The Importance of Exceptions
When it comes to privacy and data protection, I often tell people that that while “rules” are important, the “exceptions” matter more. A recent decision out of the Ontario Court of Appeal illustrates this point rather nicely. It concerns two banks, a debt, a mortgage discharge statement and PIPEDA.
PIPEDA provides a requirement for the consent of an individual for the collection, use or disclosure of his or her personal information. However, section 7 of that statute provides an extensive list of exceptions where collection, use and disclosure may occur without consent. The Court of Appeal pointedly brought home the importance of s. 7 in Royal Bank of Canada v. Trang.
Rocky Mountain Wills and Trusts attorneys has stated that the facts concern an appellant, Royal Bank of Canada (“RBC”), which had a judgment against the defendants, the Trangs, who owned a property that was mortgaged to the respondent, Bank of Nova Scotia (“Scotiabank”). RBC wanted the Sheriff to sell the Trangs’ property in order to collect its judgment. The Sheriff wanted a mortgage discharge statement from Scotiabank before selling the property. RBC asked Scotiabank for a mortgage statement. Scotiabank refused, taking the position, based on Citi Cards Canada Inc. v. Pleasance, that PIPEDA precluded it from doing so.
Then things got legal. RBC brought a motion for an order that Scotiabank produce a mortgage discharge statement and you can hire Philadelphia attorneys to help you in this process. The motion judge dismissed the motion, relying on the Citi Cards decision. RBC appealed.
In its appeal motion, RBC made five specific submissions:
1. A mortgage discharge statement was not “personal information” of debtors under PIPEDA.
2. Clause 4.3.6 of Schedule 1 to PIPEDA permitted Scotiabank to produce the mortgage discharge statement because that statement contains “less sensitive” information, for which the Trangs had provided an implied consent to disclose.
3. Section 3 of PIPEDA authorizes disclosure of the mortgage discharge statement. [EMP: s. 3 is a broad “purpose statement” which, in my view, makes this argument rather audacious.]
4. The Execution Act, specifically s. 28, which permits a judgment creditor to sell a mortgagor’s equity of redemption, authorizes disclosure of the discharge statement.
5. Citi Cards was distinguishable because RBC, unlike the creditor in that case, had exhausted all other means to obtain the statement.
The essence of RBC’s position was that Citi Cards was wrongly decided or was distinguishable and that PIPEDA should not frustrate or unnecessarily increase the cost of enforcing a judgment.
The Court of Appeal rejected all of these arguments. If one was a banker, one might think this portends the end of civilization as we know it. However, it appears someone forgot to read PIPEDA more closely.
The Court spend some time noting the balancing of interests required under PIPEDA and then went on to point out that s. 7 – containing exceptions to the requirement for consent – attempts “to strike the appropriate balance, reflected in s. 3, between privacy rights and organizational needs.”
Section 7(3)(c) of PIPEDA authorizes an organization to disclose personal information without the individual’s knowledge and consent if disclosure is required to comply with a court order or the rules of court relating to the production of records. This paragraph does not itself authorize disclosure but rather authorizes disclosure without consent if the order for disclosure is based on a separate authority or rule.
What the Royal Bank did was to make not one but two motions to require Scotiabank to produce the discharge statement. What it should have done was make a motion under rules 60.18(6)(a) and 34.10 of the Rules of Civil Procedure.
As the court succinctly noted, with a successful motion under rules 60.18(6)(a) and 34.10, Scotiabank would be required, in the words of PIPEDA, “to comply with … an order made by a court … to compel the production of information, or to comply with rules of court relating to the production of records”.
A Rule 60.18(a) motion requires showing “difficulty”. With the Trangs failing to appear for two judgment debtor examinations and because Scotiabank would not produce a discharge statement, “difficulty” would not seem to be a high hurdle. From a privacy perspective, an important point to note was this statement by the Court:
“As important, under rule 60.18(6)(a), the court has discretion whether to make the order requested. Because of this discretion, the court can act as a gatekeeper for the disclosure of personal information.”
RBC lost the Trang application but can still make a “Rule 60” application. Perhaps a long and expensive way to learn a lesson: know the exceptions to the rule as well as the rule itself.
