A study aid, not legal advice. The case studies are written in our own words from published decisions and summaries; they are not the judgments. Paragraph references are deliberately left out. Confirm every decision, and whether it has been appealed or overtaken, on CanLII or the court or regulator website before you rely on it. Links to CanLII are built from the neutral citation.
Eastmond v. Canadian Pacific Railway
2004 FC 852 · Federal Court · 2004 · Reasonable purposes
Sections: PIPEDA s. 5
Facts. Canadian Pacific installed six digital video cameras in the mechanical facility area of its Scarborough rail yard. The cameras were not watched live. The footage was kept so that incidents such as vandalism and theft could be investigated afterwards, and prominent notices said that video surveillance was in use. An employee complained, and the Privacy Commissioner found against the railway.
Held. The Federal Court refused to confirm the Commissioner's finding. It held that, on these facts, the surveillance served a reasonable purpose and did not breach PIPEDA.
Why it matters. It shows how section 5(3) works in practice. The question is whether a reasonable person would consider the purpose appropriate, and the answer turns on the specific need the organization can point to, how intrusive the method is, and whether people are told about it.
Think about. What specific need did the railway point to, and why did that matter under section 5(3)? Would the result be the same if the cameras had been watched live to monitor employees' productivity? Why?
Check before you cite: Summarised from published commentary on the decision. Read the reasons for the Court's full test before citing it.
Find it on CanLII
Englander v. TELUS Communications Inc.
2004 FCA 387 · Federal Court of Appeal · 2004 · Consent
Sections: PIPEDA Sch. 1 cl. 4.3, PIPEDA Sch. 1 cl. 4.2
Facts. A TELUS subscriber complained that the company published subscribers' information in its telephone directories, and made it available online and in other databases, without proper consent. The Federal Court had held that the long-standing practice of directory listings meant TELUS had valid consent.
Held. The Federal Court of Appeal disagreed and held that TELUS had breached PIPEDA by failing to obtain consent before publishing subscriber information in its directories and making it available in other forms.
Why it matters. Consent under clause 4.3 cannot be taken from industry practice alone. People must be told what will be done with their information so that they can decide.
Think about. Why did a long-standing practice not settle the consent question? Which principle in Schedule 1 is central to this decision?
Check before you cite: Based on published summaries. The Court's separate treatment of the fee for an unlisted number is a different point.
Find it on CanLII
Nammo v. TransUnion of Canada Inc.
2010 FC 1284 · Federal Court · 2010 · Damages and accuracy
Sections: PIPEDA s. 16, PIPEDA Sch. 1 cl. 4.6
Facts. A credit reporting agency's file on Mr. Nammo contained another person's information. His bank declined a business loan, and the agency was slow to correct the error.
Held. The Federal Court found a breach of the accuracy principle and awarded ,000 in damages under section 16(c), even though no specific financial loss had been proved.
Why it matters. It is an early example of damages under section 16. The Court treated a serious and prolonged failure to correct an error as a case where damages were warranted, relying on the section's reference to humiliation.
Think about. Why were damages awarded even though no specific financial loss was proved? How does clause 4.6 (accuracy) connect to the harm Mr. Nammo suffered?
Check before you cite: Based on published summaries. Check the judgment for the Court's test for when damages are appropriate.
Find it on CanLII
Randall v. Nubodys Fitness Centres
2010 FC 681 · Federal Court · 2010 · Damages and the hearing
Sections: PIPEDA s. 14, PIPEDA s. 16
Facts. A man joined a fitness club in Atlantic Canada under an employer-paid corporate membership. He said the club passed information about how often he used it to his employer, and that nothing he signed clearly allowed it. The Privacy Commissioner found his complaint well-founded, and he applied to the Federal Court under section 14.
Held. The Federal Court declined to award damages. It said that damages under PIPEDA should be reserved for the most egregious breaches.
Why it matters. A finding that PIPEDA was breached does not automatically lead to damages. Read with Nammo and Chitrakar, it helps to show where the courts have drawn the line under section 16.
Think about. What is the difference between the Commissioner finding a complaint well-founded and the Court awarding damages? Why might sharing gym attendance with an employer be a privacy concern even if the money loss is small?
Check before you cite: Based on excerpts and commentary. Read the judgment for the facts and the reasoning on damages.
