The SCC on PIPEDA: Royal Bank of Canada vs. Trang

Practical Law Canada Legal Update w-005-0169 (Approx. 6 pages)

The SCC on PIPEDA: Royal Bank of Canada vs. Trang

by Practical Law Canada Commercial Transactions

Background

In April 2008, the Royal Bank of Canada (RBC) loaned Phat and Phuong Trang ("the Trangs"), $35,000. The Trangs defaulted on their loan, and in 2010 RBC obtained a judgment against the Trangs. The Sheriff prohibited RBC from selling the Trang's property to collect on its judgment unless RBC was able to produce a mortgage statement from either the Trangs or the mortgagee bank, the Bank of Nova Scotia ("Scotiabank"). In April of 2011, RBC obtained an order for examination in aid of execution, at which the Trangs failed to appear. RBC then requested the mortgage discharge statement from Scotiabank, who refused to provide the statement on the basis that the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA), precluded it from doing so without the express consent of the Trangs. In February 2012, RBC obtained a second order for examination in aid of execution, and the Trangs again failed to appear. In May of 2012, RBC sought an order compelling Scotiabank to produce the mortgage discharge statement (Royal Bank of Canada v. Trang, 2012 CarswellOnt 7128 (Ont. S.C.J.)). The motions judge held that producing the mortgage statement would contravene PIPEDA, on the authority of Citi Cards Canada Inc. v. Pleasance, 2011 CarswellOnt 6 (Ont. C.A.) (Citi Cards).

RBC appealed this decision (Royal Bank of Canada v. Trang, 2012 CarswellOnt 16482 (Ont. C.A.)), and the Court of Appeal determined that the motion judge's order was interlocutory because it did not fully answer the question of whether RBC could obtain an order compelling Scotiabank to produce the mortgage statement. RBC was allowed to seek to examine a Scotiabank representative.

Following this unsuccessful examination, RBC again moved to compel Scotiabank to produce the mortgage statement (Royal Bank of Canada v. Trang, 2013 CarswellOnt 8164 (Ont. S.C.J.)). The same motion judge again dismissed the motion, indicating that he was still bound by the authority in Citi Cards. RBC again appealed (Royal Bank of Canada v. Trang, 2014 CarswellOnt 17254 (Ont. C.A.)).

Justice Laskin, writing for the majority of the Court of Appeal, upheld the motion judge's decision. The dissent of Associate Chief Justice Hoy took a different approach, stating that the strict adherence to the letter of the statute did not foster access to justice. Most people, she reasoned, don't have the resources of RBC to pursue endless motions for the same court order, simply to obtain the information that they required to settle their debts. Hoy also reasoned that the mortgage discharge statement was "less sensitive" according to section 4.3.6 of Schedule 1 of PIPEDA, and that any mortgagor would reasonably expect that the mortgagee would be entitled to provide a mortgage discharge statement to other creditors.

The Decision of the Supreme Court

The issues on appeal at the Supreme Court (Royal Bank of Canada v. Trang, 2016 CarswellOnt 18044 (S.C.C.)) were therefore whether the order originally sought by RBC constituted an "order made by the court" under section 7(3)(c) of PIPEDA and whether the Trangs impliedly consented to the disclosure of the mortgage discharge statement. The Supreme Court unanimously held with the reasoning of Associate Chief Justice Hoy that the mortgage discharge statement was "less sensitive information" under PIPEDA, and that the Trangs could have reasonably implied that it would be provided to RBC as a creditor. In following this reasoning, the court provided a thorough interpretation of the purposes and principles of PIPEDA.

The SCC's Overview of PIPEDA

PIPEDA governs the collection, use and disclosure of personal information by organizations in the course of commercial activities. Generally, PIPEDA prohibits these organizations from disclosing this information without the express knowledge and consent of the party. The requirements for knowledge and consent are waived when there is an order made by the court which requires disclosure or when consent is implied. Consent to disclosure can be implied, under section 4.3.6 of Schedule 1 of PIPEDA, when the information is considered "less sensitive".

Sensitivity is assessed in the context of what information is already available in the public domain, the purpose served in making this information public and the relationship between the parties. In this case, RBC's legitimate business interest was also a relevant part of the context that informed the sensitivity of the disclosure statement.

A mortgage discharge statement is something on which the rights of others depends and, accordingly, is something they have a right to know". It affects the relationship between other creditors, as well as the relationship between mortgagor and mortgagee. A reasonable mortgagor would be aware that the details of their mortgage were publicly registered on title and that defaulting on a debt could result in a judgment of seizure and sale.

