Appeals Court Clarifies Limitations Period in Alberta Privacy Actions : Personal Information Protections Act (PIPA)

This post originally appeared on Dentons Data blog and (Shilletto). 

May 12, 2019 marked the date when the Alberta Court of Appeal released a decision from a summary dismissal application, solving any and all confusion around the province’s limitations act and it’s privacy legislation, the Personal Information Protection Act, SA 2003, c P-6.5 (“PIPA”).

The Office of the Information and Privacy Commissioner of Alberta (“OIPC”) must provide a final order against an organization via the complaint process in order to have a cause of action related to a privacy breach claim.  This is a mandatory step for the claimant to have a cause of action against the organization for damages for loss or injury that the individual has suffered as a result of the breach by the organization. 

The issue becomes when does the limitation period begin? In Moore’s Industrial Service Ltd. v Kugler, 2019 ABCA 178 (“Moore’s”) the issue was whether the limitation period ran from the time of privacy violation or from the time the order was obtained.

The court held that where a claimant initiated a proceeding under PIPA’s Section 52, given rise to a cause of action under section 60 the following: The limitation period for the alleged breach of privacy does not start to run until such time as the Alberta OIPC complaints process is complete and an order is obtained before attempting to bring an action for a privacy violation in court.  

PIPA: The Legislation 

In Alberta, PIPA is the statute that governs the collection, use, and disclosure and management of personal information by corporations. PIPA is similar to other provinces’ private sector privacy laws within Canada. Privacy legislation such as this requires organizations to take reasonable measures to protect the personal information they hold. 

Analysis Source: (Shilletto)

“At paragraph 10 of its decision, the Court of Appeal summarized the process of a complaint filed under PIPA:

[T]he Commissioner may investigate and attempt to resolve complaints about personal information being collected, used or disclosed by an organization in contravention of the Act: s 36(2). An individual must initiate a complaint to the Commissioner within a “reasonable time”: s 47(3). Once in receipt of the complaint, the Commissioner may authorize a person to investigate and attempt to mediate the complaint (s 49), and if the matter is not resolved, conduct an inquiry: s 50. An inquiry must be completed within one year from the day that the complaint was received, but the Commissioner is entitled to extend that period: s 50(5). On the completion of an inquiry, the Commissioner must make an order under s 52.

The Court further confirmed that under section 53, an order from the AB OIPC is final. Under section 54.1, an application for judicial review of an AB OIPC order must be made within 45 days from the day the person making the application is given a copy of the order. Having reviewed this, the Court held that PIPA contemplates that the time between an individual discovering a privacy breach and the AB OIPC making an order regarding a complaint about the privacy breach may in fact be longer than two years.

In conducting its analysis, the Court of Appeal agreed with the lower court’s analysis that a section 60 PIPA cause of action requires the making of an order under section 52 to come into existence. Under a plain reading of PIPA, the injury for which Mr. Kugler sought a remedial order could not occur until after a section 52 order was made by the AB OIPC and triggered the section 60 cause of action. Alternatively, the injury that assumed liability on the part of Moore’s did not warrant bringing a proceeding until the AB OIPC had completed an investigation. Citing Martin v General Teamsters, Local Union No. 362, 2011 ABQB 412, the Court of Appeal further concluded that had Mr. Kugler filed a claim prior to the AB OIPC’s decision on November 29, 2013, the claim would have been struck for failing to disclose a cause of action.

The Court noted Moore’s concern that its interpretation of PIPAcould permit individuals to bring section 60 PIPA causes of action many years after the discovery of a privacy breach. However, the Court held that PIPA addresses this concern specifically at section 50(3), wherein the AB OIPC is required to notify the defendant organization if the AB OIPC is conducting an inquiry into a complaint about that organization. The Court further determined that if a matter is referred to mediation prior to an inquiry, a defendant organization will also receive notice. In both circumstances, the requirements of PIPA put the defendant organization on notice in advance of a final determination, removing concerns about “stale claims” being made years later.

Conclusion

         The Court’s decision in Moore’s clarifies that where a piece of legislation does not stipulate a limitation period, but does create an instance wherein a cause of action only exists upon the completion of an investigation, decision or other pre-condition of the legislation in question, the two-year limitation period in section 3(1) of the Limitations Act does not start until that pre-condition has occurred.

Businesses should be aware that this has the effect of extending the period of risk they may face in respect of alleged violations of PIPA.” (Shilletto)

 

Sources:

Shilletto, Emily. “Alberta Privacy Actions.” Court of Appeal Clarifies Limitations Period, http://www.limitationslaw.com/court-of-appeal-clarifies-limitations-period-in-alberta-privacy-actions.

 British Columbia’s Personal Information Protection Act, S.B.C. 2003, ch. 63; Québec’s An Act Respecting the Protection of Personal Information in the Private Sector, R.S.Q., ch. P-39.1; and, the Federal Personal Information Protection and Electronic Documents Act, SC 2000, ch 5 (“PIPEDA”)