The price of inaccuracy: Federal Court awards first damages for PIPEDA breach
This week, the Federal Court of Canada made its first damage award ever under the 10 year old Personal Information Protection and Electronic Documents Act (PIPEDA), awarding damages to a businessman in connection with the provision of inaccurate credit information by a credit reporting agency -- despite a failure to prove actual losses arising from the breach.
While the quantum of the damages awarded in Nammo v. Transunion of Canada Inc., was a modest $5,000 plus costs, the case establishes several important principles respecting the interpretation of PIPEDA and the availability of damages for humiliation stemming from a violation of the Act.
The case concerned a businessman who sought a bank loan in order to launch a trucking business with a partner. The loan was rejected by the bank based on an inaccurate credit profile for the applicant, which subsequently was discovered to include the credit history of another individual with a different name, date of birth, Social Insurance Number and address history.
The case marks the Court’s first consideration of Clause 4.6 of Schedule 1 to the legislation, which requires that personal information held by an organization must be “as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used.” Justice Zinn rejected the respondent’s argument that there is no breach of “the Accuracy Principle” where an organization responds adequately to correct inaccurate information after it is brought to its attention, finding that while such rectification may be a factor to consider in determining an appropriate remedy, it cannot be used as “an escape hatch” to avoid a finding of a breach of the principle itself. Justice Zinn similarly found that neither prior notification of inaccuracy, nor industry standard practices, nor commercial efficiency were relevant to assessing whether the Accuracy Principle had been breached.
In the first Federal Court damage award under s. 16 of PIPEDA, Justice Zinn awarded damages for humiliation for violation of the Accuracy Principle of the Act, finding “a serious breach involving financial information of high personal and professional importance.” It is noteworthy that damages were awarded despite little apparent evidence in this regard, with the judge finding that a reasonable person would have been humiliated by having their loan application turned down, having to convey to their business partner that their credit was “bad” and living with the taint of uncreditworthiness before their bank, in addition to undergoing the process to have the error corrected.
On the question of jurisdiction, Justice Zinn found that, while the Federal Court, on conducting a hearing de novo pursuant to s. 14 of PIPEDA, does not have jurisdiction to consider matters that were not complained of to the Privacy Commissioner of Canada in the complaint on which the rehearing is based, the Court’s jurisdiction is constrained only by the factual issues raised before the Privacy Commissioner, not by the particular clauses of the legislation considered by the Commissioner or her legal characterization of the factual issues raised.
