No Privilege Claim In Data Breach Investigation

On April 30, 2024, the Ontario Superior Court of Justice (the Court) released its decision in LifeLabs LP v Information and Privacy Commr. (Ontario), 2024 ONSC 2194, dismissing LifeLabs LP’s (LifeLabs) application for judicial review and finding that the Information and Privacy Commissioners of Ontario and British Columbia (ON IPC and BC IPC, respectively) did not err in their application of the law on solicitor-client and litigation privilege, nor breach LifeLabs’ right to procedural fairness.

In a joint investigation of LifeLabs’ 2019 data breach, the ON IPC and BC IPC sought certain information obtained by LifeLabs from its consultants; LifeLabs resisted, asserting solicitor-client and/or litigation privilege over the information.  In 2020, the ON IPC and BC IPC decided that LifeLabs’ claims of privilege should fail (the Privilege Decision) and finalized their investigation report (as previously reported by the E-TIPS® Newsletter here).

On application for judicial review, LifeLabs sought an order quashing the Privilege Decision and preventing publication of the investigation report, among other things.

In finding that the ON IPC did not err in applying the law of solicitor-client and litigation privilege, the Court held that health information custodians cannot defeat their responsibilities under the Personal Health Information Protection Act by placing facts about privacy breaches inside privileged documents.  The Court reiterated that the ON IPC’s statutory duty to inquire, and LifeLabs’ duty to respond, does not permit a claim of litigation privilege over facts obtained through its lawyers, even where those facts might play a role in defending against parallel civil litigation.

Additionally, the Court stated that solicitor-client privilege does not extend to protect facts required to be produced pursuant to a statutory duty.  The Court found that the ON IPC correctly articulated the law in stating that “[e]ven if the communication is privileged, the facts referred to or reflected to in those communications are not privileged if they exist outside the documents and are relevant and otherwise subject to disclosure”.

In rejecting LifeLabs’ remaining arguments, the Court further held that an informed person would conclude that there was no apparent bias or lack of independence arising from the jointly issued Privilege Decision.

The Court therefore dismissed LifeLabs’ application.

Summary By: Steffi Tran