Common law privacy breach cases require a claimant to show:

• a defendant intentionally disseminated the claimant’s private information;
• this dissemination constituted an invasion, without lawful justification, of the plaintiff’s private affairs or concerns; and
• this invasion would be regarded by a reasonable person as highly offensive, causing distress, humiliation or anguish.

The tort of “invasion of privacy” is relatively new in Ontario – and Canada more generally – with the court’s conceptualisation of privacy developing year-on-year. The Ontario tort of privacy breach was originally developed in the late 2010s to counter unlawful disclosure of personal information (such as medical or banking information by third parties; however, it has grown to encompass concepts such as “false light” breach of privacy, where the unlawful disclosure paints the plaintiff in a light that does not accurately reflect them. In this sense, “false light” privacy breach cases bear some similarity to defamation – although the case law in this area is relatively sparse and will likely develop in the coming years.

A plaintiff in a civil case may seek pre-publication injunctive relief to embargo private information – although the threshold is relatively high and Ontario courts are alive to the imperative that free expression/a free press plays in a democratic society. The result is that a claimant seeking such relief must have grounds that go beyond mere embarrassment from the disclosure and instead show an interest that is more pressing than free expression/a free press/the presumptive openness of the court process. This is done on a case-by-case basis and generally a claimant must show that:

• court openness poses a serious risk to an important public interest;
• the order sought is necessary to prevent this serious risk to the identified interest because reasonable alternative measures will not prevent this risk; and
• as a matter of proportionality, the benefits of the order outweigh its negative effects.

Recent Supreme Court of Canada rulings establish that for disclosure to be enjoined, the impugned information must go to the “biographical core” of the individual seeking the publication ban. This means that the information must be truly unique to the moving party. Common examples might be disclosure of a stigmatised fact about the individual, such as occupation, medical diagnosis or prior emotional trauma.

It is worth noting that – civil cases aside – the Criminal Code of Canada has its own well-established statutory regime for presumptive publication bans of information that may identify the victims of sexual assault. The result is that media organisations seeking to report on sexual assault cases will often face a number of presumptive publication bans that must be navigated.

Also notable is that corporations and governmental and medical entities in the province are also bound by their own privacy legislation, which sets out a number of statutory penalties that are focused more on compliance than strict monetary compensation (which would be the general goal of a civil action). 

Damages for breach of privacy in Ontario tend to be relatively modest – at least to date. The original case law in Ontario that created civil breach of privacy as a tort suggested that damages for privacy breaches should be limited to around CAD20,000.

That being said, this guideline is now approximately a decade old. With the advent of increasingly egregious and pervasive forms of privacy breach such as “revenge pornography”, it is possible – indeed, likely – that this informal cap on damages will have less relevance as the case law develops.

Under Ontario’s Limitations Act, the general limitation period for a civil breach of privacy case is two years from the date that the plaintiff either knew or should reasonably have known that it was appropriate to bring a claim.

This is not a standard of perfect knowledge and the question of when it is “appropriate” to bring a claim can often be a subject of some contention. As a general rule, it is often better to commence litigation promptly – if only to put defendants on notice and begin the process of preserving evidence.

Civil and Criminal Proceedings

A victim of a privacy breach has the ability to pursue both civil and criminal proceedings against an individual who has breached their privacy. In the former case, the plaintiff will drive the process, whereas – in the latter – the question of whether to lay charges under the Canadian Criminal Code will be up to the police and/or the Crown prosecutor’s office, depending on the province.

The main distinction is that, whereas a civil case can be brought and controlled by the plaintiff, a criminal proceeding places the Crown (ie, the State) in the “driver’s seat” and treats the victim of a privacy breach as more of a “key witness”. For this reason, victims of so-called revenge porn breaches of privacy are often called upon to consider whether they wish to pursue and be a part of criminal proceedings, as one criticism is that such proceedings deprive them of agency or a voice.

Civil cases are focused on monetary compensation, whereas criminal proceedings are focused on remedies such as probation, jail terms, and/or community service.

Private or Anonymised Court Proceedings

Canadian courts will be loath to permit cases to be pursued entirely in private (in camera). Such draconian measures go against the presumption of an open court in Canadian law and extensive publication bans over large swaths of a case are reserved usually for matters involving national security and/or confidential intelligence gathering. Even in these “hot button” cases, Canadian judges will not grant publication bans beyond what is strictly necessary.

