Case considered: Lycka v. Alberta (Information and Privacy Commissioner) and Jane Doe, 2009 ABQB 245
A Court of Queen’s Bench decision on April 20th to quash orders of the province’s Information and Privacy Commissioner (the Commissioner) should prove to be of little, if any, persuasive value outside of Alberta. However, in this province, it may be accorded weight – even precedential value since the decision has not been appealed – that it does not deserve. As a result of Lycka v. Alberta (Information and Privacy Commissioner) and Jane Doe, the name of a person who complains to the Commissioner of a breach of privacy must be disclosed to the party alleged to have committed the breach. Consequently, Alberta residents may be reluctant to bring forward complaints about privacy breaches, especially when physicians are on the other side.
The facts in Lycka are straightforward. The Applicant for judicial review of the Commissioner’s orders, Dr. Barry Lycka, is an Edmonton-based dermatologist. Dr. Lycka runs a clinic that offers patients consultative and diagnostic services – including biopsies – and both therapeutic and cosmetic surgeries as well. The clinic is run through the doctor’s professional corporation, Endermologie Centre Corporation (Endermologie), the operating arm of which is called Corona Rejuvenation Centre and Spa (Corona). Corona offers personal spa and esthetic services, and sells both cosmetic and therapeutic skin products. Dr. Lycka is also one of the founders of the Canadian Skin Cancer Foundation (the Foundation), which is a non-profit charity with its own Board of Directors, operating separately from the clinic and Corona. Among other things, the Foundation’s mandate is to raise awareness among people about ways to prevent skin cancer, and to educate physicians – through seminars and lectures – about ways to prevent and treat skin cancer.
Although the Foundation, Corona, and the clinic are separate entities, according to Dr. Lycka, many of his patients and/or clients of Corona have, over the years, indicated an interest in donating money to the Foundation. Therefore, because of these overlapping interests, information about the various services is periodically sent out to patients and clients. For the past few years, Dr. Lycka’s clinic maintained a database of patient information; i.e. names, phone numbers, gender, addresses, and services requested. Dr.Lycka maintained this database for mailing out information about the clinic, the spa, and the Foundation to his former patients and other interested members of the public. Clinic patients and clients of Corona were asked if they wanted to be included in the database, as were donors to the Foundation.
The privacy of patient health information, the maintenance of files and databases for such information, and the rules for collecting, using and disclosing health information are all regulated by the Health Information Act, R.S.A. 2000, c. H-5 (HIA). The protection of individual privacy and the rules for collecting, using and disclosing personal information for businesses, non-profit organizations and professional regulatory bodies are all regulated by the Personal Information Protection Act, R.S.A. 2003, c. P-6.5 (PIPA).
Before PIPA took effect on January 1, 2004 Dr. Lycka amended the forms used to collect basic demographic information so as to make them compatible with the new legislation. More specifically, these amendments were: i) the Patient History Form gives the choice to clinic patients as to whether they wish to be included in a database mailing list; ii) clinic patients receive consent forms for them to indicate whether they wish to receive information from the Foundation; iii) when people attend a Foundation-sponsored lecture or seminar, they are asked to indicate whether they wish to receive additional information and, if so, their names are included in the database mailing list; and iv) clients of Corona are asked if they would like to receive an informational newsletter. The database mailing list was subsequently updated, to allow information to be sorted by the organization through which the patient and/or client was registered, the date the contact information was entered into the database, and the date a request was made to remove the contact information from the database mailing list. Dr. Lycka’s staff received training in how to remove a person’s contact information from the database mailing list upon receiving a request for such a removal.
In early 2006, a decision was made to celebrate Dr. Lycka’s 50th birthday at an event at the Northern Alberta Jubilee Auditorium. Invitations to attend were mailed to Dr. Lycka’s friends, colleagues, patrons of the Foundation, clients of Corona, and patients past and present. Instead of gifts, patients were asked to consider making a financial contribution to the Foundation to enable it to continue its work with detecting and treating skin cancer. However, if a person decided not to donate, or could not make a donation, s/he could attend the event anyway; there was no fee to do so. Two of Dr. Lycka’s female patients, whose identities were not disclosed, complained to the Commissioner after receiving solicitations from Dr. Lycka and Corona even though they had earlier requested that their contact information be removed from the database mailing list.
This matter would seem to be rather prosaic and uncomplicated. Two patients had communicated to Dr. Lycka’s office that they did not wish to receive unsolicited information not directly related to their health care. They received such unsolicited information anyway. So, they complained to the Commissioner and the Commissioner looked to the legislation relevant to the matter. Two orders were duly issued under the HIA directing Dr. Lycka to do two things: i) submit a privacy impact assessment regarding the health information at issue, and ii) to cease collecting, using and disclosing such information for marketing and fundraising purposes. The Commissioner found that the information was “collected;” that upon such information being entered into a shared database, it was “disclosed;” and that in the compilation of a mass mailing list and subsequent mailing out of the information, the personal information of the two patients was “used.”
