The Office of the Privacy Commissioner has published a summary on its website of the finding I referred to in my previous post about video surveillance and personal injury litigation (see The Canadian Privacy Law Blog: Assistant Privacy Commissioner concludes that initiating a lawsuit is implied consent to video surveillance). You can view the summary here: Commissioner's Findings - PIPEDA Case Summary #311: A woman's activities recorded and videotaped by a private investigator hired by an insurance company (August 9, 2005).

We advised the insurance company in this case.

The summary also addresses the complaint brought by the plaintiff against the private investigator, but the Assistant Commissioner unfortunately does not deal with the status of the insurer or the private investigator as an agent for the defendant in the underlying personal injury lawsuit. Though we raised the argument in the submissions to the Commissioner, we'll unfortunately have to wait until another case arises to have greater certainty on that issue.

As an aside, the insurance company in this case has decided not to seek judicial review of the decision of the Assistant Commissioner to assume jurisdiction. It was argued that PIPEDA did not apply in the circumstances because there is no commercial relationship between the plaintiff and the defendant in the personal injury lawsuit, and the insurer and PI were merely agents of the defendant.

From the published summary:

Commissioner's Findings - PIPEDA Case Summary #311: A woman's activities recorded and videotaped by a private investigator hired by an insurance company (August 9, 2005):

"Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use and disclosure of personal information, except where inappropriate.

The Assistant Privacy Commissioner reviewed the circumstances surrounding the insurance company's decision to conduct surveillance, including video surveillance on the woman. She agreed that when an individual initiates a lawsuit there is an implied consent that the other party to the suit may collect information required to defend itself against the damages being sought by the individual who filed the suit. When the woman initiated her lawsuit against the insurance company's client and when her testimony and medical reports revealed discrepancies and were inconsistent with the injuries claimed, the Assistant Privacy Commissioner concluded that she gave her implied consent to the collection of her personal information.

That being said, the Assistant Privacy Commissioner emphasized that implied consent is not without limitations. Implied consent does not authorize unlimited or uncontrolled access to an individual's personal information, but only to the extent it is relevant to the merits of the case and the conduct of the defense. In this case, the Assistant Privacy Commissioner noted that the collection of the woman's personal information was limited to what was necessary for the insurance company to defend itself against her Court action."

Labels: information breaches, litigation, privacy, surveillance, video surveillance