Parties hoping for complete confidentiality to mediate private civil disputes are better served by seeking agreement on the appointment of a private arbitrator in Ontario, as these arrangements can include robust privacy positions. (However, the appointment of a private arbitrator may well add significantly to the parties’ litigation expenses.)

Establishing Grounds to Bring Proceedings

Establishing jurisdiction in Ontario for a civil breach of privacy claim is relatively easy, in the sense that any number of factors can ground jurisdiction under Ontario’s “real and substantial connection” test, including the place where the tort was committed and the residence of the plaintiff or defendant. Ultimately, an Ontario court will adopt a two-step approach to a jurisdiction challenge, asking:

• whether or not Ontario has legal jurisdiction in the sense that there is a “real and substantial connection” to the province; and
• if it does, whether or not there is another jurisdiction that is more convenient as the true locus of the case.

Put simply, a court will determine first if it can exercise jurisdiction and, then, whether it should. This is a far-ranging analysis, and the court will look at the full factual matrix of the case.

In the privacy context, a claimant may face a jurisdiction challenge where the connection to Ontario is merely nominal or technical (such as where perhaps only computers or servers were located in Ontario) and/or where there is another forum that is clearly more connected to the facts in issue (ie, where the majority of consumption of the impugned material was in another jurisdiction). As a result, courts in Ontario will be alive to allegations of “forum shopping”.

Ontario law presumes that a successful claimant will have a portion of their legal costs paid. The general rule is that a successful party will receive “partial indemnity” costs – approximately 60-70% of their overall fees and expenses for the litigation.

In cases where the unsuccessful party acts improperly, or where its position was particularly tenuous, a court can award “substantial indemnity” or “full indemnity” – that being 80–100% of the successful party’s legal fees.

The foregoing is always subject to the fact that an Ontario judge has full discretion over whether to award costs in a proceeding. The upshot is that a successful party that acts egregiously in litigation may find their costs award diminished by a displeased judge.

Perhaps the most unusual feature of privacy claims in Ontario is their relatively slow development in terms of case law and damages. One suspects that this will change as the locus of privacy disputes shifts to the online world, where harm can be much more pervasive, and as victims of the disclosure of intimate images bring more cases in the jurisdiction.

In addition, it is worth noting that a number of pieces of legislation address the requirements for government, medical and corporate actors to maintain and secure private personal information. These acts can have applicability to a civil breach of privacy claim, but they are mainly applicable to mass data breach cases involving hackers and the like.

Canadian defamation law is largely built upon the historical law from the UK. To prove defamation, a claimant must prove that:

• the defendant has made a publication to a third party;
• this publication concerns the plaintiff; and
• this publication would lower the plaintiff’s reputation in the community.

This is a low threshold and the vast majority of cases will revolve around whether the defendant can successfully rely on one of the available defences to defamation. These defences include:

• truth – that the allegation was true or substantially true;
• honest opinion – that the defendant was expressing an honestly held opinion on a matter of public interest with sufficient factual context;
• responsible communication – that the defendant made the publication responsibly under all the circumstances (a defence most often attributed to and applied by the news media); and
• qualified privilege – that the publisher had a social, legal or moral obligation to make the publication to the recipient at the time the publication was made (for example, a complaint to a regulatory body).

Damages/Remedies

Damages are the usual remedy in Canadian defamation cases. Damages are awarded using two general measures (which can be awarded simultaneously):

• special damages – “out-of-pocket” damages that the plaintiff can show as arising from the defamation (ie, a large drop in commercial sales as a result of a defamatory article); and
• general or “at large” damages – damages awarded by the judge or jury for the otherwise unquantifiable damage to the plaintiff’s reputation (given that the effect of defamation is often insidious and hard to quantify, it is not uncommon for plaintiffs to rely upon this measure of damages, as special damages can be difficult to prove).

The extent of damages can vary widely and will depend on the specific facts of each case, including:

• the nature of the defamation and whether it implies criminality or moral turpitude;
• the nature and size of the community to whom the defamation was published;
• the extent to which propriety is a hallmark of the community to which the plaintiff belongs (eg, lawyers, doctors);
• the anguish caused to the plaintiff; and
• the overall conduct of the defendant, and whether the defendant was particularly malicious or punitive in making or publicising the defamation.

