PIPEDA Fines and Penalties – Recent Canada Federal Court Decisions

Rather, the OPC (sometimes referred to as the Privacy Commissioner of Canada) refers information relating to the possible commission of a PIPEDA offense to the Attorney General of Canada. The Attorney General may then file a lawsuit, on behalf of an individual whose PIPEDA rights were violated, against the entity alleged to have violated PIPEDA. Canada’s Federal Court hears the lawsuit. The Federal Court is authorized to award fines and penalties, in the form of damages to the complainant, including for any humiliation that the complainant has suffered. Two notable PIPEDA fines and penalties are discussed below.

PIPEDA Fines and Penalties: The First Damages Case

In 2008, Mr. Mirza Nammo applied to the Royal Bank of Canada (RBC) for a business loan. RBC rejected the loan application, citing Mr. Nammo’s alleged history of “bad credit.” Mr. Nammo did some sleuthing, and later found out that the negative credit decision stemmed from RBC’s reliance on inaccurate information on Mr. Nammo’s TransUnion credit report. 

Use Our PIPEDA Checklist to Find out if You’re Compliant!

Instead of containing Mr. Nammo’s personal information, that report contained another person’s information – the information of a person with a different name, date of birth, Social Insurance Number, and address history. Mr. Nammo filed a complaint with the Privacy Commissioner of Canada (PCC). He alleged that TransUnion violated PIPEDA by disclosing inaccurate personal information to a bank connected to a loan application he made.

Mr. Nammo alleged that TransUnion had violated PIPEDA Clause 4.6, known as the Accuracy Principle. Under the Accuracy Principle, organizations (including banks) that collect, use, and disclose personal information must be “as accurate, complete, and up-to-date as is necessary for the purpose for which it is to be used.” The Accuracy Principle further provides that “information shall be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about an individual.”

The PCC found, and the Federal Court subsequently concluded, that the information TransUnion had in its database concerning Mr. Nammo was grossly inaccurate. The Federal Court noted that a simple human check of that information by TransUnion prior to submitting the credit report to RBC would most likely have alerted TransUnion to the fact that Mr. Nammo’s file contained another person’s personal information instead of his. 

In Nammo v. TransUnion, the Federal Court issued PIPEDA fines and penalties in the amount of $5,000, even though Mr. Nammo did not sustain a specific financial loss. When awarding the PIPEDA fines and penalties, the Court concluded TransUnion failed to collect accurate information on Mr. Nammo. When apprised of its error, TransUnion could not address the complaint quickly and effectively. The Court further concluded that TransUnion failed to quickly and effectively correct the inaccurate information it had disseminated, and failed to take responsibility for its error, first blaming RBC, and even going so far as to attribute some of the blame to Mr. Nammo.

The Court concluded that “these are circumstances that warrant an award of damages based on the considerations of vindication and deterrence.” This case was the first case in which Canada’s Federal Court issued PIPEDA fines and penalties. Since 2011, the Federal Court has continued to issue decisions containing fines and penalties.

PIPEDA Fines and Penalties: Just Ask

In 2013, the Federal Court awarded $20,000 in damages to Complainant Rabi Chitraker, in the case of Rabi Chitraker v Bell TV. Chitraker claimed that Bell TV (Bell), without his consent, conducted a credit check that proved detrimental to a subsequent student loan application with a third party. 

Chitraker ordered Bell’s satellite TV services in late 2010. When his service was installed, he provided Bell with a copy of his signature on a handheld device. Bell took the signature and transposed it to a contract. The contract, which Bell never gave Chitraker a copy of, contained a provision allowing Bell to perform a credit check. Soon enough, Chitraker discovered, when viewing his credit report, that Bell had performed a “hard check” when Chitraker ordered the services. Eventually, Bell admitted to Chitraker that it erred by not informing him that it would perform a credit check when Bell applied for services.

Under PIPEDA, businesses that collect, use, access, and disclose consumer personal information, must obtain consent before doing so. Obtaining consent protects consumers’ privacy rights. When hearing the matter in 2013, the Federal Court concluded that Bell was liable under PIPEDA for not obtaining Chitraker’s consent before accessing his personal information. 

The facts of Chitraker’s case would have posed a problem in an American federal court. Traditionally, in an American federal court, a plaintiff must present evidence of financial or other monetary loss to be awarded money damages. In some instances, federal courts will not even allow a lawsuit to proceed if a plaintiff cannot allege some kind of actual harm.

Canada’s Federal Court operates differently. Under Canada Federal Court Precedent, an award of damages serves three main functions:

• Compensation;
• Deterrence; and
• Vindication of rights.

Chitraker alleged that he was denied a student loan for the first time in 10 years after Bell’s credit check. However, he could not prove that Bell’s actions were the sole or even primary cause of the denial. The Court nonetheless awarded Chitraker $21,000 in damages, $10,000 of which were exemplary. “Exemplary damages,” sometimes referred to as punitive damages, are awarded by courts to deter potential subsequent illegal activity. The Federal Court noted such damages were appropriate, given that Bell failed to show up in court, and showed zero interest in apologizing or settling the matter. The Federal Court awarded the $21,000 to vindicate Chitraker’s PIPEDA rights and to deter future misconduct.