Insights Header image
Insights Header image
Insights Header image

Flag on the Play? Recent Disclosure of NFL Player’s Medical Information Sparks Allegations of Privacy Violations

July 2015 Privacy Bulletin 5 minute read

The recent unauthorized disclosure of a National Football League (“NFL”) player’s medical records has garnered significant media attention. On July 8, 2015, ESPN reporter Adam Schefter posted images of NFL player Jason Pierre-Paul’s medical charts on Twitter.[1] The records detailed the medical procedures performed on Mr. Pierre-Paul’s finger, which was injured in a fireworks incident on July 4th. In response to the news of his injury, the New York Giants pulled Mr. Pierre-Paul’s long-term $60 million contract.[2]

The “twitterverse” quickly denounced Mr. Schefter’s revelation as an improper violation of Mr. Pierre-Paul’s privacy. While some people may disagree with Mr. Schefter’s decision to post full medical records, the question of whether there has been a violation of legal privacy rights remains. If this situation had occurred in Canada, there would be a number of potentially relevant laws to consider.

Provincial Health Sector Legislation

Most Canadian provinces have implemented legislation governing collection, use and disclosure of personal health information.[3] For example, in Ontario, the relevant legislation is the Personal Health Information Protection Act (“PHIPA”).[4] PHIPA applies to health information custodians within Ontario, and includes some provisions that apply to individuals and organizations that receive personal health information from such custodians.

Under PHIPA, a health information custodian who willfully discloses personal health information without consent can be found guilty of an offence and fined up to $50,000, if the person is a natural person, and otherwise up to $250,000.[5] Furthermore, if a corporation commits such an offence, “…every officer, member, employee or other agent of the corporation who authorized the offence, or who had the authority to prevent the offence from being committed but knowingly refrained from doing so, is a party to and guilty of the offence and is liable, on conviction, to the penalty for the offence, whether or not the corporation has been prosecuted or convicted.”[6]

In addition, if this incident had occurred in Ontario, Mr. Pierre-Paul could have a potential claim under PHIPA against the individual who disclosed his medical records to ESPN, if such individual was a health information custodian. Under PHIPA, a person affected by conduct giving rise to a conviction for an offence can sue for damages for actual harm caused by the contravention or offence.[7] In addition, under PHIPA, willful or reckless conduct may give rise to an award of up to $10,000 for mental anguish.[8] Furthermore, in Hopkins v Kay,[9] the Ontario Court of Appeal held that PHIPA does not preclude separate tort claims. Therefore, a person who discloses medical records without authorization in Ontario could also face civil exposure for damages.

Tort of “Intrusion Upon Seclusion”

In Canada, the common law protects individuals against certain unauthorized intrusions upon privacy. In the leading case of Jones v Tsige,[10] the Ontario Court of Appeal formulated a new tort of “intrusion upon seclusion”, as follows:

One who intentionally [or recklessly] intrudes, physically or otherwise, upon the seclusion of another or his [or her] private affairs or concerns, is subject to liability to the other for invasion of his [or her] privacy, if the invasion would be highly offensive to a reasonable person.[11]

This tort is actionable without proof of economic harm, although the Court did establish some limits upon non-pecuniary damages.[12] Jones v Tsige has been followed by courts in a number of Canadian jurisdictions outside of Ontario, including British Columbia,[13] Nova Scotia,[14] Newfoundland,[15] and Manitoba.[16]

Medical records contain sensitive personal information, and it is conceivable that unauthorized disclosure of such records could meet the threshold of being “highly offensive to a reasonable person.” Therefore, in Canada, Mr. Pierre-Paul would potentially have a claim for intrusion upon seclusion against a person who released his medical records.

Statutory Torts

Some provinces in Canada have enacted legislation creating a statutory privacy tort, which provides a right of action against a person who willfully and without a claim of right violates the privacy of another person.[17] As with the common law tort described above, proof of damages is not required for such statutory torts. However, the statutory torts appear to establish a lower threshold for claims, as the violation of privacy does not need to meet the standard of being “highly offensive” to a reasonable person.

If an unauthorized disclosure of medical records were to occur in a province where a statutory privacy tort has been enacted, a person in Mr. Pierre-Paul’s situation could have a potential recourse under such legislation.

