Court Certifies Class Action Relating to Improper Access of Medical Files

By: Kelly Brennan

In Welshman v. Central Regional Health Authority, the Supreme Court of Newfoundland and Labrador (Court) certified a class action in which the plaintiffs alleged that employees of the defendant, the Central Regional Health Authority, improperly accessed the private personal and medical information of 260 individuals outside of the scope of their employment. The Court’s decision is at the intersection of privacy law, employment law and class actions law.

The plaintiffs alleged a breach of privacy based upon the statutory tort of breach of privacy under the Newfoundland and Labrador Privacy Act, a breach of privacy based upon the common law tort of “intrusion upon seclusion,” negligence, and breach of contract. The plaintiffs further pled the doctrine of vicarious liability to support their claims against the employer defendant (i.e., to hold the employer liable for the conduct of its employees).

One of the criteria for certification under the Newfoundland and Labrador Class Actions Act (CLA) is that the pleadings disclose a cause of action. The Court noted that only one of the four claims advanced by the plaintiffs needed to disclose an arguable cause of action in order to meet that criterion, but in this case all four claims disclosed an arguable cause of action:

1. The plaintiffs argued that the violation of their privacy and other members of the proposed class met the Privacy Act’s threshold of conduct that was “wilful” and “without colour of right,” as the employees of the defendant accessed the plaintiffs’ private records outside the scope of their employment. The Court stated that whether or not “the action or inaction of the Defendant is ultimately sufficient to reach the threshold of wilfulness and thus ground a direct liability claim against the Defendant is unclear at the present time.” This was an issue to be fleshed out at trial. On the issue of vicarious liability, the Court stated, “It is clear that it is possible for the principles of vicarious liability to operate with a statutory tort.” It will ultimately be for the trial judge to determine this issue.
2. With respect to the claim for a breach of privacy based on the common law tort of intrusion upon seclusion, the defendant argued that the common law tort could not coexist with a breach of the Privacy Act and in any event the pleadings did not specifically plead wilful or intentional conduct on behalf of the defendant itself. The Court found that a breach of the common law tort of intrusion upon seclusion and a breach of the Privacy Act may be able to coexist as the law is unsettled. The pleading here was sufficient.
3. The defendant disputed the claim of negligence on the basis of the damages sought in that the plaintiffs “have to prove that the damages alleged are suitable under the class action framework (i.e., are suitable for aggregate damages).” The defendant also argued that allegations of “mental distress, anguish, anxiety and stress” did not rise to the level of compensable loss in negligence. The Court disagreed as the information in question deals with the plaintiffs’ personal and medical information. It was possible that the plaintiffs could establish serious and prolonged psychological impacts at trial. The Court held this was an issue to be determined at trial.
4. On the issue of breach of contract, the Court stated that while it may be difficult for the plaintiffs to make a claim on the basis of an implied or good faith contract between them and the defendant, it was not impossible. It was not plain and obvious that an action in contract would be unsuccessful at trial.

The Court then found that the other criteria to certify an action as a class action in the CLA had been met:

• There was an identifiable and proper class.
• There were common issues to support the action.
• A class action was the preferable procedure.
• The representative plaintiffs were suitable representatives.

The class action was therefore certified.

This decision serves as a stark reminder that Canadian courts will take breaches of privacy (and related causes of action) seriously, and that Canadian courts remain open to novel claims for certification of class proceedings. Where those issues intersect, it is crucially important to have the best possible strategic legal advice.

The article in this client update provides general information and should not be relied on as legal advice or opinion. This publication is copyrighted by Hicks Morley Hamilton Stewart Storie LLP and may not be photocopied or reproduced in any form, in whole or in part, without the express permission of Hicks Morley Hamilton Stewart Storie LLP. ?

Practice Areas: Information, Data Security & Privacy, Litigation - Class Actions

Tags: Class Actions, Privacy