Digital Brain
digital brain
digital brain

Flag on the Play? Recent Disclosure of NFL Player’s Medical Information Sparks Allegations of Privacy Violations

July 2015 Privacy Bulletin 5 minute read

The recent unauthorized disclosure of a National Football League (“NFL”) player’s medical records has garnered significant media attention. On July 8, 2015, ESPN reporter Adam Schefter posted images of NFL player Jason Pierre-Paul’s medical charts on Twitter.[1] The records detailed the medical procedures performed on Mr. Pierre-Paul’s finger, which was injured in a fireworks incident on July 4th. In response to the news of his injury, the New York Giants pulled Mr. Pierre-Paul’s long-term $60 million contract.[2]

The “twitterverse” quickly denounced Mr. Schefter’s revelation as an improper violation of Mr. Pierre-Paul’s privacy. While some people may disagree with Mr. Schefter’s decision to post full medical records, the question of whether there has been a violation of legal privacy rights remains. If this situation had occurred in Canada, there would be a number of potentially relevant laws to consider.

Provincial Health Sector Legislation

Most Canadian provinces have implemented legislation governing collection, use and disclosure of personal health information.[3] For example, in Ontario, the relevant legislation is the Personal Health Information Protection Act (“PHIPA”).[4] PHIPA applies to health information custodians within Ontario, and includes some provisions that apply to individuals and organizations that receive personal health information from such custodians.

Under PHIPA, a health information custodian who willfully discloses personal health information without consent can be found guilty of an offence and fined up to $50,000, if the person is a natural person, and otherwise up to $250,000.[5] Furthermore, if a corporation commits such an offence, “…every officer, member, employee or other agent of the corporation who authorized the offence, or who had the authority to prevent the offence from being committed but knowingly refrained from doing so, is a party to and guilty of the offence and is liable, on conviction, to the penalty for the offence, whether or not the corporation has been prosecuted or convicted.”[6]

In addition, if this incident had occurred in Ontario, Mr. Pierre-Paul could have a potential claim under PHIPA against the individual who disclosed his medical records to ESPN, if such individual was a health information custodian. Under PHIPA, a person affected by conduct giving rise to a conviction for an offence can sue for damages for actual harm caused by the contravention or offence.[7] In addition, under PHIPA, willful or reckless conduct may give rise to an award of up to $10,000 for mental anguish.[8] Furthermore, in Hopkins v Kay,[9] the Ontario Court of Appeal held that PHIPA does not preclude separate tort claims. Therefore, a person who discloses medical records without authorization in Ontario could also face civil exposure for damages.

Tort of “Intrusion Upon Seclusion”

In Canada, the common law protects individuals against certain unauthorized intrusions upon privacy. In the leading case of Jones v Tsige,[10] the Ontario Court of Appeal formulated a new tort of “intrusion upon seclusion”, as follows:

One who intentionally [or recklessly] intrudes, physically or otherwise, upon the seclusion of another or his [or her] private affairs or concerns, is subject to liability to the other for invasion of his [or her] privacy, if the invasion would be highly offensive to a reasonable person.[11]

This tort is actionable without proof of economic harm, although the Court did establish some limits upon non-pecuniary damages.[12] Jones v Tsige has been followed by courts in a number of Canadian jurisdictions outside of Ontario, including British Columbia,[13] Nova Scotia,[14] Newfoundland,[15] and Manitoba.[16]

Medical records contain sensitive personal information, and it is conceivable that unauthorized disclosure of such records could meet the threshold of being “highly offensive to a reasonable person.” Therefore, in Canada, Mr. Pierre-Paul would potentially have a claim for intrusion upon seclusion against a person who released his medical records.

Statutory Torts

Some provinces in Canada have enacted legislation creating a statutory privacy tort, which provides a right of action against a person who willfully and without a claim of right violates the privacy of another person.[17] As with the common law tort described above, proof of damages is not required for such statutory torts. However, the statutory torts appear to establish a lower threshold for claims, as the violation of privacy does not need to meet the standard of being “highly offensive” to a reasonable person.

If an unauthorized disclosure of medical records were to occur in a province where a statutory privacy tort has been enacted, a person in Mr. Pierre-Paul’s situation could have a potential recourse under such legislation.

