Medical marijuana users are suing Health Canada, in a case that could open doors for other privacy lawsuits against the federal government, and highlight shortcomings in Canada’s Privacy Act, experts say.

“If this case actually proceeded, and resulted in a court decision, it would be precedent-setting,” says Kris Klein, a lawyer at nNovation law firm who has been an advisor to the Privacy Commissioner of Canada.

But it still faces steep hurdles to get there.

Privacy compromised

The case started last November, after Health Canada sent letters to 40,000 medical marijuana users across the country. Rather than the usual discreet envelopes sent by courier, these went through regular post, and had “Marihuana Medical Access Program” and the patients’ names and addresses clearly displayed on the envelopes.

Patients say this violated their privacy by disclosing to an unknown number of people that they consume and possess marijuana, and that they have grave health conditions. They say it also put them in danger, as many patients in the program also grow marijuana at home, and the information could leave them vulnerable to break-ins and violence.

“That address on that piece of paper outed a lot of people, including designated growers,” says Jason Wilcox, a patient based in Vancouver. As the founder of the Cannabis in Canada Society and an avid social media user, Wilcox isn’t afraid to admit he smokes pot – but he is worried that people could now find out where he grows it.  He says for people living in small towns where everyone knows everyone, the problem is even worse.

Jason Wilcox on how he believes the letters endangered growers

Health Canada apologized for the gaffe in a statement on their website, saying it “deeply regrets this administrative error”.  But patients have slapped the organization with a class action lawsuit, which is now being waged by four law firms working together across Canada.

The Privacy Act: outdated?

The plaintiffs are seeking financial compensation from the federal government, which is a new and barely-explored territory in Canadian privacy law. That’s because Canada’s Privacy Act, which regulates how the federal government handles people’s personal information, doesn’t actually say if people have the right to claim damages if their privacy is invaded. In fact, the only remedy the Act explicitly states is to complain to the federal Office of the Privacy Commissioner.

Because of that, many courts have interpreted the Act to mean that “the legislation didn’t intend for there to be a remedy and that the court doesn’t actually have the right to award a remedy,” says Kate Saunders, a Vancouver lawyer with Branch MacMaster LLP who is handling the medical marijuana case.

Klein says this is one of the areas where he feels the privacy law desperately needs reform. “The Privacy Act right now gives these hollow rights,” he says. “You’re not really giving us rights if, at the same time, you can go ahead and violate them without any negative consequence.”

Listen to Kris Klein on why he thinks the Privacy Act needs reform

The Office of the Privacy Commissioner shares Klein’s concerns. In the watchdog organization’s most recent annual report, then-commissioner Jennifer Stoddart slammed the government’s continued failure to update the Privacy Act, calling it “troubling.” In a speech last November, Stoddart also called for a complete overhaul of the Act, and lamented the lack of penalties for ignoring privacy guidelines. “Wouldn’t it be better to have the force of law to motivate better practices so rather than focusing on reporting breaches, the emphasis would be on avoiding them altogether?” she said.

Privacy lawsuits on the rise

Saunders and Klein both say they’re seeing an increase in the number of people looking for legal recourse when their privacy is violated. Klein says in the digital age, people are becoming a lot more aware of their personal information, “and as people become more aware, they want to hold organizations accountable if they have that personal information.”

In the Privacy Commissioner’s annual report, Stoddart said that the number of complaints to her Office by citizens has hit a record high two years in a row, with an increase of 133% this past year. While that number was inflated by two significant incidents, Stoddart said it was still concerning.

On the flip side, she also said that data breaches reported by government were at an all-time high for the third year in a row, with 30% more breaches reported than the year before.

But without legal recourse, says Klein, complaining to the Privacy Commissioner is “the end of the road.”

A new avenue

In the absence of hard legislation, the Privacy Commissioner recommends a new, common-law avenue that could offer promise, known as intrusion upon seclusion. It’s borrowed from American case law, and can award damages for an intrusion into someone’s privacy, even if there is no physical loss. This argument will play a key role in the medical marijuana case.

Saunders says they owe a big debt to a ground-breaking 2012 case in the Ontario Court of Appeal, known as Jones v. Tsige. For the first time, a Canadian court used intrusion upon seclusion to award damages for a privacy breach.

“The Jones and Tsige case opened up an avenue that was very exciting for privacy lawyers,” says Saunders, because it meant that, at least in Ontario, there is a common-law right to privacy.  “It created a very strong argument that there is a right to privacy in the rest of Canada as well.”

Listen to Kate Saunders on how Jones v Tsige matters to privacy law

Since then, a number of privacy lawsuits in Ontario have relied on intrusion upon seclusion, but the medical marijuana case would be the first to bring it into the federal arena.

“This is why this case is very interesting,” says Saunders. “It provides an opportunity for the government to weigh in on the status of the common-law right to privacy, federally.”

The long road ahead

But there’s a long road ahead to get to that point. Saunders says they will be applying for certification next month, which means the court must determine whether it’s appropriate for the case to be treated as a class action.

And even to be certified, Klein says they’ve got an uphill battle. “Most people are not overly sympathetic to the plaintiffs,” he says, saying the incident is largely viewed as a relatively minor mistake.

On top of that, because the Privacy Act doesn’t give any guidelines on what warrants compensation and what doesn’t, he says there’s a lot of risk involved. “The plaintiffs’ lawyers who are taking this on now, they’re gutsy,” he says.

After certification, Saunders says, about 90% of cases will be settled out of court – which means they don’t set any precedent for future cases.

Whichever way this battle goes, there’s no shortage of privacy class actions that are headed for the federal arena right now, including several in Saunders’ office. “But as it stands, we don’t have a good read on which way the federal court is going to lean on them.”