Alberta’s Court of Appeal Finds Claims for Privacy Breaches can be Filed More Than Two Years after Discovering the Breach

On May 13, 2019, in Moore’s Industrial Service Ltd v Kugler, 2019 ABCA 178, the Alberta Court of Appeal (the “Court”) confirmed that the two year limitation period for bringing a civil claim for a breach of privacy does not begin until an order from the Office of the Information and Privacy Commissioner (the “OPC”) can no longer be appealed.

Wilfried Kugler was terminated from Moore’s Industrial Service Ltd. (Moore’s) in 2009, upon which Kugler was asked to return his company laptop. By October 2010, Kugler had discovered that an employee of Moore’s had accessed his personal email using the laptop. The OPC determined that Moore’s had breached its obligations under Alberta’s Personal Information Protection Act (PIPA). On November 29, 2013, the OPC issued an order under section 52 of PIPA. Kugler filed a claim for damages on January 15, 2015.

Generally, an individual must bring a civil action within two years after the individual knew or ought to have known that the injury occurred.  Kugler filed a claim for damages nearly five years after discovering the privacy breach. However, section 60 of PIPA does not indicate a time limit to commence a complaint. Rather, complaints must be brought within a “reasonable time.”

The Court confirmed that the two year limitation period for the cause of action in section 60 of PIPA should not begin until the OPC makes a final order and there is no further right of appeal. Given this decision, organizations dealing with a privacy breach should be conscious of the length of time they retain their records relating to the breach.

Summary By:  Alessia Monastero