Furthermore, the Commissioner found that the HIA did not allow the collection or use of the patients’ information by a “custodian” (as the HIA defined the word) for marketing or fundraising purposes, even if individual consent were given. However, in fact, the Commissioner found that neither patient had consented to disclose her information; nor did Dr. Lycka’s consent forms comply with the requirements as set out in the HIA.
The Commissioner also made an order under PIPA against Endermolgie directing it to cease collecting and using personal information from the database for marketing purposes. The Commissioner found that Endermologie lacked authority under sections 14 and 17 of PIPA to collect and use personal information without consent and that, in any event, consent to use such information had not been obtained under s. 8(1) of PIPA. The Commissioner found that in choosing “No” on the Patient History Form, the complainants had opted out of the database and that, in any event, consent could only extend to the collection and use of personal information within the clinic for the purpose of providing health services, not for mailouts associated with marketing purposes.
In the application for judicial review of these orders, counsel for Dr. Lycka raised three issues:
1. What is the applicable standard of review?
2. Did the Privacy Commissioner breach the rules of natural justice and procedural fairness by refusing to disclose the identity of the complainants?
3. Did the Privacy Commissioner err in finding that the Health Information Act prohibits the collection and use of individually identifying health information, with consent, for the purposes of marketing and soliciting for fundraising?
In addressing the issues of standard of review and procedural fairness, Mr. Justice Gerald Verville was presented with the following judicial authorities: University of Alberta v. Alberta (Information and Privacy Commissioner), 2009 ABQB 112; Dunsmuir v. New Brunswick, [2008] 1.S.C.R. 190; and Stubicar v. Alberta (Office of the Information and Privacy Commissioner), 2008 ABCA 357. Counsel for the Commissioner argued that the decision not to disclose the names of the complainants was in fact a substantive matter, and that the important question was whether the two patients could be put at a disadvantage if Dr. Lycka knew their identities. Counsel for the Commissioner further argued that since this was a question of mixed fact and law, the standard of review analysis invited the standard of reasonableness. However, Mr. Justice Verville saw the non-disclosure of the names as going to the heart of procedural fairness and, as such, the applicable standard of review should be one of correctness.
There is persuasive judicial authority from Ontario courts to support the proposition that although a Privacy Commissioner cannot be regarded as an expert in interpreting statutes all and sundry, in regard to statutes relevant to the legislated mandate to protect privacy interests, the Commissioner can be regarded as an expert. (See John Doe v. Ontario (Information and Privacy Commissioner (1993), 106 D.L.R. (4th) Ont. Div. Ct. and Ontario (Minister of Health and Long-Term Care v. Ontario (Assistant Information and Privacy Commissioner) (2004), 73 O.R. (3d) 321 (C.A.)). There is judicial authority in Alberta that may be regarded as persuasive as well. As Ross, J. said in IMS Health Canada Limited v. Alberta (Information and Privacy Commissioner) 2008 ABQB 213 at paragraph 79: “But while the Commissioner is not expert in statutory interpretation in a general sense, he is expert in relation to this [the HIA] statute. A tribunal’s familiarity with a statute usually results in deference.” Finally, there is binding judicial authority from the Supreme Court of Canada that could be regarded as material and relevant. For example, the court in Pushpanathan v. Canada (Minister of Citizenship and Immigration), [1998] 1 S.C.R. 982 identified, as one of the factors that a court should consider in deciding whether to undertake judicial review over a tribunal’s decision, whether the issue is one that would be best decided by a specialized tribunal with expertise in the subject matter.
However, with regard to the degree of deference – or indeed, even whether deference should be accorded to the Commissioner at all – the judge in Lycka barely alluded to this. Counsel for Dr. Lycka had argued that the question as to whether the HIA prohibited the collection and use of personal identifying health information, even with individual consent, for marketing and fundraising purposes, was a matter of statutory interpretation. Mr. Justice Verville, evidently interested in going behind the Commissioner’s orders, agreed with this approach, and found that the standard of review with regard to the issue of procedural fairness was one of correctness, and then went on to find that Dr. Lycka’s ignorance of the names of the two patients somehow constituted such an egregious affront to procedural fairness that the doctor was effectively denied his right to a fair hearing before the Commissioner.
The obvious question in my mind is this: how would the names of the two patient-complainants be at all relevant in an analysis into whether Dr. Lycka’s clinic breached the rules regarding patient privacy? The Commissioner had all the evidence he needed to make his decision; i.e. the consent forms with the appropriate boxes duly ticked off to indicate that the patients did not want to receive any unsolicited fundraising or marketing information unrelated to their health care. Furthermore, this was not a case where anyone was alleging any breach of professional misconduct or any other serious impropriety that would result in disciplinary consequences for Dr. Lycka or his practice.
Unfortunately, since the Commissioner did not appeal this decision, only negative speculation is invited as to how this will impact the privacy interests of Albertans, especially in the health care setting.
anonymous
The case is this: Jane Doe accused Dr. Lycka of violating the laws of Alberta. Dr. Lycka could have defended himself if he knew who his accuser was – he could have accessed his chart to confirm or deny the accusations. But the privacy commissioner denied him this right.
