The Supreme Court of Canada’s recent decision in Royal Bank of Canada v. Trang is important to the discussion of privacy rights in Canada. The decision highlights that consent to the disclosure of personal information can be implied under the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) “when the information is ‘less sensitive’” (para. 34, citing PIPEDA, Sched. 1, clause 4.3.6).
PIPEDA regulates how personal information is collected, used and disclosed by private commercial organizations. Under it, organizations are prohibited from disclosing such information without the knowledge and consent of the individual affected. Express consent is usually required for the disclosure of sensitive information, such as financial information. However, the Supreme Court found that the information in this case was “less sensitive” and consent to its disclosure was implied.
The case arose in the banking context. Royal Bank of Canada (“RBC”) was owed money by the Trangs, pursuant to a court judgment. To be repaid through a sheriff’s sale of the Trangs’ property, RBC needed a mortgage discharge statement, discharging the Trangs’ first mortgage, with Scotiabank, on the property. The Trangs refused to provide the statement, and, since it contained their personal information—the current balance of the mortgage—Scotiabank refused to provide it without their consent. The Privacy Commissioner of Canada raised concerns to the Court about the disclosure of sensitive personal financial information.
The Court concluded that the specific facts supported disclosure of the information. Most significantly, the Court found that RBC met the criteria for a court order requiring disclosure, an exception to the consent requirement for disclosure (PIPEDA, section 7(3)(c)).
In addition, the Court engaged in a balancing of the sensitivity of the personal information against the legitimate business reasons for seeking the disclosure. The Court noted the Privacy Commissioner’s concerns about the general sensitivity of financial information, but said, “the degree of sensitivity of specific financial information is a contextual determination” (at para 36). Since mortgages are generally registered on title, i.e. publicly available, mortgage balance information is “less sensitive” (paras. 36-37).
The Court also noted that a person’s reasonable expectations are relevant to obtaining consent under PIPEDA (Schedule 1, clause 4.3.5). Despite the concerns of the Privacy Commissioner about determining the Trangs’ reasonable expectations based solely on their borrower relationship with the bank (para. 20), the Court held that a reasonable person, having defaulted on their loan, would expect the creditor to seek to enforce their legal rights, which, in this case, required the disclosure.
The Court’s contextual approach to the sensitivity of the information is an attempt at preventing misuse of the implied consent provisions in PIPEDA. But the increased use of implied consent to disclosure of personal information for business reasons like this has the potential to undermine privacy rights.
This decision comes amid CCLA’s ongoing lawsuit challenging certain provisions of PIPEDA as being overly broad and violating fundamental rights. CCLA will continue in its fight to secure meaningful privacy rights and state accountability for Canadians.
Sources:
Royal Bank of Canada v. Trang, 2016 SCC 50.
Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Part 1, s. 7(3)(c), Sched. 1, cls. 4.3.5-4.3.6.
KEY LINKS
About the Canadian Civil Liberties Association
The CCLA is an independent, non-profit organization with supporters from across the country. Founded in 1964, the CCLA is a national human rights organization committed to defending the rights, dignity, safety, and freedoms of all people in Canada.
For the Media
For further comments, please contact us at media@ccla.org.
