As private lives are increasingly digitized, Canadian courts continue to expand their recognition of common law privacy torts.
The latest privacy tort recognized in Alberta is public disclosure of private facts in the decision of ES v Shillington, 2021 ABQB 739. Justice Inglis confirmed that the common law tort exists in Alberta and awarded the plaintiff $155,000 in damages in connection.
This decision brings the Alberta courts one step closer to recognizing all four privacy torts set out by the Ontario Court of Appeal in Jones v Tsige in 2012 and are now officially recognized by the Ontario Courts. To date, the Alberta courts have considered the tort of intrusion upon seclusion,[1] and have now officially recognized the misappropriation of personality[2] and public disclosure of private facts.
While the tort in this case was applied to egregious facts about a personal relationship, businesses should remain aware of the way that courts continue to extend the scope and reach of privacy torts. This new privacy tort captures the public disclosure of sexual and relationship matters, financial information, and health records. It also opens up the opportunity for claimants to argue for the application of the tort to novel situations of privacy, as long as a reasonable person would find the disclosure of the private information highly offensive.
Background
In Shillington, the plaintiff was married to the defendant for eleven years. During the course of their relationship, the plaintiff provided the defendant with sexualized photographs of herself. The defendant posted these photographs on various pornography websites, without the plaintiff’s consent.
In response to these online postings of her photographs, the plaintiff brought an action against the defendant which included an argument for the recognition of a tort for the public disclosure of private information.[3] The plaintiff sought injunctive relief to have the images removed from the various websites as well as general, aggravated, and punitive damages.
Elements of the New Tort
To establish a breach of the tort public disclosure of private information in Alberta, the court found that a plaintiff must establish:
(a) the defendant publicized an aspect of the plaintiff’s private life;
(b) the plaintiff did not consent to the publication;
(c) the matter publicized or its publication would be highly offensive to a reasonable
person in the position of the plaintiff; and,
(d) the publication was not of legitimate concern to the public.[4] (emphasis added).
While this test follows closely with the tests set out in Ontario[5] and Nova Scotia,[6] the court shifted the wording from the Ontario test on the third element to include “a reasonable person in the position of the plaintiff.” The Ontario courts in Jane Doe articulate this element as “highly offensive to a reasonable person.” The inclusion of the offensiveness of the material based on the “position of the plaintiff” follows case law set out in the UK that considers the circumstances of the plaintiff and how they are affected by the publication.[7]
In other words, the plaintiff does not need to prove the information itself is highly offensive to establish the tort. The court held, “what is required to qualify for protection is simply that the information in question be private.”[8] This is a lower threshold compared to the Ontario and Nova Scotia courts, in that it considers whether the information is offensive based on the subjective position of the plaintiff.
The private information that is captured by this tort includes sexual matters, financial records, relationships, and health records.[9] The court also held that if the information does not match one of these groups, then the appropriate way to determine whether the issue is private is to ask: “what would a reasonable person feel if they were placed in the same position as the claimant faced with the same publicity?”[10] This catch-all of private information allows for claimants to make novel arguments about what might be included as private information that may be liable for breach of public disclosure of private facts.
Implications for businesses
While the facts of Shillington relate to a personal relationship and the public distribution of sexualized images, the tort includes private information that businesses may collect of their employees or clients. This information includes: financial records, health records, and even information about relationships.
This tort may also further open the risk of vicarious liability for businesses in the privacy context. If an employee either negligently or maliciously discloses private information within the scope of their employment, it is possible that businesses may be vicariously liable to this disclosure. However, there are important limitations to potential vicarious liability that are detailed in our Dentons Privacy Blog here.
Crucially, businesses should be aware that they may be liable for general, aggravated, and punitive damages as well as injunctive undertakings if an employee publicly exposes information that is deemed private by the courts under this tort.
Overall, the trend is towards courts applying the common law to privacy concerns that arise in a digitized world. Businesses should be prepared to respond to expanding privacy law risks and Dentons can provide further guidance about this shifting landscape.
[1] Carbone v Burnett, 2019 ABQB 98.
[2] Hay v Platinum Equities Inc, 2012 ABQB 204.
[3] Ibid at para 18.
[4] Ibid at para 68.
[5] Jane Doe 72511 v Morgan, 2018 ONSC 6607 as cited by Shillington at para 26.
[6] Racki v Racki, 2021 NSSC 46, 52 RFL (8th 1) as cited by Shillington at para 31.
[7] Campbell v Mirror Group Newspaper Ltd, [2004] UKHLL 22 as cited by Shillington at para 52.
[8] Shillington at para 64.
[9] Ibid at para 69.
[10] Ibid a tpara 68, citing directly from Campbell, supra note 7.
For more information about Denton’s data expertise and how we can help, please see our Transformative Technologies and Data Strategy page and our unique Dentons Data suite of data solutions for every business, including enterprise privacy audits, privacy program reviews and implementation, data mapping and gap analysis, and training in respect of personal information.
