Date: Fri, 13 Oct 2006 10:12:23 -0400 (EDT)

From: Jennifer Chandler

Subject: Liability for data security breaches

Hello all:

I have been looking at the new group of cases dealing with tort liability for breaches of data security - in which careless handling of customer personal information results in the loss/theft of the information and subsequent ID theft.

I'm looking at the question of whether PIPEDA (the Personal Information Protection and Electronic Documents Act) forecloses negligence liability for breaches of data security.

PIPEDA requires that reasonable measures to protect data security be used by organizations holding personal information.

The act also provides a reasonably comprehensive scheme for the adjudication of complaints by the federal Privacy Commissioner, as well as (eventually) a limited ability for a complainant to appeal to the Federal Court and to seek damages there.

It occurred to me that the Bhadauria, Frame v. Smith line of cases suggests that comprehensive statutory regimes foreclose the development of new common law torts to cover the same matter as the statute.

However, I can think of two possible reasons why this might not be the case here.

First - negligence is not a new tort, and although data security breaches are a new problem, liability for breaches of data security simply recognizes duties latent in negligence. (This argument is weakened as one must establish that pure economic losses are recoverable in this situation - suggesting that data security breach liability is new).

Second - doesn't the constitutional division of powers mean that only provincial statutory regimes can pre-empt the development of tort remedies? I have found cases where courts have held that federal regimes have pre-empted tort liability - but these cases do not mention the constitutional issue. Although courts have recognized that federal statutes can create civil remedies in some cases, it seems to be a different matter for a federal statute to "occupy the field" of tort law - a matter of provincial jurisdiction. On the other hand, federal attempts to create regimes to deal with problems within their jurisdiction might be undermined if the courts could create parallel systems to resolve disputes. What do you think?

<<<< Previous Message  ~  Index  ~  Next Message >>>>>