Private Sector Privacy Legislation

In Canada, the federal Personal Information Protection and Electronic Documents Act (“PIPEDA“) and substantially similar provincial legislation governs the collection, use and disclosure of personal information in the private sector.[18] The term “personal information” has been interpreted broadly,[19] and it would certainly include an individual’s medical records. However, this legislation generally only applies to the activities of “organizations” (or, in Quebec, “enterprises”). Therefore, this legislation would not generally apply to an individual’s actions unless such person was acting in the course of his/her employment, in which case the employing organization could potentially be held responsible for any privacy breach (such as the unauthorized disclosure of personal information).

Furthermore, under PIPEDA and substantially similar legislation, there are exceptions to consent requirements for collection, use and disclosure of personal information solely for journalistic purposes,[20] which may be relevant in situations like the one facing Mr. Pierre-Paul.

Take-Away

The disclosure of Mr. Pierre-Paul’s medical records provides a good illustration of the complex nature of privacy rights and restrictions. If this situation had occurred in Canada, there are a number of laws that could potentially apply, and such laws vary by province.

Given the complicated network of privacy and data protection laws in Canada, organizations would be well advised to consult with a legal advisor when collecting, using or disclosing personal information, especially sensitive information such as medical records.

by Lyndsay A. Wasser (CIPP/C), Co-Chair Privacy and Jon Wypych, Student-at-Law

[1] Brian Stelter, “ESPN reporter tweets player’s medical charts, and ethical questions erupt“, CNN, July 7, 2015.

[2] Dan Diamond, “Jason Pierre-Paul Lost His Finger. Did ESPN Violate HIPAA By Reporting It?“, Forbes, July 8, 2015.

[3] The only provinces that do not are Quebec and Prince Edward Island.

[4] Personal Health Information Protection Act, 2004, SO 2004, c 3, Sched A.

[5] Ibid at s 72.

[6] Ibid at s 72(3).

[7] Ibid at s 65(1).

[8] Ibid at s 65(3).

[9] 2015 ONCA 112.

[10] 2010 ONCA 32.

[11] Ibid at para 70.

[12] Ibid at para 71.

[13] Albayate v Bank of Montreal, 2015 BCSC 695.

[14] Murray v Capital District Health Authority, 2015 NSSC 61.

[15] Hynes v Western Regional Integrated Health Authority, 2014 NLTD(G) 137.

[16] Grant v Winnipeg Regional Health Authority, 2015 MBCA 44.

[17] Provinces with privacy acts include British Columbia, Manitoba, Newfoundland and Labrador, and Saskatchewan.

[18] Personal Information Protection and Electronic Documents Act, SC 2000 c 5.

[19] Canada (Information Commissioner) v Canada (Commissioner of the Royal Canadian Mounted Police), [2003] 1 SCR 66, 2003 SCC 8 at para 23.

[20] Supra note 15, s 4.

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2015

Insights (5 Posts)

Featured Insight

Part 1 | Capital Markets Podcast: The Clash Between Securities Law and Crypto

This podcast series dives into the future of crypto law.

Read More
Nov 24, 2022
Featured Insight

Update for Federal Employers: Changes to the Canada Labour Code and Regulations

Federal employers should prepare for the forthcoming approval and implementation of several regulations proposed under the Canada Labour Code.

Read More
Nov 24, 2022
Featured Insight

Bill 23 Update: Revisions Proposed to Bill 23 Following Lengthy Second Reading

Ontario's most talked about piece of legislation, Bill 23, received some revisions from the Standing Committee prior to Third Reading.

Read More
Nov 24, 2022
Featured Insight

McMillan’s Annual Privacy, Data Protection and Cybersecurity Client Seminar

Join McMillan's Privacy & Data Protection Group on Wednesday, December 7th for an overview of recent significant legal developments, tips on complying with new and forthcoming obligations under Quebec’s Bill 64, and discussions about hot topics in data management.

Details
Wednesday, December 7, 2022
Featured Insight

OSC Signals Concerns about Gamification of Investing

The OSC cautions trading platforms about the use of gamification to incentivize investment after an experimental study shows these techniques are effective.

Read More
Nov 21, 2022