Find it on CanLII
Chitrakar v. Bell TV
2013 FC 1103 · Federal Court · 2013 · Consent and damages
Sections: PIPEDA Sch. 1 cl. 4.3, PIPEDA s. 16
Facts. Bell TV ran a "hard" credit check on a customer a month before he signed anything. Bell argued that a signature on a later rental agreement covered consent.
Held. The Federal Court held that Bell had breached the consent principle in clause 4.3 and awarded damages under section 16, treating the credit check as harmful because a hard check can lower a credit score.
Why it matters. Consent must be obtained before the information is collected, not found afterwards in a form the customer signs later. The case is often cited on the size of PIPEDA damages.
Think about. Why did the later signature not cure the missing consent? What does this case suggest about when a credit check may be made?
Check before you cite: Published reports differ on the amounts awarded (general and exemplary damages), so check the judgment before quoting a figure.
Find it on CanLII
Canada (Privacy Commissioner) v. Blood Tribe Department of Health
2008 SCC 44 · Supreme Court of Canada · 2008 · Commissioner's powers
Sections: PIPEDA s. 12.1
Facts. A former employee of a tribal health department complained to the Privacy Commissioner when she could not get her personal information. The department withheld documents on the ground of solicitor-client privilege, and the Commissioner ordered them produced for review.
Held. The Supreme Court of Canada unanimously held that PIPEDA does not give the Commissioner the power to review or compel documents over which solicitor-client privilege is claimed. Whether privilege applies is for the courts to decide.
Why it matters. Section 12.1 gives the Commissioner wide investigative powers, but the Court read them as not overriding solicitor-client privilege without clear words.
Think about. Which section gives the Commissioner power to compel evidence, and what limit did the Court find? Who decides whether a document really is privileged?
Find it on CanLII
Canada (Privacy Commissioner) v. Facebook, Inc.
2024 FCA 140 · Federal Court of Appeal · 2024 · Meaningful consent and safeguards
Sections: PIPEDA Sch. 1 cl. 4.3, PIPEDA Sch. 1 cl. 4.7, PIPEDA s. 6.1
Facts. The Privacy Commissioner applied to the Federal Court alleging that Facebook let third-party apps reach information about users and their friends without meaningful consent and without adequate oversight of those apps. The Federal Court dismissed the application.
Held. On September 9, 2024 the Federal Court of Appeal allowed the Commissioner's appeal. It held that Facebook had not obtained meaningful consent from friends of users and had failed in its duty to safeguard the information, judging both from the standpoint of a reasonable person.
Why it matters. It applies section 6.1 and clause 4.7 to a large platform. Long privacy policies and contract terms with third parties were not enough to show meaningful consent or adequate safeguards.
Think about. What is the standard used to judge whether consent was meaningful? Why were contract terms with app developers not enough to meet the safeguards principle?
Check before you cite: Leave to appeal to the Supreme Court of Canada has been reported as granted. Check the current status before relying on the decision as final.
Find it on CanLII
Equifax Inc. and Equifax Canada Co. (PIPEDA Findings #2019-001)
PIPEDA Findings #2019-001 · Office of the Privacy Commissioner of Canada · 2019 · Safeguards and accountability
Sections: PIPEDA Sch. 1 cl. 4.7, PIPEDA Sch. 1 cl. 4.1
Facts. After a cyberattack on Equifax Inc., the Privacy Commissioner investigated whether Equifax Inc. and Equifax Canada had adequate safeguards, and whether Equifax Canada was accountable for Canadian data that Equifax Inc. processed.
Held. The Commissioner found that neither company had adequate safeguards and that Equifax Canada had breached the accountability principle. She also found that relying on third-party audits was not appropriate. Equifax Canada entered a compliance agreement without admitting fault.
Why it matters. It shows that accountability (clause 4.1) follows the data when it is sent to an affiliate or processor, and that safeguards (clause 4.7) must match the sensitivity of the information.
Think about. Why was Equifax Canada held accountable for data processed by Equifax Inc.? What is a compliance agreement, and where does PIPEDA provide for one?
Check before you cite: The Commissioner's findings are not a court judgment. The paragraph-level details were taken from summaries.