The smaller the community or the more mundane the defamation, the more the damages are likely to be in the low thousands or mid-five figures. The wider the publication and the more harmful the defamatory statement, the more likely it is that a damages award will be in the low-to-mid six figures. The highest damages awards to date (from the late 1990s/early 2000s) tend to be in the mid-six figures for serious defamation arising in large national broadcasts or publications.

Injunctions

Defamation injunctions are available in Ontario courts, but they are extremely difficult to obtain. This stems from the fact that Canadian courts are unwilling to limit free expression and essentially “pre-judge” a case by enjoining expression prior to trial. A plaintiff seeking to enjoin a defendant from making defamatory statements prior to trial must have a case of such strength that the matter is essentially predetermined. The test is as follows.

• The publication complained of must be clearly defamatory and impossible to justify.
• If the defendant states an intention to rely on common law defences to defamation, the injunction must be refused unless it is clear that any such defence will inevitably fail.
• The plaintiff must establish irreparable harm if the injunction is refused.

These sorts of injunctions are rarely granted and are usually reserved for the most egregious cases – ie, cases of extreme online “trolling” or harassment with allegations of criminality or extreme moral turpitude.

In addition, a plaintiff can apply for a post-judgement order enjoining the defendant from further publishing. However, in addition to the foregoing, the plaintiff must also show that the defendant is likely to continue to defame the plaintiff and be ungovernable by further damages awards.

Limitation Periods in Ontario

The general Ontario limitation period for defamation is two years from the date that the publication came to the plaintiff’s attention. The general limitation period in other Canadian provinces depends on the specific limitations act of that province or territory.

However, in cases that involve “newspapers” or “broadcasters” in Ontario, the preconditions and limitations to bring a defamation action are short and stringent thanks to Sections 5 and 6 of Ontario’s Libel and Slander Act. The plaintiff is obliged to deliver a notice of libel to all defendants involved in the publication that they wish to sue within six weeks of the libel coming to the plaintiff’s attention and a claim must be commenced within three months. The purpose of this short timeline is twofold: it permits the media defendant to issue an expeditious retraction and apology while the matter is fresh and it ensures that journalists are not forced to “look over their shoulders” for prolonged periods of time for the articles they have published.

While television, radio, newspaper and online newspaper/magazine outlets are clearly covered by these truncated timelines under Sections 5 and 6, it remains an open question as to whether online mediums such as X (formerly Twitter) and Facebook are “broadcasters” under the Libel and Slander Act and therefore able to avail themselves of these sections. Ontario case law from approximately a decade ago held that this question could not be decided without suitable expert evidence on the issue and, to date, no case has taken up or resolved that challenge. As a result, the question remains important, albeit largely academic at this point.

Protections for Media

Much like in the UK, Canadian law has enshrined a “reasonable communication” defence that is often employed by media defendants in defamation claims. The defence employs a non-exhaustive list of factors to determine whether an otherwise defamatory publication is defensible. Those non-exhaustive factors are:

• the seriousness of the allegation;
• the public importance of the matter;
• the urgency of the matter;
• the status and reliability of the source;
• whether the plaintiff’s side of the story was sought and accurately reported;
• whether the inclusion of the defamatory statement was justifiable;
• whether the defamatory statement’s public interest lay in the fact that it was made rather than in its truth; and
• any other relevant circumstances.

Media defendants in Canada do not have a blanket/presumptive privilege for the protection of journalistic sources. Rather, they can avail themselves of a common law privilege (known as a “Wigmore privilege”) that allows a media defendant to assert confidentiality on a case-by-case basis. In addition, and more recently, a privilege analysis has been codified by Section 39.1 of Canada’s Federal Evidence Act, which provides that confidentiality over a confidential journalistic source can be overcome if the moving party can show that:

• the information or document sought cannot be produced in evidence by any other reasonable means; and
• the public interest in the administration of justice outweighs the public interest in preserving the confidentiality of the journalistic source, having regard to, among other things:
1. the importance of the information or document to a central issue in the proceeding;
2. freedom of the press; and
3. the impact of disclosure on the journalistic source and the journalist.

Criminal and Civil Procedures

Canada’s federal Criminal Code has provision for defamation, but it is rarely – if ever – employed. Civil courts are the primary forum for defamation in Canada.

