Canada.
114 The Commissioner also has the authority to send a matter on to the
Federal Court.
115 Such a proceeding may take into account the Commissioner’s
report and its conclusions, but it is a de novo hearing and the Court is not bound by
either the record before the Commissioner or his report. The Federal Court can issue
binding orders and can award damages.
116 The Court has taken a very conservative
approach to moral damages under PIPEDA, ruling that such damages are only
available in “egregious” circumstances.
117 Where damages have been awarded,
they have tended to be very low. As a consequence, such applications are almost
always brought by unrepresented applicants who may struggle to adduce appropriate
evidence of actual and/or moral damage. Under the provincial equivalents to
PIPEDA in B.C., Alberta and Quebec, the Commissioners may issue binding orders,
but they do not have the power to award damages.
Both the current and former Privacy Commissioners are on record for criticizing
the weak enforcement provisions of PIPEDA and have called for a reform of the
legislation that would include order-making powers and other enforcement mechanisms. A recent review by a House of Commons Standing Committee also
recommended enhanced Commissioner’s powers.
118
In 2015 PIPEDA was amended by the Digital Privacy Act to include a new power
of the Commissioner to enter into compliance agreements where he has reasonable
grounds to believe “that an organization has committed, is about to commit or is
likely to commit an act or omission” that could amount to a breach of PIPEDA.
119
Where a compliance agreement is entered into and the organization complies with it,
the Commissioner will not apply to the Federal Court for an order, and any
application by the Commissioner to the Federal Court for a compliance order is
put in abeyance.
120 If there is non-compliance with the agreement, the possibility of
seeking an order before the Federal Court is revived.
121
PIPEDA provides for the levying of fines against any organization who destroys
data or documents relevant to a complaint under the statute, who retaliates against a
whistleblower under the Act, or who obstructs the investigation of a complaint. Fines
are fairly modest with the maximum on an offence punishable on summary conviction being $10,000 and for offences by indictment $100,000.
122 Fines can only be
imposed by a court, and they are not available as a sanction for breaches of data
protection obligations. There have been calls for the Commissioner to have broader
114 PIPEDA, s. 14.
115 PIPEDA, s. 15.
116 PIPEDA, s. 16.
117 See, e.g. Randall v. Nubodys Fitness Centres, 2010 FC 681 (CanLII).
118 House of Commons (2018) Report of the Standing Committee on Access to Information, Privacy
and Ethics.
119 PIPEDA, s. 17.1.
120 PIPEDA, s. 17.1(3).
121 PIPEDA, s. 17.2(2).
122 PIPEDA, s. 28.
72
T. Scassa
114 The Commissioner also has the authority to send a matter on to the
Federal Court.
115 Such a proceeding may take into account the Commissioner’s
report and its conclusions, but it is a de novo hearing and the Court is not bound by
either the record before the Commissioner or his report. The Federal Court can issue
binding orders and can award damages.
116 The Court has taken a very conservative
approach to moral damages under PIPEDA, ruling that such damages are only
available in “egregious” circumstances.
117 Where damages have been awarded,
they have tended to be very low. As a consequence, such applications are almost
always brought by unrepresented applicants who may struggle to adduce appropriate
evidence of actual and/or moral damage. Under the provincial equivalents to
PIPEDA in B.C., Alberta and Quebec, the Commissioners may issue binding orders,
but they do not have the power to award damages.
Both the current and former Privacy Commissioners are on record for criticizing
the weak enforcement provisions of PIPEDA and have called for a reform of the
legislation that would include order-making powers and other enforcement mechanisms. A recent review by a House of Commons Standing Committee also
recommended enhanced Commissioner’s powers.
118
In 2015 PIPEDA was amended by the Digital Privacy Act to include a new power
of the Commissioner to enter into compliance agreements where he has reasonable
grounds to believe “that an organization has committed, is about to commit or is
likely to commit an act or omission” that could amount to a breach of PIPEDA.
119
Where a compliance agreement is entered into and the organization complies with it,
the Commissioner will not apply to the Federal Court for an order, and any
application by the Commissioner to the Federal Court for a compliance order is
put in abeyance.
120 If there is non-compliance with the agreement, the possibility of
seeking an order before the Federal Court is revived.
121
PIPEDA provides for the levying of fines against any organization who destroys
data or documents relevant to a complaint under the statute, who retaliates against a
whistleblower under the Act, or who obstructs the investigation of a complaint. Fines
are fairly modest with the maximum on an offence punishable on summary conviction being $10,000 and for offences by indictment $100,000.
122 Fines can only be
imposed by a court, and they are not available as a sanction for breaches of data
protection obligations. There have been calls for the Commissioner to have broader
114 PIPEDA, s. 14.
115 PIPEDA, s. 15.
116 PIPEDA, s. 16.
117 See, e.g. Randall v. Nubodys Fitness Centres, 2010 FC 681 (CanLII).
118 House of Commons (2018) Report of the Standing Committee on Access to Information, Privacy
and Ethics.
119 PIPEDA, s. 17.1.
120 PIPEDA, s. 17.1(3).
121 PIPEDA, s. 17.2(2).
122 PIPEDA, s. 28.
72
T. Scassa