Read it at the regulator
R. v. Spencer
2014 SCC 43 · Supreme Court of Canada · 2014 · Disclosure to police
Sections: PIPEDA s. 7
Facts. Police traced an IP address to a Saskatoon man and asked his internet provider, without a warrant, for the subscriber information behind it.
Held. The Supreme Court of Canada held that the man had a reasonable expectation of privacy in the subscriber information. PIPEDA's provision allowing disclosure to a government institution on request did not by itself give police lawful authority to obtain it without a warrant.
Why it matters. Section 7(3) lets an organization disclose personal information without consent in listed cases, but the Court held that it could not turn a warrantless police request into lawful authority.
Think about. Why did the Court say the information was private even though the provider held it? What does this tell you about relying on section 7(3) when police ask for customer information?
Check before you cite: Summarised from commentary. Read the reasons for how the Court treated the PIPEDA provision.
Find it on CanLII
Schindler Elevator Corporation (Order P12-01)
Order P12-01, 2012 BCIPC 25 · Office of the Information and Privacy Commissioner for British Columbia · 2012 · Employee monitoring
Sections: PIPA s. 13, PIPA s. 4
Facts. From 2010 Schindler used GPS and engine-monitoring technology in its elevator service vehicles. Employees challenged the collection under PIPA, and Schindler argued the data was not personal information or, if it was, was employee personal information it could lawfully collect.
Held. The Commissioner found that Schindler was authorized to collect and use the data for purposes such as employee safety, managing employees and client billing. She set out factors for deciding whether a reasonable person would consider the collection appropriate, and stressed that employees must be notified in advance.
Why it matters. It shows how the reasonable-person standard in section 4(1) and the employee rule in section 13 work together: a legitimate purpose is not enough without notice and proportionality.
Think about. Which section lets an employer collect employee personal information without consent, and what conditions apply? What did the Commissioner say an employer must do before starting the monitoring?
Check before you cite: Not a court judgment. Summarised from commentary; search the OIPC site by order number.
Read it at the regulator
Order P24-03 (law firm and solicitor-client privilege)
Order P24-03 · Office of the Information and Privacy Commissioner for British Columbia · 2024 · Refusing access: privilege
Sections: PIPA s. 23, PIPA s. 51
Facts. An individual asked a law firm for personal information. The firm withheld records on the ground of solicitor-client privilege.
Held. The adjudicator found that the firm was authorized to withhold the records because solicitor-client privilege applied. Privilege includes both legal advice privilege and litigation privilege.
Why it matters. Section 23(3)(a) lets an organization withhold privileged information, but at an inquiry the organization carries the burden of proving the exception applies (section 51).
Think about. Who must prove that an exception to access applies? Which two kinds of privilege are covered by solicitor-client privilege in the order?
Check before you cite: Not a court judgment. Based on search summaries: confirm the number and the facts on the OIPC site.
Read it at the regulator
College of Physicians and Surgeons of British Columbia v. British Columbia (Information and Privacy Commissioner)
2002 BCCA 665 · Court of Appeal for British Columbia · 2002 · Policy advice
Sections: FIPPA s. 13
Facts. A professional regulator refused to give an applicant expert opinions it had obtained when deciding how to respond to a matter. The Commissioner reviewed the refusal.
Held. The Court of Appeal held that the expert opinions could be withheld under section 13 as advice developed for a public body. "Advice" can include expert opinion on matters of fact on which the public body must make a decision.
Why it matters. It is the leading BC authority on the meaning of "advice" in section 13(1). Later orders read it as protecting advice that a public body needs to make a decision, not only recommendations to act.
Think about. Why does section 13(2) still require release of factual material? How is expert opinion on a factual question different from the underlying facts?
Check before you cite: Summarised from OIPC orders that apply it. Read the reasons for the exact test.
Find it on CanLII
John Doe v. Ontario (Finance)
2014 SCC 36 · Supreme Court of Canada · 2014 · Policy advice (Ontario)
Sections: FIPPA s. 13
Facts. A tax lawyer asked Ontario for policy options the government had prepared before introducing partly retroactive tax legislation. The ministry refused under Ontario's advice or recommendations exemption.
Held. The Supreme Court of Canada upheld the refusal. It read "advice" more broadly than "recommendations", so that it includes information on how a decision-maker should view a matter and the range of options, not only a recommended course.