The SCC emphasized that it would be "overly formalistic and detrimental to access to justice" to insist on the sort of multiple hoops that RBC had jumped through to obtain this disclosure statement. The right of RBC to obtain information, to which they were entitled to collect on their debts, could not be frustrated by PIPEDA.

Based on the "less sensitive" nature of the mortgage disclosure statement, and what a reasonable person would infer by entering into a lending contract, the court held that the Trangs had implied consent to disclosure of the information. Scotiabank was therefore not precluded from disclosing the mortgage discharge statement to RBC. The SCC stated at paragraph 47:

"A reasonable mortgagor in their position would be aware that the financial details of their mortgage were publicly registered on title, and that default on the RBC debt could result in a judgment empowering the sheriff to seize and sell the mortgaged property. In my view, a reasonable mortgagor would know that the outstanding mortgage balance would ultimately be provided to the sheriff as a matter of law, once the writ of seizure and sale is filed. A reasonable mortgagor would also know that in such circumstances, the property would be sold to satisfy the RBC debt, subject to the settling of the mortgage with Scotiabank. Moreover, a reasonable mortgagor would know that a judgment creditor in such circumstances has a legal right to obtain disclosure of the mortgage discharge statement through examination or by bringing a motion."

Balancing Corporate Collection and Disclosure

The SCC's decision hinges on the point of what is reasonable:

What the reasonable mortgagor should know about debts and mortgages.

What the reasonable person would realize about their personal information when entering into multiple debt relationships.

This reasonableness test is what determines sensitivity for the purposes of PIPEDA. Any reasonable person who has defaulted on a debt would realize that his creditor would be entitled to recover his losses. In the reasoning of the court, it follows that a reasonable person would realize that in order to follow through on his legal right, a creditor would be required to obtain the necessary information to do so.

An individual's right to privacy must be balanced not only with the rights of the corporation but with the relevance of the disclosure of the information. In this case, not only was the information deemed "less sensitive", but the disclosure was highly linked to RBC's right to collect on their debt. The judgment makes it clear that the right of the creditor or corporation does have an effect on a privacy analysis under PIPEDA. The statute protects the rights of every party, not simply the individual whose information is in question.

Implications

Previously, litigants have attempted to use PIPEDA to prevent others from gaining access to information necessary to pursue their case, as was the case in Citi Cards. The court has now ruled that such attempts should be shut down. Access to justice cannot be thwarted in the name of privacy, especially if a privacy interest is out of proportion with the legal right of the complainant.

PIPEDA formally recognises both express and implied consent. As this decision emphasizes, the appropriate form of consent depends on the intended use of the information, its sensitivity, as well as the circumstances surrounding its collection and use. Overall, implied consent will be valid under PIPEDA only if it is reasonable to expect that the individual will understand the nature, purpose and consequences of their consent.

As we see in this case, implied consent can be appropriate where the personal information is not particularly sensitive and where it is reasonable to infer consent from an individual's actions or inactions. For example, online behavioural advertising may be considered a reasonable purpose under PIPEDA, provided it is carried out under certain parameters and is not made a condition of service. It is important to note that while PIPEDA allows for the withdrawal of implied consent (section 4.3.8, Schedule 1, PIPEDA), an individual is not able to withdraw their consent to avoid their legal obligations.

Consent will not be required if an organization is able to establish that its collection, use or disclosure of personal information is subject to an exemption. Other situation-specific exceptions may exist. However, corporations should not view this decision as a license to disclosure simply because they have a legal right to the information. When lacking express consent, a corporation should consider the sensitivity and public nature of the information, the amount of disclosure required, and the nature of the party to whom the information is being disclosed. All these elements are required for disclosure under this newly established "Trang Test".

For those corporations that collect sensitive information through online behavioural advertising, the Office of the Privacy Commissioner of Canada has provided guidelines on using implied consent through an opt-out mechanism. These guidelines are reinforced by the "Trang Test" discussed above. They indicate that opt-out consent may be acceptable for behavioural advertising where all of the following apply:

Individuals are made aware of the purposes for the practice in a manner that is clear and understandable.
Individuals are informed of these purposes at or before the time of collection and provided with information about the various parties involved in online behavioural advertising.
Individuals are able to easily opt-out of the practice at or before the time the information is collected.
The opt-out takes effect immediately and is persistent.
The information collected and used is limited, to the extent practicable, to non-sensitive information (avoiding sensitive information such as medical or health information).
Information collected and used is destroyed as soon as possible or effectively de-identified.

The SCC on PIPEDA: Royal Bank of Canada vs. Trang | Practical Law