ill Ontario's New Privacy Tort Affect Your Business Or Organization?
An Ontario judge has created a new privacy tort; public disclosure of private facts, which could affect your business or organization. Specifically, if your business or organization collects information that is confidential, your business or organization could be liable for any disclosure of that information to the public. To put it another way, you could now be sued for data breaches.
The case before the court involved a civil action by a young woman against her former boyfriend who had published pornographic pictures and video of her after he promised that he would keep the information private. Over a period of time, he requested that they exchange pornographic images and assured her that anything that she sent him would be viewed by him only. Eventually, she did so and later discovered that he had shown the images to a number of friends as well as publishing the images on a website.
As you may be aware, the Criminal Code of Canada criminalizes such behaviour. However, the ex-boyfriend was a minor at the time, so a decision was made to sue him in tort.
In deciding to expand existing tort law, the presiding judge examined existing privacy torts and noted that the development of the electronic age had created a gap for legal remedies. To "block" this gap, the judge created a new privacy tort, public disclosure of private facts. The tort can be established where:
There is public disclosure - the disclosure must be to the public and not merely private disclosure. Sharing a photo with a friend or two would likely be insufficient to establish liability.
The facts must be private - or not known or easily discoverable by the public.
The publication must be objectively offensive - it is not sufficient if the victim is subjectively offended. Rather a reasonable person of ordinary sensibilities must find the publication offensive.
Undoubtedly, the tort will apply to vindictive ex-spouses and lovers as well as to cyber-bullies. However, its application potentially also applies to businesses or organizations that collect or retain sensitive, personal information "in confidence". A data breach, especially in the context of a breach caused by a disgruntled or careless employee could leave the business liable or vicariously liable for the employee's actions.
I recommend that owners and directors move promptly to audit data protection and security procedures. Additionally, written policies should be established for collecting, retaining and protecting confidential and private information. Any existing weaknesses in privacy policies should be found and eliminated. Employees, management and boards of directors should be educated regarding those policies and alerted to potential issues. As is the case in tort law, existence and adherence to a reasonable policy often negates or significantly reduces liability.
As noted above, the case that established the new tort dealt with the publication of nude and pornographic images. The action was not defended which certainly affected the way the evidence was adduced and the development of the law. Subsequent cases will assist in a more fulsome understanding about the tort and its application. However, at this point, it is not overreaching to anticipate that this tort will be used against businesses and organizations that allow information it their possession to be disclosed publically.
If you have any questions about the tort or about establishing or reviewing your privacy policies, do not hesitate to contact the author.
Doe v Defendant [redacted], decision as yet unpublished
The content and the opinions expressed here is informational purposes only and does not constitute legal or professional advice. Nor does reading or commenting on it create a lawyer/client relationship with the author. I encourage you to contact me directly at adrianlawoffice@gmail.com if you have specific legal questions or concerns.
The author encourages you to share this article on social media.
Follow me on Twitter @gwendolynadrian