“The Most Egregious of Circumstances” – The Federal Court Confirms the High Bar for Privacy Law Damages in Al-Husseini v. Altaif Inc.

Introduction

The Federal Court’s recent decision in Al-Husseini v. Altaif Inc., 2022 FC 1497, adds to a growing number of cases that address the high bar for awarding privacy law damages under Section 16 of the Personal Information Protection and Electronic Documents Act (“PIPEDA”). Justice Strickland confirmed the Federal Court’s high bar when she refused to award damages to Sadeq Al-Husseini (“Mr. Al-Husseini”), who had brought an application against Altaif Inc. for disclosing financial information that he claimed exceeded the scope of a production order (the “Production Order”) related to his divorce proceedings, thereby breaching his privacy rights.

In dismissing Mr. Al-Husseini’s application and denying damages, Justice Strickland emphasized that, while PIPEDA gives the Federal Court discretion to grant remedies for privacy breaches, an award for privacy law damages should only be made in the “most egregious of circumstances.”

Background

On September 15, 2020, the Ontario Superior Court of Justice, Family Court (the “Family Court”) issued a production order (the “Production Order”) for documents relevant to a divorce proceeding between Mr. Al-Husseini and his ex-wife. The Production Order included a request for third-party records that would illustrate transfers of funds between Mr. Al-Husseini and several financial institutions. One of the financial institutions included in the Production Order was Altaif Inc., a business that offers foreign exchange and money transfer services.

On January 7, 2021, in response to the Production Order and an additional letter from the ex-wife’s lawyer, Altaif Inc. advised that Mr. Al-Husseini had not processed any money transfers with Altaif Inc., but had conducted a number of foreign exchange operations with Altaif Inc.’s Windsor branch between 2016 and 2017. 

On February 19, 2021, Mr. Al-Husseini sent Altaif Inc. a letter asserting that having disclosed the foreign exchange transfer records, Altaif Inc. had breached Mr. Al-Husseini’s right to privacy under PIPEDA by providing information that fell outside the scope of the Production Order. Mr. Al-Husseini’s letter sought $20,000 in damages and advised that if a response was not received within two weeks, then he would make a formal complaint to the Office of the Privacy Commissioner of Canada (OPC).

Mr. Al-Husseini subsequently filed a complaint with the OPC. In its report, the OPC concluded that Altaif Inc.’s disclosure was valid under the Production Order and there was no breach of PIPEDA. After receiving the OPC’s report, Mr. Al-Husseini brought his application to the Federal Court under Section 14 of PIPEDA, which permits individuals to apply for a hearing at the Federal Court to appeal the results of an OPC investigation.

Consistent with his letter to Altaif Inc., Mr. Al-Husseini’s application sought two things: (1) a declaration that Altaif Inc. had breached his privacy rights, and (2) $20,000 in damages pursuant to Section 16 of PIPEDA.

Issues

The Federal Court divided its decision into two issues:

1. Whether Altaif Inc. had breached Mr. Al-Husseini’s PIPEDA privacy rights.
2. If there had been a breach, whether Altaif Inc. owed Mr. Al-Husseini any damages.

Analysis

1. Whether Altaif Inc. had breached Mr. Al-Husseini’s PIPEDA privacy rights.

   On the first issue, the Federal Court decided that Altaif Inc. had not breached Mr. Al-Husseini’s privacy rights, because foreign exchange transfers were validly within the scope of “transfers of funds,” and thus Altaif Inc.’s disclosure was within the scope of the Production Order. The Federal Court accepted the Altaif Inc.’s submission that the transfer of funds was not limited to transfers from one person to another, but could include transfers between accounts of the same person.

   Furthermore, if the intention of the Production Order was to ensure that the Family Court received financial details necessary to calculate claims in Mr. Al-Husseini’s divorce proceeding, identifying instances where Mr. Al-Husseini had transferred funds to himself would be necessary to fairly and accurately assess his assets.  

2. If there had been a breach, whether Altaif Inc. owed Mr. Al-Husseini any damages.

Having decided that Altaif Inc.’s “transfer of funds” fell within the scope of the Production Order, the Federal Court was not required to address the second issue of damages. However, even if the Federal Court was wrong in its conclusion on the first issue, Mr. Al-Husseini had not established that the disclosure of his personal information had resulted in the damages he claimed.

If the Family Court had assessed the records from Altaif Inc. and determined that they were outside of the scope of the Production Order, the Family Court could disregard that information, thereby eliminating the risk of damage. In addition, Mr. Al-Husseini had not provided specific information to justify the quantum of damages he sought, had not established that he actually suffered the alleged damages, and had not proven that those damages had been caused by Altaif Inc.’s disclosure. As such, the Federal Court declined to exercise its discretion under Section 16 of PIPEDA to make an award of damages.

Section 16

Justice’s Strickland’s decision in Al-Husseini v. Altaif Inc. confirms that the Federal Court will grant damages in only the most “egregious of circumstances.” Damages may be awarded where the breach is serious (involving sensitive information), and the respondent acted in bad faith or attempted to cover up the breach. Even in those cases where damages have been awarded, the awards have been relatively small. In situations where the respondent acted in good faith, or promptly took steps to rectify the error and put in place measures to prevent future disclosures, awarding damages is rare.

Al-Husseini v. Altaif Inc. makes a welcome addition to a growing body of law on awarding damages under Section 16 of PIPEDA. The cases on this issue remain limited, and PIPEDA provides no guidance on the quantum of damages that may be granted. To review a selection of other core cases on this issue, please click here.

For more information about this details of this case or other matters related to privacy law damages, please contact Roland Hung or another member of Torkin Manes’ Technology, Privacy & Data Management Group.

*Disclosure: Roland Hung was counsel for the Respondent in Al-Husseini v. Altaif Inc., 2022 FC 1497.

With appreciation, the author acknowledges the contribution of Articling Student, Charlotte Butler, who assisted in drafting this article.