Why it matters. It is an Ontario case about an Ontario statute, but regulators across Canada rely on it when reading similar exemptions, including section 13 of the BC Act.
Think about. Why did the Court say "advice" has to mean more than "recommendations"? Which part of section 13 limits what a public body can hold back?
Check before you cite: A decision on Ontario's legislation: persuasive, not binding, in British Columbia.
Find it on CanLII
Aquasource Ltd. v. British Columbia (Information and Privacy Commissioner)
1998 CanLII 6444 (BC CA) · Court of Appeal for British Columbia · 1998 · Cabinet confidences
Sections: FIPPA s. 12
Facts. An applicant sought records connected with a Cabinet decision. The government refused under the section protecting Cabinet confidences.
Held. The Court of Appeal held that the "substance of deliberations" of Cabinet refers to the body of information that Cabinet considered, or would consider, in making a decision, and that the section must be read widely to protect the Cabinet process.
Why it matters. It explains why section 12(1) is a mandatory exception that reaches beyond the final decision to the material that fed the deliberation.
Think about. Why is section 12(1) a "must refuse" exception? Does the section protect only the final decision, or the information Cabinet considered?
Check before you cite: Summarised from OIPC orders that quote it. Read the reasons for the exact words.
Find it on CanLII
Merck Frosst Canada Ltd. v. Canada (Health)
2012 SCC 3 · Supreme Court of Canada · 2012 · Third-party business information (federal Act)
Sections: FIPPA s. 21
Facts. A pharmaceutical company objected to the release of information it had given to Health Canada, saying disclosure would harm its competitive position. The case concerned the federal Access to Information Act.
Held. The Supreme Court of Canada applied a "reasonable expectation of probable harm" test: a risk of harm well beyond the merely possible or speculative, but not proved on a balance of probabilities.
Why it matters. Section 21(1)(c) of the BC Act also turns on what could reasonably be expected to cause harm, and BC decision-makers draw on this approach.
Think about. How is "reasonable expectation of probable harm" different from "possible" harm? Which three conditions must be met before section 21(1) applies?
Check before you cite: A decision on a federal statute: persuasive, not binding, in British Columbia.
Find it on CanLII
Review of the Mount Polley Mine Tailings Pond Failure and Public Interest Disclosure by Public Bodies (Investigation Report F15-02)
Investigation Report F15-02 · Office of the Information and Privacy Commissioner for British Columbia · 2015 · Disclosure in the public interest
Sections: FIPPA s. 25
Facts. After the 2014 failure of the tailings pond at the Mount Polley mine, the Commissioner investigated whether government had information about the dam that it should have disclosed without a request under section 25.
Held. The Commissioner found that government had not had information about the dam that was clearly in the public interest before the failure, but that there was a public interest in information about the breach afterwards. She also reinterpreted section 25(1)(b): urgent circumstances are no longer required.
Why it matters. It explains how section 25 operates beyond the access process: public bodies must look for information that has to be disclosed in the public interest, and not wait for a request.
Think about. What does it mean that section 25 applies "whether or not a request for access is made"? How did the 2015 report change the reading of section 25(1)(b)?
Check before you cite: Not a court judgment. Check whether later decisions have revisited the reasoning.
Read it at the regulator
Investigation Report F13-02 (Ministry of Health privacy breaches)
Investigation Report F13-02 · Office of the Information and Privacy Commissioner for British Columbia · 2013 · Reasonable security
Sections: FIPPA s. 30
Facts. In three incidents, Ministry of Health employees downloaded large amounts of personal health data onto unencrypted flash drives and shared it with third parties.
Held. The Commissioner found that the Ministry did not have reasonable security arrangements as section 30 requires, because of weak privacy governance and controls. Its response after the breaches were discovered did meet section 30. The report made 11 recommendations.
Why it matters. It shows what "reasonable security arrangements" means for a public body: governance, controls on portable devices and encryption, and a good response once a breach is found.
Think about. Which controls would have met the section 30 standard in these incidents? Why did the Commissioner treat the Ministry's response after discovery differently?
Check before you cite: Not a court judgment. Search the OIPC site for the report by number.
Read it at the regulator
Insurance Corporation of British Columbia v. Ari
2023 BCCA 331 · Court of Appeal for British Columbia · 2023 · Employer liability
Sections: Privacy Act s. 1
Facts. A claims adjuster at the Insurance Corporation of British Columbia accessed the personal information of 78 customers in 2011 with no apparent business reason. Customers brought a class action under the Privacy Act.