It is akin to a person being charged with rape, without knowing his accuser. It is impossible to defend such as situation. It is for this reason the judge ruled against the privacy commissioner – he denied Dr. Lycka the ability to defend himself and in doing so denied hin justice.
Is it possible the accuser was lying? Is it possible the accuser had ulterior motives? Could the accusor be a competitor to Dr. Lycka who wanted to cause him grief?
The privacy commissioner did not have all the information but chose to accept Jane Doe’s interpreation. That is not justice but rather prejudice.
Also, the law prohibits an appeal from the privacy commissioners office.
Brian Seaman
Hi anonymous. To equate these two breaches of personal privacy with rape, the most serious of sexual assaults, indicates a lack of knowledge of law, or a serious lack of perspective, or both. We don’t have the benefit of the file before us, but, presumably, Dr. Lycka was provided with the evidence of the two persons in question having duly ticked off the forms indicating they did not wish to receive any unsolicited information. The names of the people would therefore be completely irrelevant to a determination of whether the doctor breached the pertinent portions of the Health Information Act and the Personal Information Protection Act. Also, this was not a question of “Jane Doe’s interpretation” of the relevant legislation. That is the mandated duty, among others, of the Privacy Commissioner, who was owed a higher degree of deference than the court chose to give his office. You’ve said the law prohibits an appeal in this matter. You must be alluding to the 2008 decision of the Alberta Court of Appeal in Brewer v. Fraser, Milner, Casgrain LLP 2008 ABCA 160, a decision that I think is distinguishable from the present case on its both on facts and law, but especially law. The Brewer decision concerned an appeal from a decision of the Human Rights Commission, which gets its legislative authority from the provincial Human Rights, Citizenship and Multiculturalism Act. There’s no privative clause in the Human Rights Act, which means, essentially, an aggrieved party who disagrees with the decision of the Human Rights Commission has an automatic right to get a review of the decision. The Privacy Commissioner has a different statutory grant of authority. The most relevant act in the Lycka decision was the Health Information Act. In that act, there is a privative clause, which says that an order of the commissioner is final. Thus, there is no automatic right to a review; rather, an aggrieved party has to apply for a judicial review, which should mean that, in the absence of a legal error, there should be no quashing of an order of the commissioner. Hopefully, this issue will come up before the Privacy Commissioner again. If it does, and the Commissioner isn’t granted the deference his office is owed in interpreting and applying the relevant privacy legislation I’d like to see the Commissioner launch an appeal.
anonymous
Your perspective is indeed skewed, my friend. The file clearly proved Dr. Lycka’s perspective and hence the ruling of the Privacy comissioner was over turned. Justice was denied because Dr. Lycka could not provide his documentation without reference to whom Jane Doe was. That my friend, is not justice. In fact, not one but two errors were found by the judge. Two legal errors were found by the presiding judge. Hence, the verdict overturned. In the future, the privacy commissioner will have to be more careful.
If it were appealed, which I believe is not allowed by the legislation, the same result would occur. A person is entitled to know who his attacker is to launch a defence. A doctor keeps copious notes about his clients in order to defend himself. Without them, he cannot launch a proper defence. This is the primary problem with the privacy commissioner’s decision hence the honorable judge overturned the privacy commisioner’s decision.
Brian Seaman
Anonymous, I continue to assert the inapplicability of the decision in Brewer v. Fraser, Milner, Casgrain LLP because I think it is distinguishable because of the privative clause issue. In any event, I think the QB judge in Lycka made a legal errors himself in: i) not granting deference to the Privacy Commissioner’s interpretation of the relevant legislation; but more seriously, ii) in applying the correctness standard and finding the PC erred in his interpretation of relevant legislation, which of course the judge was able to do when he found that Lycka was denied procedural fairness by not knowing the names of the two complainants.
On the other hand, in a different vein, were somebody to bring an allegation of professional misconduct against Dr. Lycka, indeed against any health care professional, then the identity of the complainant would be relevant because of the serious repercussions that would befall the health care professional if a finding of misconduct was made against that person. Since these repercussions could, depending on the seriousness of the allegation (egs: negligence or a sexual impropriety), involve the loss of a licence and thus the loss of a doctor’s livelihood, then that would invite the need for the doctor’s lawyer to cross-examine the complainant. Also, the seriousness of the allegation would invite, in accordance with a long line of judicial authority, a hearing that would be quasi-judicial in nature, with the various procedural requirements that are attendant to that. Also, an allegation of professional misconduct, of course, would not involve the Privacy Commissioner but the applicable professional standards board, (the Alberta College of Physicians and Surgeons, for example, if the complaint was against a doctor) and, of course, a different piece of legislation.
Evidently, then, we are going to agree to disagree. I do appreciate the feedback though, because it indicates that somebody is reading my writing, and is concerned enough to care to write.
anonymous
To be complete, I really only care about fareness. Yes, we will agree to disagree. Dr. Lycka felt he was treated unfairly and appealed to the Court of Quenns bench. Mr Justice Verville agreed with Dr. Lycka and quashed the Privacy Commisioners decision. This will have implications for the Privacy Commissioners’ office.
You can state all you want about supposed errors. The facts remain and for now stand.