On October 16, 2019, the Ontario Superior Court of Justice approved a settlement in Haikola v. The Personal Insurance Company, 2019 ONSC 5982. The case arose out of a complaint that the insurer was inappropriately collecting credit scores as part of a fraud detection process for evaluating accident benefit claims. The settlement of $2.25 million is likely to result in a payment of between $150 to $180 per affected individual, after deducting class action counsel fees and administrative charges.
The case is significant because it highlights potential deficiencies of PIPEDA in providing meaningful access to remedies for individuals. The case also demonstrates the court’s openness to alternative means to achieve a PIPEDA remedy in order to deter PIPEDA breaches by others.
The key deficiencies with PIPEDA remedies were:
1. The OPC does not always issue timely findings
Section 14 of PIPEDA requires individuals to wait until the Office of the Privacy Commissioner of Canada (OPC) issues a report of findings with respect to a complaint before the individual can seek a monetry remedy before the Federal Court. The problem is that the OPC’s investigation process can move slowly.
Haikola filed his complaint on July 20, 2014. The OPC took until March 14, 2017 to issue its Report of Findings #2017-003. Section 13(1) of PIPEDA states that “[T]he Commissioner shall, within one year after the day on which a complaint is filed or is initiated by the Commissioner, prepare a report […]”. However, the OPC does not treat “shall” as a mandatory directive. Whatever the cause of the delay in this case, the OPC missed the 1-year timeframe by a wide margin – taking four months shy of 3 years.
The problem, of course, is that the OPC’s investigation process can itself prove to be a barrier for individuals seeking a monetary remedy. In this case, the OPC’s failure to keep to the 1-year timeline resulted in an additional delay of nearly 2 years before Haikola could seek a remedy.
2. The Federal Court hearing is a de novo proceeding
A delay might be tolerable for complainants if it gave them a leg up in Federal Court, but it doesn’t. Once in Federal Court, Haikola was required to prove that the Personal Insurance Company breached PIPEDA all over again. The Federal Court is not bound by the findings of the OPC. The burden on a complainant who has a legitimate complaint is not insubstantial. Unless Haikola was prepared to be self-represented, Haikola would have to incur legal costs to essentially argue the case of the OPC before the Federal Court.
3. It is not clear a class action in Federal Court is permissible
All plaintiffs must weight the legal costs of pursuing a claim against an expected outcome. This presents a natural disincentive to pursue claims for minor issues. Class action legislation recognizes that this may allow wrongdoers to escape liability if the relative harm to each individual is small.
Perhaps to make the pursuit of the claim in Federal Court worthwhile, Haikola commenced a class action proceeding. However, the Personal Insurance Company argued that section 14 of PIPEDA does not permit class actions. The prerequisite to a section 14 claim is that the plaintiff went through the OPC complaint process. Since none of the other members of the class of affected individuals had made complaints to the OPC and received reports of findings, the Personal Insurance Company said that Haikola could not pursue claims on their behalf.
4. Recourse to the Ontario courts were necessary to settle the case
After a mediation, Haikola and the Personal Insurance Company agreed to settle the case. In order to avoid the jurisdictional issue, which would have arose if Haikola had pursued certification of the class action and settlement in the Federal Court, Haikola had to discontinue the Federal Court application and commence an application in the Ontario Superior Court of Justice. In doing so, Haikola reframed the action as a breach of an implied contractual term that the Personal Insurance Company would comply with PIPEDA.
In certifying the class action and approving the settlement, Glustein J. noted the deficiencies of the PIPEDA process. Glustein J. also stated that class actions were necessary to address systemic PIPEDA privacy breaches given the limited enforcement powers of the OPC:
[86] The basic goals of a class proceeding (access to justice, judicial economy, and behavioural modification) are all served by the Settlement Agreement. No Class Members, other than Haikola, were either willing or able to assert a breach of their privacy rights against the Defendants in a proceeding before the Privacy Commissioner. The hurdles associated with obtaining a report, including submitting a full privacy complaint to the Privacy Commissioner, do not justify the likely modest amounts that Class Members would have obtained in compensation after a Federal Court action (assuming that after receiving a report, an individual complainant would choose to incur the time and legal fees associated with a Federal Court proceeding).
[87] Judicial economy is served by the settlement. Even if individual Class Members were inclined to commence privacy complaints with the Privacy Commissioner, the courts will not be required to hear hundreds or thousands of similar complaints related to the same basic systemic wrong (the Defendants’ credit score access policy). The proposed settlement spares both the courts and the Privacy Commissioner the unnecessary time and expense of handling a potentially enormous volume of complaints and actions.
[88] Behavioural modification is a key objective of the Settlement Agreement. If systemic PIPEDA privacy breaches are not rectified by a class procedure, it is not clear what incentive large insurers and others will have to avoid overcollection of information. While the Privacy Commissioner may encourage or require changes to future practices, it has very limited powers to enforce compliance through strong regulatory penalties (see s. 28 of PIPEDA).
Haikola v. The Personal Insurance Company, 2019 ONSC 5982
Commissioner Therrien has been arguing for some time that he needs order-making power and, possibly, the ability to levy administrative monetary penalties. Commissioner Therrien’s argument is that this is necessary to provide individuals with a timely and real remedy. However, as this case shows, the process before the OPC and the limitations of a section 14 application may be the real barrier to an individual remedy. It is not clear at all how levying penalties will provide a remedy to individuals. Any penalties will end up lining the coffers of the government rather than as compensation to affected individuals.
Categories: Litigation, Office of the Privacy Commissioner of Canada, Privacy
Leave a Reply