Privacy Protections in Alberta: A Closer Look at the Legal Gaps and Possibilities for Change

Canada is governed by two key federal laws that help protect personal privacy. The Privacy Act controls how public organizations collect, use, and disclose personal information, while the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to organizations involved in commercial activities, regulating their collection, use, and disclosure of personal data.

In Alberta, there is a provincial counterpart to PIPEDA: the Personal Information Protection Act (PIPA). PIPA applies to private-sector organizations regulated within the province and governs how these organizations handle employee information. While these laws provide some level of protection, they do not offer a civil cause of action for individuals whose privacy is violated.

The Gap in Privacy Protections

One significant limitation of Alberta’s privacy framework is that individuals cannot sue for a privacy breach if it is caused by another individual, rather than a public or private organization. This means that if someone personally violates your privacy—whether by hacking into your personal accounts or sharing private information without consent—you may find yourself without legal recourse.

To fill this gap, other provinces like Ontario have taken steps to recognize civil privacy torts. For example, the Ontario Court of Appeal established the tort of “intrusion upon seclusion” in the 2012 case Jones v. Tsige. This ruling acknowledged that there are other civil privacy torts, such as the public disclosure of private facts, false light, and appropriation of name or likeness, which have since been recognized in other jurisdictions.

Alberta's Progress: The Tort of Public Disclosure of Private Facts

Although Alberta has not yet created legislation that would provide a statutory cause of action for civil privacy breaches, the province has made some progress. In a 2021 case, ES v. Shillington, the Court of Queen's Bench recognized the tort of public disclosure of private facts. In this case, the plaintiff’s intimate partner posted explicit images of her online without consent. The court established a clear test for determining when a privacy breach might qualify as public disclosure of private facts:

1. The defendant disclosed a private aspect of the plaintiff's life.
2. The plaintiff did not consent to this disclosure.
3. The disclosure would be highly offensive to a reasonable person.
4. The disclosure had no legitimate public interest.

The court noted that, although the images in question were explicit, other forms of private information—such as health or financial details—could also be deemed “highly offensive” if made public.

While this ruling is a step toward stronger privacy protections in Alberta, it does not fully address the issue of privacy breaches caused by individuals. For instance, the tort of intrusion upon seclusion would allow individuals to take legal action if their privacy is violated, even if the information is not publicly disclosed.

The Tort of Intrusion Upon Seclusion: A Missed Opportunity?

The Jones v. Tsige decision also introduced the tort of intrusion upon seclusion, which applies when someone invades your privacy without your consent, regardless of whether the information is shared with others. To establish this tort, the following criteria must be met:

1. There was an unauthorized intrusion.
2. The intrusion was highly offensive to a reasonable person.
3. The matter intruded upon was private.
4. The intrusion caused anguish or suffering.

In Jones, the plaintiff’s banking information was accessed by a co-worker without consent. Although the information wasn’t shared with anyone else, the mere act of accessing sensitive data was enough to meet the test for this tort.

While Alberta courts have yet to formally recognize the tort of intrusion upon seclusion, it remains a possibility for the future. Alberta courts have looked to decisions like Nevsun Resources Ltd. v. Araya (2020) when considering the recognition of new torts. In Shillington, Justice Inglis emphasized that any new tort must address a real wrong, be necessary to resolve that wrong, and be an appropriate issue for the courts to address.

The Path Forward: Can Alberta Recognize New Privacy Torts?

Some previous Alberta cases, like Al-Ghamdi v. Alberta (2017), have suggested that there is no common law tort for breach of privacy in Alberta. However, these cases also demonstrate that courts in the province have the discretion to recognize new torts. In the Al-Ghamdi case, the plaintiff didn’t claim “intrusion upon seclusion”; instead, he argued that his privacy had been violated. The court’s decision, which stated that no tort existed for breach of privacy outside of specific provincial statutes, may be an oversimplification of the issue.

The fact remains that Alberta courts have the authority to recognize new torts, provided they meet the criteria set out in Nevsun. In Shillington, the court recognized the tort of public disclosure of private facts because it addressed a wrong with no other legal remedy available. This suggests that, under the right circumstances, Alberta could recognize the tort of intrusion upon seclusion as well.

Conclusion: A Need for Change in Alberta’s Privacy Laws

Although Alberta has made progress by recognizing the tort of public disclosure of private facts, significant gaps remain in privacy protections, particularly when it comes to privacy breaches between individuals. The tort of intrusion upon seclusion could offer a solution, but it has not yet been formally recognized in the province.

However, this does not mean that individuals in Alberta have to wait for legislation to change. With careful and strategic legal pleading, it may be possible to have this tort recognized in future cases. The Shillington decision suggests that courts are willing to recognize privacy torts when they address real harm and provide remedies that the current legal system does not. With continued attention to this issue, Alberta’s privacy protections may continue to evolve, offering greater safeguards for individuals in the digital age.