortable as he felt as if his employer was constantly monitoring his usage. He also believes that changes in his work environment were attributable to his communications with Nubody’s. He was moved from one set of offices to another set closer to his supervisor. He believes that area was reserved for problem employees requiring closer supervision. Further, on one occasion he was asked to work a double shift (i.e., an additional half-day) at a supermarket to solicit donations of food from customers. Employees were asked to do this on a voluntary basis. Mr. Randall believes he was the only employee ever asked to put in more than a half day on such duties.
[14] Mr. Randall terminated his employment with Feed Nova Scotia in February 2008 for reasons unrelated to this application. At that time he cancelled his membership with Nubody’s as his employer was no longer paying half the cost. Later he reactivated the membership as he had learned that he could do so at the discounted price so long as he paid the full amount including the employer’s share. Mr. Randall says that while he enjoyed the facilities, he continued to be dissatisfied with how Nubody’s had dealt with his August request not to disclose the frequency of his usage to his employer.
[15] On May 26, 2008, Mr. Randall wrote to another representative of the respondent outlining his concerns. The applicant stated that he had not consented to the disclosure of the frequency of his usage and that neither the application form nor the payroll deduction form he filled out to become a member of the fitness centre contained information about the collection, use or disclosure of his personal information.
[16] Mr. Randall indicated in the letter that he was prepared to pursue remedies with other agencies if Nubody’s did not address his concerns and suggested the company would prefer that his complaint not be made public. The respondent characterizes this as a veiled threat. Mr. Randall says that he wasn’t looking for compensation and that he would have been satisfied with an apology.
[17] In a reply dated May 27, 2008, the representative wrote that under the corporate membership program, the applicant’s employer agreed to subsidize his membership as a benefit of employment provided that he used the fitness centre a certain number of times per month and that the applicant had consented to disclosure of his usage information when he applied for membership.
[18] Dissatisfied with this response, Mr. Randall filed his complaint with the Office of the Privacy Commissioner stating that he had never provided oral or written consent for the disclosure of information on his fitness centre usage and was not aware that such information was being tracked or was required by his employer until he learned of it as set out above. He wrote that the disclosure of information on his fitness centre usage caused him embarrassment and created an atmosphere of competition amongst co-workers that he was unwillingly forced into. The applicant also stated that he believes that he was reprimanded by his superiors for his communications with the respondent.
[19] An investigator was appointed and an inquiry was conducted. The investigator found that neither of the forms completed by Mr. Randall in applying for the corporate membership program requested consent to the disclosure of information about an individual’s use of the fitness center to the employer.
Report of the Privacy Commissioner – May 26, 2009
[20] The report of findings prepared by the Office of the Privacy Commissioner of Canada with regard to the complaint that the applicant filed against Nubody’s Fitness Centres Inc., concluded that the matter was well-founded.
[21] In determining this matter, the Assistant Privacy Commissioner relied upon Principle 4.3 of Schedule 1 of the PIPEDA – Principle 3: Consent.
[22] Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate. Also, Principle 4.3.6 states that an organization should generally seek express consent when the information is likely to be considered sensitive, and that implied consent would generally be appropriate when the information is less sensitive.
Findings of the Privacy Commissioner
[23] The Privacy Commissioner found that information about an individual’s use of the respondent’s fitness centre facilities constitutes personal information, as it is information about an identifiable individual, in this case, the complainant/applicant.
[24] The documentation (membership agreement, payroll deduction form and web page) pertaining to corporate memberships at the respondent did not at the relevant times state that the membership is contingent on an individual making a minimum number of visits per month, nor did it mention that information pertaining to the frequency of visits would be tracked and disclosed to the member’s employer.
[25] Despite the respondent’s position that the applicant provided consent to the disclosure of information about his fitness centre usage when he agreed to become a corporate member, the respondent could not show that it obtained the applicant’s consent.
[26] If the respondent was relying on the applicant’s employer to obtain his consent to the disclosure of information about his usage of the fitness centre to the employer, it should have documented that understanding, the Commissioner found. The respondent only appeared to have asked the employer about whether it had obtained employee consent to the disclosure in the context of a discussion about this complaint.
