Bennett Jones
Written by Stephen Burns and Martin Kratz, Q.C.
The Alberta Court of Appeal in Moore’s Industrial Service Ltd. v Kugler, 2019 ABCA 178 has confirmed that the limitation period under the Limitations Act (Alberta) applicable to a claim for damages under section 60 of the Personal Information Protection Act (Alberta) (PIPA) does not start until the Commissioner's Order under section 52 of PIPA has become final.
Section 60 creates a statutory right to claim damages for a breach of PIPA.
Damages for breach of this Act
60(1) If the Commissioner has made an order under section 52 against an organization and the order has become final as a result of there being no further right of appeal, an individual affected by the order has a cause of action against the organization for damages for loss or injury that the individual has suffered as a result of the breach by the organization of obligations under this Act or the regulations.
Accordingly, an individual may bring a claim for damages for a breach of PIPA many years after the breach giving rise to the claim has occurred as the individual must first engage with Alberta's Commissioner and wind their way through the compliant, investigation and inquiry phases of the complaint resolution process under PIPA before bringing their action for damages under section 60 of PIPA. As noted in the decision, the complaint resolution process before the Commissioner can currently take years (just over two years in the subject case).
In addition, it is important to note the Court's observation that similar statutory causes of action arise in each of British Columbia (Personal Information Protection Act (British Columbia)), Ontario (Personal Health Information Protection Act (Ontario)) and federally (Personal Information Protection and Electronic Documents Act (Canada) (PIPEDA)). Although, in the case of PIPEDA, the statute expressly provides a limitation period and the application to court must be brought within one year of the Commissioner's report.
As such, every organization dealing with a breach under PIPA (or similar legislation) should be aware of the possibility of a claim for damages under such legislation and that the relevant limitation period for such claim may not start until after the applicable final Order or Report is issued by the applicable Commissioner.