Federal Privacy Commissioner on Bill c-27 news release.

Report into the 2021 cyber attack on Newfoundland health information systems released.

Privacy Commissioner of Canada announced his office is launching a joint investigation into OpenAI

Federal Privacy Commissioner launches new guidance on workplace privacy

Cybersecurity: Best Practices for Setting Up a Security Operations Centre

Alberta IPC finds risk of significant harm from stolen server.

Updates to Chapter 3 for the Guide to FOIP and the Guide to LA FOIP are now available!

Steps for effectively deploying multi-factor authentication.

Concerns about AI


UPDATED – Can You Bring an Action or Class Action for the Tort of Violation of Privacy in Saskatchewan?

February 25, 2021 - Ron Kruzeniski, Information and Privacy Commissioner

I was asked whether a person could sue or be part of a class action in Saskatchewan for a breach of privacy. The Privacy Act provides in section 2, that it is a tort, actionable without proof of damage, for a person willfully and without claim of right, to violate the privacy of another. In section 7, the Court can award damages, grant an injunction or any other remedy. In section 8, the right to sue is in addition to any other rights the plaintiff has.

In 2018, the Legislative Assembly amended The Privacy Act to allow an action to be brought for the tort of distributing an intimate image of another person without that other person’s consent. In addition, the amendment allowed a person to sue in small claims court or Queen’s Bench. Thus, an action for violation of privacy could occur in Saskatchewan.

A recent case under The Privacy Act is Bierman v Haidash, 2021 SKQB 44. The Court of Queen’s Bench for Saskatchewan ordered damages of $7,500 and costs of $3,000 against the defendant. The judge stated at paragraph [78]:

[78]…A helpful discussion of damages awarded by Canadian courts is found in Getting to Damages in the Health Information Privacy Context: Is the Cost Worth the Damage? by Liam O’Reilly (April 11, 2016) (CanLll).  He writes that despite increased public concern over privacy violations, courts have generally relegated privacy breaches to the lower end of the damages spectrum.

[79] The author opines that the courts’ reluctance to award more substantial damages for violation of privacy does not reflect society’s growing concern over privacy. He states that more emphasis should be placed on compensating violations of dignity as opposed to actual harm that is often psychological and troublesome to access or quantify. The author notes that s. 6(1) of the Saskatchewan Act, among the other Canadians Acts, is the most generic in its approach in setting out certain criteria to assess damages, noting the Act’s direction to assess the relationship between the victim and the tortfeasor and the expectation of privacy in the circumstances.

[80] The author then recognizes that the bulk of privacy breach jurisprudence has arisen in British Columbia. At the time he wrote, no damages for privacy violation had been awarded in other provinces with a statutorily created tort (Newfoundland, Saskatchewan or Manitoba). The author then provides a detailed and helpful summary of several decisions from British Columbia with damages ranging from a low of $50.00 (Fillion v Fillion, 2011 BCSC 1593 [Fillion]) to a high of $60,000.00 (l.A.M. v J.E.l.I., 2008 BCSC 114 7). The cases at the higher end attracted punitive damages and involved plaintiffs being spied upon in a private washroom (Malcolm v Fleming, [2000] BC.I No 2400 (QL) – $50,000.00 damages); watched in a bedroom through a hole cut in the wall above the bed, concealed on the inside by a two-way mirror (Lee v Jacobson (1992), 87 DLR (4th) 40 I (BC SC) – $36,000.00 damages); intercepting and recording phone calls and providing them to person’s employer resulting in dismissal (Watts v Klaemt, 2007 BCSC 662, [2007] 11 WWR 146 – $36,000.00 damages). The lower end of awards involved reading and copying personal documents (Fillion – $50.00 damages); sending bank statements to an ex-spouse’s address allowing him to use the information to harass her (Albayate v Bank of Montreal, 2015 BCSC 695 – $2,000.00 damages); communicating between financial institutions and revealing confidential information (B.M.P. Globed Distribution Inc. v Bank of Nova Scotia, 2005 BCSC 1091 , 8 BLR (4th) 247 –  2,500.00 damages); photographing persons in their back yard and aiming video surveillance cameras at the windows of their home (Wasserman v Hall, 2009 BCSC 1318, 87 RPR (4th) 184 – $3,500.00 damages); installing close-imaging cameras in a hallway outside of apartments (Heckert v 5470 Investments Ltd., 2008 BCSC 1298, 299 DLR (4th) 689 – $3,500.00 damages).

[81] In Ontario, which does not have a statutorily created tort, the Court of Appeal found that using a workplace computer to access bank accounts of her partner’s spouse at least 174 times was actionable under the developing tort of intrusion upon seclusion (Jones v Tsige, 2012 ONCA 32, 346 DLR (4th) 34) and awarded $10,000.00 in damages.

[82] Within the context of these decisions and considering the factors set out in s. 6( 1 ), the court finds that Dr. Haidash’ s inquiry into any database of persons who were not his patients cannot be justified. Not only did he inquire into Ms. Bierman’s profile, he inquired into several other persons who were not his patients. Health information is highly private. Physicians, more than anyone, should appreciate this truism. …

[83] The court recognizes that Dr. Haidash should receive a firm message from the court that he did not show the expected care he ought to have shown to accessing anyone’s health records for a purpose other than for the benefit of a patient.

The court also recognizes that Dr. Haidash has already been subject to the scrutiny and disapproval of the College of Physicians and Surgeons and the Privacy Commissioner.

This case clearly signals that suing for a breach of privacy under The Privacy Act can result in an award for damages.

Could persons sue in a class action?  

The Class Actions Act sets out the rules and procedures for commencing a class action. Such an action has to be certified by the Court of Queen’s Bench. If certified, a class action or multi-jurisdictional class action for a tort of breach of privacy could proceed in this province.


The Freedom of Information and Protection of Privacy Act (FOIP) gives citizens certain rights to access information held by government institutions. The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP) does the same for information held by local authorities (e.g. cities, towns, villages and other municipalities’ school and library boards, the U of S and U of R, the Saskatchewan Health Authority and police services.) The Health Information Protection Act (HIPA) applies to trustees and gives the right to individuals to access their personal health information. The rights and actions under these Acts do not affect the right to bring an action under The Privacy Act.

The Information and Privacy Commissioner (IPC) process is completely separate and apart from lawsuits for a breach of privacy. The IPC may undertake a breach of privacy investigation under FOIP, LA FOIP or HIPA. There is no potential for monetary advantage through the IPC process though.



Categories: BlogTags:

Back to Blog