[27] Had the applicant receive notice that his employer’s sponsorship of his corporate membership was conditional upon a certain frequency of use, it could be argued that the respondent had the implied consent of the applicant to disclose the applicable information to his employer. The evidence provided does not lead to such a conclusion. The Commissioner therefore found the respondent in contravention of Principle 4.3.
Conclusion
[28] Given the foregoing, the report concluded that the complaint that the respondent disclosed the applicant’s personal information without his knowledge or consent is well-founded.
Recommendations
[29] The report recommended that the respondent modify its procedures and documentation so as to ensure that it obtains its members’ consent to the collection, use and disclosure of their personal information, which will include giving members notice of the purposes for which their personal information is collected, used and disclosed. If consent is to be obtained by a third party, such as members’ employers, the respondent should document that arrangement with the employers and in its information on corporate memberships.
[30] On or about June 23, 2009, the respondent wrote to the Assistant Privacy Commissioner advising that a new application form specifically disclosing that information regarding an individual’s use of the Nubodys’ facilities would be disclosed to employers participating in the corporate partnership program was being implemented and provided to all participating individuals.
Issues
[31] The issues raised by the parties in their written submissions are the following:
a. Did the respondent, Nubody’s Fitness Centres, breach provisions of the PIPEDA?
b. If the respondent breached provisions of the PIEPEDA, did the applicant suffer any damages?
c. If the applicant has suffered damages, what would be an appropriate damages award given all of the circumstances?
Analysis
[32] The hearing of an application made after receipt of a report of the Privacy Commissioner under subsection 14(1) of the PIPEDA is not a judicial review of the Commissioner's findings and recommendations. Section 14 in effect provides for de novo review in court of "any matter in respect of which the complaint was made": Waxer v. McCarthy, 2009 FC 169, [2009] F.C.J. No. 252, at para. 25.
[33] In Englander v. Telus Communications Inc., 2004 FCA 387, [2004] F.C.J. No. 1935, at paras. 47 and 48, Justice Décary of the Federal Court of Appeal stated that:
What is at issue in both proceedings is not the Commissioner's report, but the conduct of the party against whom the complaint is filed.
....
... the hearing under subsection 14(1) of the Act is a proceeding de novo akin to an action and the report of the Commissioner, if put into evidence, may be challenged or contradicted like any other document adduced in evidence.
[34] Accordingly, the proceedings before this Court consist of a fact finding process to determine whether the respondent, Nubody’s Fitness Centres, disclosed the personal information relating to the applicant’s fitness centre usage without his consent. If it is found that there was indeed disclosure of personal information by the respondent, this Court must decide, as a matter of law, whether the alleged disclosure constitutes a “violation of the complainant’s privacy” as contemplated by PIPEDA: Waxer, above, at para. 25.
[35] If a violation of PIPEDA is found, the Court must consider the remedies that are available to the applicant/complainant: Johnson v. Bell Canada, 2008 FC 1086, [2008] F.C.J. No. 1368, at para. 54. The applicant agrees that the respondent has implemented the Commissioner’s recommendations. He seeks damages as a remedy should the Court find that there was a violation of the Act.
Did Nubody’s Fitness Centres breach provisions of the PIPEDA?
[36] I find that the respondent Nubody’s Fitness Centres disclosed personal information relating to the applicant’s fitness centre usage without his consent and thereby violated his privacy.
[37] I agree with the applicant that the documentation (membership agreement, payroll deduction form and web page) pertaining to the respondent’s corporate memberships program at the relevant times did not mention that the membership is contingent on an individual making a minimum number of visits per month, nor did it indicate that the information pertaining to the frequency of visits would be tracked and disclosed to the member’s employer.
[38] The respondent has filed an affidavit from a Nubody’s employee that states that Feed Nova Scotia expressly informed the applicant when he applied for the corporate membership program that his usage of the facilities would be disclosed to his employer. According to counsel for the respondent, the source of this information was the applicant’s former supervisor, the Executive Director of Feed Nova Scotia. That is not clear on the face of the affidavit.