Private Sector Privacy Legislation

In Canada, the federal Personal Information Protection and Electronic Documents Act (“PIPEDA“) and substantially similar provincial legislation governs the collection, use and disclosure of personal information in the private sector.[18] The term “personal information” has been interpreted broadly,[19] and it would certainly include an individual’s medical records. However, this legislation generally only applies to the activities of “organizations” (or, in Quebec, “enterprises”). Therefore, this legislation would not generally apply to an individual’s actions unless such person was acting in the course of his/her employment, in which case the employing organization could potentially be held responsible for any privacy breach (such as the unauthorized disclosure of personal information).

Furthermore, under PIPEDA and substantially similar legislation, there are exceptions to consent requirements for collection, use and disclosure of personal information solely for journalistic purposes,[20] which may be relevant in situations like the one facing Mr. Pierre-Paul.


The disclosure of Mr. Pierre-Paul’s medical records provides a good illustration of the complex nature of privacy rights and restrictions. If this situation had occurred in Canada, there are a number of laws that could potentially apply, and such laws vary by province.

Given the complicated network of privacy and data protection laws in Canada, organizations would be well advised to consult with a legal advisor when collecting, using or disclosing personal information, especially sensitive information such as medical records.

by Lyndsay A. Wasser (CIPP/C), Co-Chair Privacy and Jon Wypych, Student-at-Law

[1] Brian Stelter, “ESPN reporter tweets player’s medical charts, and ethical questions erupt“, CNN, July 7, 2015.

[2] Dan Diamond, “Jason Pierre-Paul Lost His Finger. Did ESPN Violate HIPAA By Reporting It?“, Forbes, July 8, 2015.

[3] The only provinces that do not are Quebec and Prince Edward Island.

[4] Personal Health Information Protection Act, 2004, SO 2004, c 3, Sched A.

[5] Ibid at s 72.

[6] Ibid at s 72(3).

[7] Ibid at s 65(1).

[8] Ibid at s 65(3).

[9] 2015 ONCA 112.

[10] 2010 ONCA 32.

[11] Ibid at para 70.

[12] Ibid at para 71.

[13] Albayate v Bank of Montreal, 2015 BCSC 695.

[14] Murray v Capital District Health Authority, 2015 NSSC 61.

[15] Hynes v Western Regional Integrated Health Authority, 2014 NLTD(G) 137.

[16] Grant v Winnipeg Regional Health Authority, 2015 MBCA 44.

[17] Provinces with privacy acts include British Columbia, Manitoba, Newfoundland and Labrador, and Saskatchewan.

[18] Personal Information Protection and Electronic Documents Act, SC 2000 c 5.

[19] Canada (Information Commissioner) v Canada (Commissioner of the Royal Canadian Mounted Police), [2003] 1 SCR 66, 2003 SCC 8 at para 23.

[20] Supra note 15, s 4.

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2015

Insights (5 Posts)View More

Featured Insight

Automotive Webinar Series | Part III: Where Rubber Meets the Road: Automotive Litigation Update

At this session, our panel of experts will provide a panoramic view of the evolution of automotive class actions across Canada, a review of best practices for managing disputes with distributors and franchisees, and
insights into litigation and disclosure obligations arising from automotive industry labour issues.

Wednesday, November 29, 2023
Featured Insight

Automotive Webinar Series | Part II: Looking towards the Future: Automotive Legislation Updates

Our panel of professionals will highlight important changes impacting the automotive industry in Canada’s ever-evolving regulatory landscape including updates to cross-border sales legislation, advertising obligations arising from drip pricing provisions under the Competition Act and understanding Transport Canada's lates enforcement tool: administrative monetary penalties.

Tuesday, November 7, 2023
Featured Insight

Nothing Casual about it: Hotel Faces Employees’ Class Action over Employment Benefit Changes

Hotel faces employees' class action over employment benefit changes.

Read More
Sep 29, 2023
Featured Insight

“Mend your speech a little, lest it may mar your fortunes”: Are Employee Defamation Cases A Fool’s Errand?

This bulletin discusses the recent decision in Williams v. Vac Developments Limited regarding gag defamation proceedings commenced by employers.

Read More
Sep 27, 2023
Featured Insight

Overholding in Commercial Leasing

The concept of overholding is often misunderstood and deserves more attention in commercial leases, given the significant consequences for landlords and tenants.

Read More
Sep 27, 2023