The Superior Court of Quebec condemns the government to pay $385,000 to Jean Charest for unlawful disclosure of his personal information during an investigation by the Permanent Anti-Corruption Unit (UPAC). The case is not trivial, the amount is even less so. But above all, it should be seen as a strong signal in terms of privacy and data protection, not only for the former premier of Quebec, but also for all Quebecers.
A sensational story often comes with the same ingredients: power, secrecy, drama. Everything is there in this case. In April 2017, in the continuity of the Charbonneau commission, a newspaper article casts opprobrium on Jean Charest, Prime Minister of Quebec from 2003 to 2012, by linking him to the Mâchurer investigation into the financing of the Liberal Party of Quebec, and this, on the basis of information obtained from an unknown source within the UPAC.
There follows a series of investigations and projects to find the “bandit” at the origin of the leak, all strewn with twists and controversies of all kinds. Result: no less than 54 leaks from UPAC, but no proof as to the identity of the author(s). In February 2022, the UPAC closed the Mâchurer investigation without any charges being brought against anyone. The story is therefore closed, even if the mystery of the mole remains intact.
However, confidentiality only lives once. This is the challenge for the principal concerned, Jean Charest. Indeed, by disclosing his name associated with a UPAC investigation file as well as other nominative and biographical data (including residential addresses, telephone number, date of birth, marital status, background, etc.), this is in fact personal information that has not been protected under applicable laws. At a time when data protection is on everyone’s lips, in particular with the adoption of Bill 25 and the increase in the budget of the Commission d’accès à l’information du Québec1this decision drives the point home a little more.
Responsibility: no preferential treatment for UPAC
The UPAC, under the rule of the Anti-Corruption Commissioner, is certainly endowed with broad powers, including the right to obtain personal information held by other public bodies without the person concerned being informed. This does not mean, however, that there are no safeguards. UPAC is at all times bound to respect the constitutional right to privacy and remains responsible for protecting the personal information it holds.
This last notion of responsibility, which applies to any organization holding personal information, whether in the public or private sector, is at the heart of the court’s reasoning.
Indeed, beyond the extravagant nature of the case, the UPAC is essentially criticized for not having taken sufficient measures to protect Jean Charest’s personal information. Although the decision makes the economy of an exhaustive analysis of breaches of the law, a certain number of examples are evoked in a scattered way. First of all, UPAC’s document management seemed flawed since there was no measure to prevent the consultation, reproduction or sending by e-mail of documents without the person or medium at the time being identified. source of the leak. In addition, like any public body, in the absence of consent, UPAC could not communicate personal information to the media under the law. This observation is not unique to UPAC and concerns any organization holding personal information.
Too bad: no denial of privacy for Jean Charest
Then comes the question of the sensitivity of the information in question as well as the expectation of privacy of a public figure. And, again, there are some lessons to be learned from this case. On the one hand, personal information may be more sensitive because of the context in which it is communicated. Concretely, it is not so much the disclosure of Jean Charest’s name that poses a problem as its juxtaposition to the Mâchurer investigation and the risks of condemnation by the public. “The personal information disclosed is not trivial”, in short.
On the other hand, everyone has the right to privacy, including a political figure, a fortiori when she no longer holds public office.
This was then the case for Jean Charest when disclosing his personal information. Further, we must think of the illegal manipulation of information from public figures, who are sometimes in situations of vulnerability inversely proportional to their notoriety. This consideration also played an important role in the awarding of compensation: “A significant amount must be granted to remind all public bodies, be it UPAC, the Agence du Revenu du Québec, the Director of civil status, or other, […] their obligation to protect the personal information they hold, even if they believe they will benefit from anonymous and unlawful disclosure of a public figure’s private information. »
Penalty: no quarter for offenders
The Court hit hard by awarding Jean Charest $35,000 in compensatory damages and $350,000 in punitive damages2. There is much to be said for the motives in support of this quantum. Let us remember, however, that this is a warning for all organizations, not just UPAC, to take the right to the protection of privacy seriously… at the risk of paying a heavy price. Last touch of irony: Law 25 with its new record sanctions and fines has not even entered into force… For goodness sake.