Held. The Court of Appeal upheld the trial judge's finding that the insurer was vicariously liable for the employee's wilful violation of customers' privacy under section 1. It also confirmed that the Act does not require proof of actual damage.
Why it matters. A policy against misuse did not protect the employer. The connection between the employee's job and the wrongdoing was enough for vicarious liability.
Think about. Which elements of section 1(1) did the employee's conduct meet? Why did the insurer's rules against misuse not prevent a finding of vicarious liability?
Check before you cite: Trial decision: 2022 BCSC 1475. Damages were assessed in later decisions. The way the information was passed on is described differently in different sources, so check the judgment.
Find it on CanLII
Tucci v. Peoples Trust Company
2020 BCCA 246 · Court of Appeal for British Columbia · 2020 · A common law tort?
Sections: Privacy Act s. 1
Facts. A data breach class action against a trust company included a claim for breach of privacy. The plaintiffs did not plead the Privacy Act.
Held. The Court of Appeal confirmed that there is no separate "federal common law" privacy tort, and did not accept that PIPEDA displaces the common law. It also noted, without deciding, that whether BC has a common law privacy tort is an open question.
Why it matters. In BC the Privacy Act is the settled source of the privacy tort. The case shows why claimants plead it, and why the common law question remains open.
Think about. Why does it matter that the plaintiffs did not plead the Privacy Act? What did the Court say about the relationship between PIPEDA and the common law?
Check before you cite: The Court's statement about the provincial common law tort was not a decision. Do not cite the case for the proposition that none exists.
Find it on CanLII
RateMDs Inc. v. Bleuler
2025 BCCA 329 · Court of Appeal for British Columbia · 2025 · Name or portrait
Sections: Privacy Act s. 3
Facts. A proposed class action alleged that a website used health professionals' names in breach of the Privacy Act. The Court of Appeal considered whether that use fell within section 3(2).
Held. The Court of Appeal dismissed the proposed class action. It said that section 3(2) is not designed to capture every use of a plaintiff's name or portrait by a defendant who expects to profit from that use, and held that the use of the professionals' names was not commercial exploitation of the kind the section covers.
Why it matters. It narrows the name-or-portrait tort: the question is whether the name or portrait is used to advertise or promote the sale of property or services, not whether a business profits from it in some way.
Think about. What does section 3(2) require beyond a business making money from a name? How would a restaurant that puts a customer's photograph in an advertisement differ from this case?
Check before you cite: Very recent. Summarised from commentary: read the decision before citing it.
Find it on CanLII
Data Protection Commissioner v Facebook Ireland and Schrems (Schrems II)
Case C-311/18 (16 July 2020) · Court of Justice of the European Union · 2020 · Transfers to third countries
Sections: GDPR s. 44, GDPR s. 45, GDPR s. 46
Facts. Max Schrems complained to the Irish Data Protection Commissioner about the transfer of his Facebook data from Facebook Ireland to servers in the United States. Transfers were being made under the EU-US Privacy Shield adequacy decision and under standard contractual clauses.
Held. The Court declared the Commission's Privacy Shield decision invalid because of limits on US surveillance law and the lack of enforceable remedies for EU residents. It held that the standard contractual clauses remain valid in principle, but that the exporter must check in practice whether the destination country ensures an essentially equivalent level of protection, and must suspend the transfer if the recipient cannot comply with the clauses.
Why it matters. It shows that an adequacy decision or a transfer tool is not a one-off tick: protection travels with the data, and the exporter has to check it in practice.
Think about. Why did the Court invalidate the Privacy Shield but keep the standard contractual clauses? What must an exporter do if the recipient cannot comply with the clauses?
Check before you cite: The EU-US Data Privacy Framework adopted in 2023 later replaced the Privacy Shield. Read the judgment before citing it.
Find it on CanLII
Google Spain SL and Google Inc. v Agencia Española de Protección de Datos and Mario Costeja González
Case C-131/12 (13 May 2014) · Court of Justice of the European Union · 2014 · Search results and delisting
Sections: GDPR s. 17, GDPR s. 4
Facts. Mario Costeja González objected that a search for his name returned links to an old newspaper notice about the attachment of his property. He asked that the newspaper and Google remove or hide the links. The Spanish data protection authority and then the Court of Justice were asked what the data protection rules required of the search engine.
