The Alberta Court of Appeal has recently confirmed that the limitation period under the Alberta Limitations Act applicable to a statutory claim for damages under the Personal Information Protection Act (PIPA) does not begin to run until a Commissioner’s Order under section 52 of PIPA has become final.

In Moore’s Industrial Service Ltd. v Kugler, 2019 ABCA 178, a former employee of Moore’s filed a complaint with the Privacy Commissioner alleging that the company had unlawfully accessed and forwarded personal emails on what had formerly been his company laptop. Almost exactly two years later, in November of 2013, the Commissioner issued an Order under s. 52 of PIPA, finding that Moore’s had breached its obligations under the Act. Fourteen months later, in January of 2015, Kugler filed a civil claim against Moore’s seeking damages for the cause of action created by section 60 of the Act, which holds that

…if the Commissioner has made an order under section 52 against an organization and the order has become final as a result of there being no further right of appeal, an individual affected by the order has a cause of action against the organization for damages for loss or injury that the individual has suffered as a result of the breach by the organization of obligations under this Act or the regulations.

Moore’s applied to strike or in the alternative summarily dismiss the claim on the basis that it was statute-barred under the Limitations Act, arguing that the applicable limitation period was two years from the date upon which the plaintiff knew or ought to have known of the facts giving rise to the claim, and Kugler was aware of Moore’s privacy breach more than four years before his claim was filed. Both the master and chambers judge dismissed Moore’s application, holding that the two-year limitation period did not start to run until November of 2013, or sometime after, when the Commissioner issued her Order and it became final.

Moore’s appealed. The Court of Appeal considered the statutory framework and concluded that the Legislature had contemplated the possibility that the time between an individual making a complaint under PIPA and the Commissioner making an Order might be longer than two years. In the Court’s view, it would be absurd if the statutorily authorized timelines relied on by the Commissioner would operate so as to deny a complainant access to the cause of action the Legislature created for him. Accordingly, the appeal was dismissed. The Court held that the two-year limitation period under the Limitations Act does not begin to run for claims brought under section 60 of PIPA until the date the Commissioner’s Order becomes final.

Private-sector organizations governed by PIPA must therefore be aware of the possibility that a claim for damages for breach of the Act may be brought more than two years after the breach is initially discovered, and the relevant limitation period will likely not begin to run until such time as the Commissioner issues an Order and that Order becomes final. Organizations should manage any uncertainty by planning to defend possible claims with those expanded timelines in mind.

If you have any questions about privacy in your workplace, please contact a member of Field Law's Labour + Employment Group.