Supreme Court: Implied Consent For “Less Sensitive” Information Under…

The Supreme Court of Canada’s recent decision in Royal Bank of Canada v. Trang is important to the discussion of privacy rights in Canada. The decision highlights that consent to the disclosure of personal information can be implied under the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) “when the information is ‘less sensitive’” (para. 34, citing PIPEDA, Sched. 1, clause 4.3.6).

PIPEDA regulates how personal information is collected, used and disclosed by private commercial organizations. Under it, organizations are prohibited from disclosing such information without the knowledge and consent of the individual affected. Express consent is usually required for the disclosure of sensitive information, such as financial information. However, the Supreme Court found that the information in this case was “less sensitive” and consent to its disclosure was implied.

The case arose in the banking context. Royal Bank of Canada (“RBC”) was owed money by the Trangs, pursuant to a court judgment. To be repaid through a sheriff’s sale of the Trangs’ property, RBC needed a mortgage discharge statement, discharging the Trangs’ first mortgage, with Scotiabank, on the property. The Trangs refused to provide the statement, and, since it contained their personal information—the current balance of the mortgage—Scotiabank refused to provide it without their consent. The Privacy Commissioner of Canada raised concerns to the Court about the disclosure of sensitive personal financial information.

The Court concluded that the specific facts supported disclosure of the information. Most significantly, the Court found that RBC met the criteria for a court order requiring disclosure, an exception to the consent requirement for disclosure (PIPEDA, section 7(3)(c)).

In addition, the Court engaged in a balancing of the sensitivity of the personal information against the legitimate business reasons for seeking the disclosure. The Court noted the Privacy Commissioner’s concerns about the general sensitivity of financial information, but said, “the degree of sensitivity of specific financial information is a contextual determination” (at para 36). Since mortgages are generally registered on title, i.e. publicly available, mortgage balance information is “less sensitive” (paras. 36-37).

The Court also noted that a person’s reasonable expectations are relevant to obtaining consent under PIPEDA (Schedule 1, clause 4.3.5). Despite the concerns of the Privacy Commissioner about determining the Trangs’ reasonable expectations based solely on their borrower relationship with the bank (para. 20), the Court held that a reasonable person, having defaulted on their loan, would expect the creditor to seek to enforce their legal rights, which, in this case, required the disclosure.

The Court’s contextual approach to the sensitivity of the information is an attempt at preventing misuse of the implied consent provisions in PIPEDA. But the increased use of implied consent to disclosure of personal information for business reasons like this has the potential to undermine privacy rights.

This decision comes amid CCLA’s ongoing lawsuit challenging certain provisions of PIPEDA as being overly broad and violating fundamental rights. CCLA will continue in its fight to secure meaningful privacy rights and state accountability for Canadians.

Sources:

Royal Bank of Canada v. Trang, 2016 SCC 50.

Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Part 1, s. 7(3)(c), Sched. 1, cls. 4.3.5-4.3.6.

KEY LINKS

• Update on CCLA’s Charter challenge to the PIPEDA privacy legislation
• Full decision by the Ontario Superior Court in rejecting the motion to strike
• Learn more about our PIPEDA Charter challenge