Held. The Court held that a search engine operator processes personal data and is a controller for that processing. In certain conditions a person can ask the operator to remove links to pages containing information about them from a name search, even if the pages themselves lawfully stay online.
Why it matters. It is the origin of the right to be forgotten that Article 17 of the GDPR later put into the text, and it shows that balancing against the public interest is part of the right.
Think about. Why did the Court treat the search engine operator as a controller? What is the difference between removing a link from a name search and removing the page itself?
Check before you cite: Decided under the earlier Directive 95/46/EC, which the GDPR replaced. Read the judgment before citing it.
Find it on CanLII
Patrick Breyer v Bundesrepublik Deutschland
Case C-582/14 (19 October 2016) · Court of Justice of the European Union · 2016 · What is personal data
Sections: GDPR s. 4
Facts. Patrick Breyer visited German federal websites that logged the dynamic IP addresses of visitors. The question was whether a dynamic IP address is personal data for the website operator, which could not itself identify the visitor from the address alone.
Held. The Court held that a dynamic IP address can be personal data for a website operator where the operator has legal means that allow it to identify the visitor with the help of additional information held by the visitor's internet access provider.
Why it matters. It shows that identifiability depends on the means reasonably available to link information to a person, and not only on what the holder already knows.
Think about. Why was the internet access provider's information relevant for the website operator? How does this fit with the definition of personal data in Article 4(1)?
Check before you cite: Decided under the earlier Directive 95/46/EC; the GDPR definition in Article 4(1) is to the same effect. Read the judgment before citing it.
Find it on CanLII
Bundesverband der Verbraucherzentralen v Planet49 GmbH
Case C-673/17 (1 October 2019) · Court of Justice of the European Union · 2019 · Valid consent
Sections: GDPR s. 4, GDPR s. 6, GDPR s. 7
Facts. Planet49 ran an online lottery. To take part, users had to fill in details, and a second checkbox, consenting to the storage of cookies for advertising, was already ticked. Users had to untick it to refuse.
Held. The Court held that consent to the storage of cookies is not validly given by a pre-ticked checkbox that the user has to untick to refuse. Valid consent needs active behaviour on the part of the user.
Why it matters. It applies the GDPR's definition of consent in practice: silence, pre-ticked boxes and inactivity are not consent.
Think about. Why can a pre-ticked box not show a clear affirmative action? What would a compliant design look like?
Check before you cite: The case also concerned the e-Privacy Directive. Read the judgment before citing it.
Find it on CanLII
UI v Österreichische Post AG
Case C-300/21 (4 May 2023) · Court of Justice of the European Union · 2023 · Compensation
Sections: GDPR s. 82
Facts. A person was upset by a political affinity that the postal operator had attributed to him from data analysis and claimed 1,000 euros in non-material damages under Article 82.
Held. The Court held that a mere infringement of the Regulation is not enough for compensation: there must be damage and a causal link. It also held that compensation for non-material damage is not limited to damage reaching a certain degree of seriousness.
Why it matters. It sets the three conditions for a claim under Article 82 (an infringement, damage and a causal link) and rejects a minimum threshold of seriousness.
Think about. Why is an infringement alone not enough for compensation? Why did the Court reject a seriousness threshold?
Check before you cite: National courts set the amount. Read the judgment before citing it.
Find it on CanLII
OQ v Land Hessen (SCHUFA Holding)
Case C-634/21 (7 December 2023) · Court of Justice of the European Union · 2023 · Automated decisions
Sections: GDPR s. 22
Facts. A credit reference agency calculated a score for a person who was then refused a loan by a bank that relied heavily on the score. The person challenged how the score was produced.
Held. The Court held that generating the credit score can itself be an automated individual decision under Article 22(1) where the third party to which it is sent draws strongly on it to establish, implement or end a contractual relationship.
Why it matters. It stops Article 22 being avoided by splitting a decision between the party that scores and the party that decides.
Think about. Why did the Court treat the scoring as a decision? What difference would it make if the bank only glanced at the score?
Check before you cite: Read the judgment for the exact conditions before citing it.
Find it on CanLII