[39] In any event, the averments in the affidavit relating to what Feed Nova Scotia personnel may have told the applicant are hearsay and do not constitute information within the personal knowledge of the deponent, as required by Rule 81(1) of the Federal Courts Rules. An adverse inference may be drawn by the Court from the failure of a party to provide evidence of persons having personal knowledge of material facts (Rule 81(2)). In this case, that would have been the Executive Director of Feed Nova Scotia, the applicant’s former supervisor.
[40] As there was no attempt made by the respondent to demonstrate that the information was reliable and that it was necessary to admit it in the form of hearsay, I draw an adverse inference from the failure to submit an affidavit from the supervisor. Accordingly, I have not relied on the averments in the respondent’s affidavit that assert that the applicant was informed that his fitness centre usage would be disclosed to his employer prior to applying for membership.
[41] Principle 4.3 to Schedule I of the PIPEDA states that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate. Principle 4.3.6 states that an organization should generally seek express consent when the information is likely to be considered sensitive, and that implied consent would generally be appropriate when the information is less sensitive.
[42] I adopt the views in the Commissioner’s Report of findings that information about the usage of the respondent fitness centre constitutes personal information, as it is information about an identifiable individual. I agree with the respondent that the type of information collected and disclosed is at the lower end of the scale of sensitivity, viewed objectively. The content was limited to the number of times per week that the applicant attended one of the respondent’s fitness centres. The information disclosed said nothing about what he did at the fitness centres, how long he remained, the nature of his training regime, level of fitness or any other personal information. In other circumstances, implied consent for the disclosure of information at such a low level of sensitivity may be found.
[43] I accept the applicant’s submission that in the circumstances of this case the information was sensitive particularly as it was being disclosed to his work colleagues at a staff meeting and encouraged rivalry with colleagues that made him uncomfortable. The employer should have been aware that some employees might not be comfortable with disclosure of the information to their colleagues in a public forum. In these circumstances, the level of sensitivity of the information was not so low that I would consider that consent to its disclosure could be implied.
[44] This is not to say that I consider the collection and dissemination of such information to the employer unreasonable, where it involves a program which the employer has offered as a discretionary benefit to staff and pays the cost or a significant proportion of the cost. It is reasonable, in my view, for the employer to be provided with the usage information in these circumstances but the employee must be informed that this will be done and given the option to decline the benefit. The respondent also bore responsibility to ensure that employees participating in their corporate membership program were expressly made aware that such information would be disclosed to their employers.
[45] The Commissioner’s Report recommended that the respondent modify its procedures and documentation so as to ensure that it obtains its members’ consent to the collection, use and disclosure of their personal information, which will include giving members notice of the purposes for which their personal information is collected, used and disclosed. If consent is to be obtained by a third party, such as members’ employers, the respondent should document that arrangement with the employers and in its information on corporate memberships.
[46] I note that the respondent took steps to implement the Commissioner’s recommendation. The respondent wrote to the Office of the Privacy Commissioner advising that a new form expressly stating that information regarding an individual’s use of the Nubody’s facilities would be disclosed to employers participating in the corporate partnership program was being implemented and provided to all participating individuals.
[47] In my view, the breach of the PIPEDA by the respondent has been adequately remedied by the Commissioner’s recommendation which was implemented by the respondent.
Did the applicant suffer any damages?
[48] The applicant claims a total of $85,000.00 in general, aggravated and punitive damages. In my view, this claim is grossly disproportional to the violation of privacy interests that occurred.
[49] There is little jurisprudence available to guide the Court in determining the question of damages for breach of a privacy interest. Applying the analysis developed in Poirier v. Wal-Mart Canada Corp., 2006 BCSC 1138, [2006] B.C.J. No. 1725, I am of the view that the impugned disclosure of personal information was minimal and that there has been no injury to the applicant justifying an award of damages. This after consideration of (1) the alleged injury to the applicant; and (2) the nature of the respondent’s conduct.
[50] I agree with the respondent that at the root of this application is Mr. Randall’s displeasure with what he perceives to be his former employer’s retaliation for his emailing the respondent to complain about disclosure of the frequency of his visits to the fitness centre. I note that the former employer is a non-profit organization and the respondent is a corporate entity now owned by a national chain with presumably deeper pockets.
