We live in a strange era where the evolving narrative of the Right to privacythat dominates headlines and political circles is from the Law of privacythat is messy, piecemeal, and underdeveloped. It’s not that we don’t have a litany of privacy laws in Canada. We just don’t have the right ones.
What we are missing, especially in Alberta, is a broad plea in tort law for invasion of privacy.
In Canada, data protection interests are governed by several laws, such as: B. Defamation and willful infliction of nervous shock, as well as fraud, harassment or voyeurism. Sections 7 and 8 of Canadian Charter of Rights and Freedoms Protection of privacy, albeit primarily and directly in a criminal law context. Best known are the provincial and federal data protection laws that govern the collection, use, and disclosure of information in the public and private sectors. These are basic data protection laws enforced by the federal and provincial data protection officers, a tighter legal framework for data protection. Some provinces, including Alberta, have created a legal plea for non-consensual disclosure of intimate pictures (also known as revenge porn).
But at a time when technology is advancing in new and diverse ways that encroach on our concept of privacy, there is a worrying loophole in the law. We live and interact online as well as in person these days, and social media can be a platform for doxing, catfishing, and other forms of online identity, harassment, and abuse. A person’s private Facebook or Snapchat messages can be screenshots and shared online, a person’s information can be posted on escort or shaming sites, or images manipulated with humiliating effects (e.g. Deepfake).
With the development of technology, the possibilities and forms of invasion of privacy are also changing. Technology can facilitate abuse, whether it be by monitoring online accounts, tracking movement, recording conversations, or sharing intimate pictures. The devices can be small and difficult to see, like the pen camera a teacher uses to film high school girls’ boobs R in Jarvis. The Internet of Things has improved connectivity and can be a tool for domestic violence, for example for ex-partners to remotely lock doors, turn lights on and off and raise the temperature in an ex-partner’s house. The nature of the threat is evolving. Robots and artificial intelligence are accelerating the embedding of technology in our lives and increasing our privacy vulnerabilities.
Some of these issues are addressed by existing privacy laws, and others fall into the gray category of legitimate but terrible. Tort law, however, has a decisive function in private law, it mediates social behavior and protects fundamental rights. In the face of social upheaval, it can instigate social norms by recognizing that an interest like privacy is at stake and by establishing the rules of sound behavior. In addition, the technology is a reminder of the central importance of privacy to our everyday experiences. Data protection enables us to participate meaningfully in society and to build trusting relationships. Tort law has often played an important role in providing such spaces.
Alberta is also not keeping pace with many other provinces. British Columbia, Saskatchewan, Manitoba, and Newfoundland and Labrador have legal causes of invasion of privacy. Quebec protects privacy in its Charter of human rights and freedoms and Civil Code. Ontario has introduced a common law data protection offense to invade privacy when it comes to seclusion Jones versus Tsigethat was tracked in Nova Scotia and paved the way for the introduction of other privacy offenses in Ontario.
Introducing a data breach is not a panacea for technology-enabled invasion of privacy. We look no further than slander to know that litigation in these cases is expensive, time-consuming, and rarely delivers the desired results. It is a large-volume, low-value, legally complex matrix. However, in order to resolve issues of access to justice, be it through accelerated procedures, online courts or other forms of support, we first need a law.
All of this means two things to Alberta. First, a data breach should be enshrined in Alberta law, be it custom or statute. Jones was cited in several cases in the province, so there are good reasons to assume that the courts will accept it here, but no decision has yet been made on the matter. Second, Alberta has the ability to lead. The suite of privacy crimes on which Jones are completely inadequate for the task of combating technology-assisted intrusions into privacy – “impoverished”, as Dr. Stuart Hargreaves cleverly described. Alberta might need a data breach, but not this one.
Jones’ Intrusion into the seclusion offense draws from the Americans Restatement (second) of tortswho identified four different data breaches. In 2021, all four torts were accepted by courts in Ontario. The other three are image misappropriation, public disclosure of private embarrassing facts, and public positioning of a person in a false light. The appeal of these offenses is understandable. They are pragmatic and rule-based. You can join some kind of activity and harm (reputation, property or emotional distress) and conduct a proper and orderly legal review. But it is frozen in an American legal mindset of the 1960s when the illicit acts suggested by Professor William Prosser, and because of its structure, cannot evolve with changing privacy norms and rapid technological innovations.
What was ossified? Among other things, the belief that privacy is what happens when we are withdrawn or alone, that privacy only protects deviant or intimate behavior, and that context does not matter. In the age of technology, our privacy is vulnerable to our act of existence as we cannot avoid going outside, using technology, sharing our personal information, or otherwise being disclosed. Many things that we might consider invasions of privacy, such as deepfakes, catfishing, some forms of doxing, and the expansion of content through search engines, would likely not be feasible as a privacy offense. The pies are also hard to justify Charter Case law on data protection, in particular the contextual factors that courts have taken into account when assessing a reasonable expectation of data protection and weighing up competing rights.
For all the shortcomings of Prosser’s tort, I understand that nothing will hinder access to justice more than a poorly worded tort. If the goal is to protect everyday privacy, the tort should be as safe, predictable and limited as possible. There are some options for legislative reform, but if a major overhaul of data protection law is sought, a legal cause of action is likely the best option. Other provincial laws can be a blueprint of where to begin drafting, but should not be adopted across the board. In particular, a data protection offense should be modeled loosely Charter Frame. I say loosely because tort law is ultimately about compensating for certain losses. As an unlawful act, this would mean that the legitimate expectation of a data protection review is at the center of the analysis, followed by an analysis of any conflicting interests and a balance between competing rights.
In the same way, I advocate a data protection breach in Alberta and reject the simplest possibility. Our current common law offenses are a patchwork solution, if nothing else, but we can do better.
This comment is based on research funded by an Insight Grant from the Social Sciences and Humanities Research Council.
Dr. Emily Laidlaw is the Canada Research Chair in Cybersecurity Law and Associate Professor in the Law School of the University of Calgary.