Privacy compromised: Legal rights and protections in Canada

August 4th, 2016 by Michael Hackl

This article was first published on

Privacy and secrecy are two interrelated concepts that raise a great many legal and ethical questions, with few easy answers. A recent example of the interplay between these concepts comes from the recent misuse of surveillance video by a liquor store employee. To set the stage, we have to go back to 2013, when a nasty verbal altercation between a feminist activist and men’s rights supporters at an event at the University of Toronto was recorded and uploaded to the Internet. The online response was truly appalling, as the woman involved received numerous serious threats. The level and nature of the abuse (including death and rape threats) was so egregious that she withdrew from her advocacy work, and instead tried to disappear from public attention.

Fast forward to this April, when this woman went to a  liquor store in Ontario. A few days later, an image of her taken from video surveillance at the liquor store and connecting her to the 2013 incident was posted on Facebook — apparently on the page of an employee at that store. While the posting was later removed, it renewed the online persecution she has tried to escape, as new threats have been made against her. The woman brought the issue to the attention of the LCBO (the Liquor Control Board of Ontario, which owns and operates the store in question). The LCBO declined to tell her what had been done regarding the matter (although it has now confirmed, after the matter received media attention, that the employee no longer works for the LCBO).

Ideally, our society should operate with a high degree of institutional transparency — secrecy by governments, businesses and institutions should be limited to situations where it is necessary. On the other hand, we should be entitled to maintain our privacy, provided that our activities do not impose on the rights or safety of others. In reality, there are many ways that our individual privacy is compromised; personal information regarding virtually every aspect of our lives, including our finances, medical conditions, consumer habits and internet usage, is regularly collected by institutions. However, there are laws in place that are meant to protect such information from being used for improper purposes. Essentially, these laws require the organizations that collect our  personal information to keep that information secret from others, so that the imposition on our privacy is minimized. Having said that, what should the institutions that are privy to our private information do when they have to deal with competing privacy and secrecy considerations?

This situation raises numerous questions and concerns. Was the video surveillance by the LCBO in itself an invasion of the woman’s privacy? If the LCBO was justified in conducting video surveillance at its store, did the woman (and by extension everybody who goes into a store with security video) have a reasonable expectation of privacy, or did she waive any right to privacy by entering an establishment with security video? Did she waive her right to privacy, but only to the extent that the video of her could be used only for proper purposes (and even the phrase “proper purposes” is loaded — who is to decide what a proper purpose is)? Having had her privacy and security compromised, what could this woman do to protect herself from the fallout?

Privacy legislation in Canada

The main piece of legislation that deals with these sorts of questions in Canada is the Personal Information Protection and Electronic Documents Act (PIPEDA), which protects personal information that any organization collects in the course of commercial activities. It also applies to government institutions unless they are covered by the Privacy Act. PIPEDA provides that such information shall not be collected, used or disclosed without an individual’s consent. However, consent can be implied in certain circumstances and may not be required in circumstances where it would be inappropriate to require consent.

The Office of the Privacy Commissioner of Canada has determined that video surveillance amounts to the collection of personal information. However, a business is not required to get explicit consent from patrons to conduct video surveillance. Instead, the business is required to inform the public that the business is carrying out video surveillance, through the use of adequate signage to ensure that patrons are aware (or should reasonably be aware) of that fact. Presumably, any members of the public who enter the business premises in the face of such signage are deemed to have given implicit consent to being videotaped by a surveillance camera. Further, the business should have a legitimate purpose for collecting this information.

The LCBO has indicated that its video surveillance system “is in place to protect the safety and security of LCBO customers and staff, as well as to protect LCBO property and deter criminal activities,” which are considered to be acceptable purposes for collecting such information. The problem with this particular situation is that the LCBO employee who posted the video surveillance footage online did not use it for any of those purposes; instead, he used it to harass a patron. While one could argue that the woman in question did not have a reasonable expectation of privacy once she entered a business when she knew that it conducted video surveillance, I would argue that she retained a qualified reasonable expectation of privacy. That is, she accepted that her privacy would be infringed, but only in order to advance the goals stated by the LCBO (to protect staff, customers and property and to deter criminal activity), and she continued to maintain a reasonable expectation that her privacy would not be further infringed by having her personal information used for other purposes.

Actions following a privacy breach

Possibly the most difficult question to answer is what recourse was available to the woman after her privacy, and her security, were compromised by this abuse of her personal information? She reported the matter to the police, but felt that they failed to follow through on her complaint, leaving her concerned for her safety. She could have lodged a formal complaint with the appropriate privacy commissioner against the LCBO, or commenced a lawsuit against the LCBO and its employee for breach of confidence, intentional infliction of mental distress, or public disclosure of private facts. Unfortunately, even if she were successful in such a complaint or action, the remedy would likely be an award of monetary damages, which would be inadequate to protect her security. Even if she got a restraining order against the employee, that would not offer protection against others who might continue their persecution, or worse, act on their threats.

In the end, the laws meant to protect our privacy do help, but in a world where information can be sent across the globe in seconds, they are not a perfect answer. How to address competing privacy interests, the effort and expense involved in protecting oneself if one’s personal information is compromised, and the inadequacy of the remedies available when a breach of one’s privacy endangers one’s security are just a few of the issues that have to be dealt with in this area. Perhaps this unfortunate story might spark a much-needed debate on these matters.

Filed in: Civil Rights

Tags: , , , , , ,