[51] The evidence does not clearly establish that the employer did in fact retaliate against the applicant for this complaint. The evidence amounts, at best, to the applicant’s perception that he was implicitly reprimanded and treated differently from his co-workers for having made the complaint.
[52] The applicant has not provided sufficient evidence for the Court to draw an inference that the former employer’s alleged actions were in any way connected to his communications with the respondent. Indeed, the applicant freely acknowledged this during the hearing.
[53] In any event, this is not an application against the former employer. The respondent could not have anticipated that the employer would “retaliate” as the applicant alleges. Further, even if a minimal injury occurred to the applicant, which I do not accept, the respondent did not behave in a flagrant and callous manner, nor did the respondent benefit commercially from its breach of the applicant’s privacy interest. There is no evidence, in my view, that the respondent acted in bad faith towards the applicant.
[54] The applicant says that he would have been satisfied with an apology from Nubody’s when he first communicated his concerns about disclosure of his fitness centre usage. It is clear from his letter of May 26, 2008 that he was by that time seeking something more tangible by way of compensation. I see nothing in the respondent’s conduct between August 2007 and May 2008 which would justify the damages he is now seeking.
[55] Pursuant to section 16 of the PIPEDA, an award of damages is not be made lightly. Such an award should only be made in the most egregious situations. I do not find the instant case to be an egregious situation.
[56] Damages are awarded where the breach has been one of a very serious and violating nature such as video-taping and phone-line tapping, for example, which are not comparable to the breach in the case at bar: Malcolm v. Fleming (B.C.S.C.), Nanaimo Registry No. S17603, [2000] B.C.J. No. 2400; Srivastava c. Hindu Mission of Canada (Québec) Inc. (Q.C.A.), [2001] R.J.Q. 1111, [2001] J.Q. no 1913.
[57] While the applicant asserts that he suffered damages in “retaliation” by his employer in the form of being subject to commentary in the workplace regarding his gym usage; the only employee to have to work extended hours on one occasion; reassignment to a different workstation; and fearing the loss of his job, I am not convinced that any of this is attributable to the actions of the respondent or that the respondent conducted itself in a high-handed manner towards the applicant nor did the respondent clearly cause the “injury” to the applicant which he alleges.
[58] I am of the view that the alleged breach of the PIPEDA was the result of an unfortunate misunderstanding on the part of the respondent with respect to the question of consent by subscribers to its corporate membership program which has now been resolved. I do not find that the breach was the result of any sort of malicious behaviour on the part of the respondent: Hill v. Church of Scientology of Toronto, [1995] 2 S.C.R. 1130, [1995] S.C.J. No. 64, at para. 196, that would justify the award of damages, let alone aggravated or punitive damages, for the respondent’s conduct.
Conclusion
[59] In the result, I find that the breach of the PIPEDA by the respondent has been adequately remedied by implementation of the recommendation of the Office of the Privacy Commissioner.
I do not, therefore, consider it necessary to order the respondent to correct its practices; to order the respondent to publish a notice of any action taken or proposed to be taken to correct its practices; or to award damages to the complainant. Accordingly, I must dismiss the application. In the circumstances, I will exercise my discretion not to award costs.
JUDGMENT
IT IS THE JUDGMENT OF THIS COURT that the application is dismissed. The parties shall bear their own costs.
FEDERAL COURT
SOLICITORS OF RECORD
DOCKET: T-1100-09
STYLE OF CAUSE: KEVIN RANDALL
and
NUBODYS FITNESS CENTRES
PLACE OF HEARING: Halifax, Nova Scotia
DATE OF HEARING: June 17, 2009
REASONS FOR JUDGMENT: MOSLEY J.
APPEARANCES:
|
Kevin Randall
|
(self-represented litigant) |
|
James D. MacNeil Kelly A. Peck
|
SOLICITORS OF RECORD:
|
KEVIN RANDALL Truro, Nova Scotia
|
|
|
JAMES D. MACNEIL KELLY A. PECK Boyne Clarke Barristers & Solicitors Dartmouth, Nova Scotia
|