Articles 2022

With the rise in the collection, use and disclosure of personal information and personal health information across organizations, the prevalence of privacy breaches, and the recognition of common law privacy torts in Ontario, organizations increasingly face legal, financial and reputational consequences from personal information handling practices. This article considers how this evolving area of law may inform an organization’s internal risk management program.

David Young summarizes his testimony before the the House of Commons Standing Committee on Access to Information, Privacy and Ethics on its study of PIPEDA. Read on for David's submissions on consent, the PIPEDA enforcement framework, and how PIPEDA aligns with the forthcoming European General Data Protection Regulation.

Canadian Securities Administrators recently published the results of their review of cyber security disclosure and guidance on appropriate disclosure.

In its recent decision in RBC v. Trang, the Supreme Court of Canada provided guidance to financial institutions holding otherwise “highly sensitive” information on how to determine when that information is somewhat less sensitive, such that it can be disclosed.

in December 2016, the Ontario Superior Court of Justice released Patel v. Sheth, the next in a series of cases sprouting from the 2012 recognition of a tort of intrusion upon seclusion. While Patel is deeply planted in a messy matrimonial context the analysis and finding of an invasion of privacy is worth addressing from a business risk perspective as well.

The decision in Lozanski v The Home Depot, Inc. by the Ontario Superior Court of Justice is one of the few court-approved privacy breach class action settlements in Canada. The decision provides some much needed guidance in this area: the Court suggests that actual harm is needed for class members to receive financial compensation and that companies should adopt a proactive approach to mitigate liability when faced with a privacy breach.

In a recent decision, the Divisional Court set aside an order of the IPC mandating that certain confidential information of the applicant union was to be disclosed to a representative of a rival union. The Court held that the applicants need not show that harm had actually occurred, but that the context of the disclosure request was enough to demonstrate a reasonable risk of harm.

This article discusses whether condo corporations should disclose to condo owners the email addresses of their owners.