Defamation Proceedings in Private or Anonymised Court Proceedings

Anonymisation of parties in defamation proceedings is possible, but the party seeking anonymisation must assert something more than mere financial harm or embarrassment and instead show an interest that is more pressing than free expression/a free press/the presumptive openness of the court process. This is done on a case-by-case basis and generally a claimant must show that:

• court openness poses a serious risk to an important public interest;
• the order sought is necessary to prevent this serious risk to the identified interest because reasonable alternative measures will not prevent this risk; and
• as a matter of proportionality, the benefits of the order outweigh its negative effects.

Recent Supreme Court of Canada rulings establish that for disclosure to be enjoined, the impugned information must go to the “biographical core” of the individual seeking the publication ban. This means that the information must be truly unique to the moving party. Common examples might be disclosure of a stigmatised fact about the individual such as occupation, medical diagnosis or prior emotional trauma.

Establishing Grounds to Bring Proceedings

The fact that a plaintiff or defendant is based in Canada or that publication took place in Canada may be enough to ground jurisdiction. The larger question in cases involving online defamation to the entire world is more often whether a Canadian province would be the “most appropriate” forum for the litigation.

In cases of online defamation where jurisdiction is disputed, courts will often consider issues such as:

• the comparative convenience of Canada assuming jurisdiction of the case versus another forum (considering things such as costs and the availability of witnesses);
• the locale of the parties’ assets; and
• where the locus of the plaintiff’s reputation is found.

See 1.5 Privacy Costs.

Canadian law traditionally tracks along the same general lines as that of the UK.

“Harassment” is a relatively recent standalone tort in Canada. Courts in the province of Alberta have recently determined that such a tort exists, whereas the issue has not yet been firmly decided in Ontario.

That being said, Ontario does have an established tort of “internet harassment”, but this tort was developed in light of a particularly egregious case of internet harassment that spanned several years and numerous unsavoury allegations such that the facts disclosed a significant campaign of harassment. The upshot is that while “internet harassment” is available to be pleaded, it will require very specific facts to be successful. In general, the plaintiff must show that:

• the defendant maliciously or recklessly engaged in communications conduct so outrageous in character and duration, and so extreme in degree, so as to go beyond all possible bounds of decency and tolerance;
• the defendant intended to cause fear, anxiety, and emotional upset or to impugn the dignity of the plaintiff; and
• the plaintiff suffered such harm.

Given the relatively new status of civil harassment remedies in Canada, seeking criminal sanction for such conduct is the more usual route.

Given the relatively new status of harassment as an independent tort in Canada, damages estimations are difficult to discern at this point. 

That being said, as described in 2. Defamation, courts in Canada will be open to pre- and post-trial injunctions to restrain harassing conduct where it is particularly egregious and where the defendant demonstrates that they will likely not be governable by damages awards.

Given the recent nature of this tort, a range of damages is difficult to theorise. However, it can be stated that the greater the emotional or medical harm suffered by the plaintiff as a result of a sustained campaign of harassment, the more likely a court will be to award damages in the five- or six-figure range. This is particularly true when considering heads of damage such as therapy costs, loss of competitive advantage, and other related factors.

Pursuant to Ontario’s Limitations Act, the general limitation period for a harassment claim would be two years from the date that the plaintiff knew or reasonably should have known about the claim.

A victim in a civil harassment case can seek anonymisation using the same tests described in 1.4 Privacy.

See3.2 Harassment Remedies.

Canada’s national broadcasters all have robust newsroom ethics policies that they traditionally adhere to. Successful claims against major broadcasters are relatively rare, given the number of cases that are commenced against them.

The five most influential providers are:

• The Globe and Mail;
• The Toronto Star;
• the Canadian Broadcasting Corporation;
• The National Post; and
• CTV.

Canada does not have any binding press regulatory bodies. The National News Media Council is a voluntary organisation – of which many of Canada’s major newspapers and broadcasters are members – but its powers are extremely limited and not analogous to the courts. Its main power comes from the ability to publish its decisions in response to complaints made by members of the public and to compel its members to do likewise. The organisation functions more like a non-binding ombudsman than a court.

Canada’s present government has previously discussed legislation to regulate hate speech online, but that discussion has been largely quiet for the past few years.

Given the niche role that the National News Media Council plays in legal debates about the media, its impact is limited largely to those individuals who make complaints.

The only sanction that the National News Media Counsel can impose is the publication of its decisions, as well as the requirement that – if a complaint is upheld – the offending media organisation must publish the decision.

