Privacy Torts in Ontario
Ontario recognizes both statutory and common law privacy torts. The principal sources of privacy protection in Ontario civil law are:
- The common law tort of intrusion upon seclusion, recognized by the Ontario Court of Appeal in Jones v Tsige, 2012 ONCA 32;
- The Ontario Privacy Act, R.S.O. 1990, c. P.28, which creates a statutory cause of action for violation of privacy;
- The common law tort of publication of private facts, which the courts have recognized as a likely cause of action in Ontario;
- The federal Personal Information Protection and Electronic Documents Act(PIPEDA) and its provincial equivalents, which regulate the collection, use, and disclosure of personal information.
Intrusion Upon Seclusion: Jones v Tsige
In Jones v Tsige, 2012 ONCA 32, the Ontario Court of Appeal became the first appellate court in Canada to formally recognize the common law tort of intrusion upon seclusion. The defendant had accessed the plaintiff's banking records hundreds of times over four years using her position as a bank employee, without any business purpose.
Elements of Intrusion Upon Seclusion
The Court of Appeal in Jones v Tsige held that the tort is established where:
- Intentional or reckless conduct: The defendant's conduct was intentional or reckless — mere negligent disclosure of private information does not suffice;
- Invasion of private affairs or concerns: The defendant invaded, without lawful justification, the plaintiff's private affairs or concerns — the privacy interest must be one that the plaintiff reasonably expected would be protected;
- Highly offensive to a reasonable person: A reasonable person would regard the invasion as highly offensive, causing distress, humiliation, or anguish.
Critically, the plaintiff does not need to prove actual loss. The tort compensates for the dignitary harm of the privacy invasion itself. This distinguishes it from most torts, which require proof of damage.
Damages for Intrusion Upon Seclusion
The Court in Jones v Tsige awarded general damages of $10,000 without proof of actual pecuniary loss and set a cap of $20,000 for general damages absent proof of a more serious wrong. The cap does not apply to:
- Aggravated damages where the plaintiff proves greater distress or humiliation;
- Punitive damages where the defendant's conduct was particularly malicious or high-handed;
- Actual pecuniary losses caused by the privacy invasion.
Categories of Invasion
The Restatement (Second) of Torts categories of privacy invasion, which influenced the Ontario court, include:
- Intrusion upon seclusion or solitude, or into private affairs;
- Public disclosure of embarrassing private facts;
- Publicity placing the person in a false light;
- Appropriation of name or likeness.
Ontario courts have applied intrusion upon seclusion primarily to cases of unauthorized access to private information — banking records, medical records, email accounts, and private photographs. The tort has been applied to employees who access co-workers' records, partners who access a spouse's accounts, and individuals who intercept private communications.
The Ontario Privacy Act
The Privacy Act, R.S.O. 1990, c. P.28 creates a statutory cause of action for violation of a person's privacy. Section 2 provides that a person who violates the privacy of another person is liable to damages.
Section 3 expressly states that it is not necessary to prove actual damage to sustain an action. Section 4 sets out factors relevant to assessing the nature and degree of the privacy violation:
- The nature, use, and extent of disclosure of the private matter;
- Whether the plaintiff consented;
- The defendant's awareness that the act violated privacy;
- Whether the defendant benefited from the violation.
Publication of Private Facts
The common law tort of publication of private facts — one of the Restatement privacy torts — has not been as fully developed in Ontario as intrusion upon seclusion, but the Supreme Court of Canada in Crookes v Newton[2011] 3 SCR 269 and Ontario courts have indicated that it likely exists. The tort requires:
- Public disclosure of private information about the plaintiff;
- The information was not of legitimate public concern;
- The disclosure would be highly offensive to a reasonable person.
Publication of private facts has particular relevance to:
- Disclosure of medical or mental health information;
- Disclosure of intimate images (see also Ontario's Intimate Images and Cyber-violence Act, 2023);
- Disclosure of private financial information;
- Disclosure of sexual orientation or other deeply personal matters.
PIPEDA and Ontario Privacy Law
The federal Personal Information Protection and Electronic Documents Act(PIPEDA) governs the collection, use, and disclosure of personal information in the course of commercial activities. PIPEDA creates obligations for organizations to obtain consent, limit collection, ensure accuracy, provide access, and safeguard personal information.
The Office of the Privacy Commissioner of Canada can investigate complaints and make findings under PIPEDA. Where the Privacy Commissioner finds a violation, the complainant may apply to the Federal Court for a remedy, including damages. In Chitrakar v Bell TV, 2013 FC 1103, the Federal Court awarded damages for PIPEDA violations.
Ontario does not have private sector privacy legislation equivalent to Alberta's PIPA or British Columbia's PIPA; PIPEDA applies to commercial activities in Ontario. Health information in Ontario is regulated by the Personal Health Information Protection Act, 2004 (PHIPA), which creates specific obligations for health information custodians.
Intimate Images and Cyber-Violence
Ontario's Intimate Images and Cyber-violence Act, 2023 creates a specific cause of action for non-consensual sharing of intimate images. A person whose intimate image is shared without consent may sue for damages, and courts may order removal of the image. The Act provides for expedited access to courts and interim injunctions to prevent irreparable harm from ongoing publication.
Practice Points for Ontario Privacy Lawyers
- For intrusion upon seclusion claims, document the extent of the unauthorized access — the number of accesses and the sensitivity of the information are relevant to the quantum of damages within the $20,000 general damages cap.
- Consider whether to plead both the common law tort and the Privacy Act— the statutory claim has no damages cap while the common law claim has a $20,000 cap for general damages in the absence of proven actual loss.
- For PIPEDA complaints, advise clients to first file with the Privacy Commissioner before seeking Federal Court relief — the complaint process is a prerequisite.
- In employment matters, assess whether the employer's conduct was covered by a lawful monitoring policy — absence of notice may support a stronger intrusion upon seclusion claim.
- The two-year limitation period under the Limitations Act, 2002 applies to intrusion upon seclusion and Privacy Act claims from the date of discoverability. For ongoing privacy violations (e.g., continued retention of private information), fresh causes of action may arise continuously.