There is no legislation in Canada that is analogous to the US Communications Decency Act. As a result, websites that host user-generated content are subject to the possibility of civil liability, and must avail themselves of common law defences if they are made defendants in a defamation or privacy actions.

Ontario and other Canadian jurisdictions have enacted anti-SLAPP (strategic lawsuits against public participation) legislation. This legislation has been in force for approximately ten years and there is a growing body of case law.

Ontario’s anti-SLAPP legislation allows a defendant to bring a motion to have a SLAPP case dismissed before a defence is even filed. The legislation provides that such a motion should be heard within 60 days of being brought; however, given the present backlog in the Ontario court system, this timetable is rarely adhered to.

Initially, Ontario’s anti-SLAPP legislation was intended to deal with SLAPP cases quickly and efficiently. However, in recent years, Ontario courts have expressed increasing frustration with the number of these motions being brought. In addition, while the original intention of the legislation was to decide these motions on a limited evidentiary record, both the judiciary and lawyers alike now charge that anti-SLAPP motions in Ontario often resemble “trials in a box” in that they involve a front-loading of evidence and extensive effort at the outset of a case. The result is that the short-term prognosis for anti-SLAPP cases in Ontario is that they will be heavily scrutinised by the judiciary.

There is no applicable information in this jurisdiction.

There are a number of pieces of data protection legislation in Ontario relating to the collection and storage of data by government, commercial, and medical care providers.

The legislation relating to medial entities contains a modest statutory penalty of CAD10,000, but data breaches are generally remedied by actions for breach of privacy in the civil courts. Damages for breach of privacy tend to be modest, except in the most personalised cases, which have tangible effects on specific individuals. As a result, it is most common for large-scale data breach cases to proceed by way of class action, as this is often the only way that such cases can be pursued economically.

Each of the various regulatory regimes involving data protection has their own sanctions that can include imprisonment or fines reaching into the hundreds of thousands of dollars for each offence. These complaints are often initially taken up by federal or provincial privacy commissioners.

However, given that these are regulatory sanctions, monetary penalties are not the property of data breach victims. Instead, victims will usually have to resort to the civil courts to obtain meaningful monetary redress.

Although damages and settlements can be substantial – sometimes amounting to hundreds of thousands or even millions of dollars – it is important to recognise that such large sums often arise in the context of class actions. As a result, individual claimants within a large class typically receive only nominal amounts.

Generally speaking, at common law in Ontario, a claim for breach of privacy would often (which is not to say always) be governed by Section 4 of the province’s Limitations Act (with some provinces and territories having similar limitations periods, and others much longer periods).

Common law aside, some statues specifically related to privacy in the corporate, healthcare and governmental data collection context have their own statutory schemes for particular kinds of damages that can be shorter, such as:

• one year under Sections 14 and 16 of Ontario’s corporate data collection act, known as the Personal Information Protection and Electronic Documents Act (PIPEDA);
• one year under Sections 14 and 16 of the companion federal PIPEDA; and
• one year under Section 56 Ontario’s Personal Health Information Protection Act. 

While recent Canadian case law has ruled that common law privacy claims are generally not ousted by those statutory privacy causes of action (in the absence of very clear legislative intent), litigants seeking to sue parties in the corporate, governmental and healthcare spheres should remain cognisant of these statutory causes of action and retain counsel promptly to determine if any of the statutory causes of action are available.

See “Establishing Grounds to Bring Proceedings” in 1.4 Privacy Proceedings Forum Choice. 

In the data protection sphere, it is also worth noting that the Supreme Court of Canada recently refused to give effect to a forum selection clause in a privacy breach case brought by social media users against Facebook. Facebook had sought to rely on such a clause in a standard form consumer agreement to try and oust the claim’s jurisdiction from the province of British Columbia and situate it in California.

The Supreme Court held, among other things, that – although the clause was enforceable – the inequality in bargaining power between Facebook and its users and the quasi-constitutional importance of privacy rights meant that the plaintiff had an interest in seeing her case decided in a local court. Canadian courts have recently been reticent to enforce forum selection clauses in standard form “clickwrap” agreements, but the courts’ particular highlighting of the very personal importance of privacy rights means that large corporate entities may find it particularly difficult to enforce forum selection clauses in privacy cases.

Damages for these sorts of cases tend to be quite modest (particularly in class action cases). Damages are only likely to reach five- or six-figure amounts where the information was highly personal and its disclosure had an extremely significant personal effect on the plaintiff.