03/02/2020 2017 FC 114 (CanLII) | CanLII [95] These cases demonstrate that remedies may transcend the particular circumstances of an applicant where it has been established that an organization’s practices are deficient. In such cases, broadly crafted remedies were required in order to ensure that the organization’s practices going forward did not result in further violations of constitutional and quasi-constitutional rights. [96] The request for a systemic remedy in the present matter is supportable because the evidence demonstrates that the effects of the respondent’s actions are not confined to the single applicant named in this application. The OPCC has received a total of 49 complaints relating to Globe24h.com. Moreover, affidavit evidence filed by the OPCC demonstrates that over 150 complaints have been received by CanLII regarding personal information found on Globe24h.com. As a result, I agree that the circumstances of this case justify a broadly crafted corrective order pursuant to paragraph 16(a) of PIPEDA. G. Damages [97] This Court has established that a damages award under PIPEDA serves three main functions: (1) compensation; (2) deterrence; and (3) vindication: Nammo v TransUnion of Canada Inc, 2010 FC 1284, [2010] FCJ No 1510 [Nammo] at paras 72-76; see also Townsend v Sun Life Financial, 2012 FC 550, [2012] FCJ No 77 at para 31; Chitrakar v Bell TV, 2013 FC 1103, [2013] FCJ No 1196 [Chitrakar] at para 26. [98] The Commissioner argues that, given PIPEDA’s quasi-constitutional nature, damages may be awarded “even where not factual loss has been proven”: Nammo, above, at paras 71 and 74. In addition to compensation, the goals of vindication and deterrence of further breaches are equally significant. The Commissioner took no position on whether damages are also required to compensate the applicant for any harm that he may have personally suffered as a result of the respondent’s actions. [99] In Nammo, above, at paragraph 76, the Court proposed a non-exhaustive list of factors to determine an application for damages under PIPEDA, namely: (1) whether awarding damages would further the general objects of PIPEDA and uphold the values it embodies; (2) whether damages should be awarded to deter future breaches; and (3) the seriousness of the breach. [100] I agree with the OPCC that the respondent’s breach is egregious because the respondent has essentially made a business of exploiting the privacy of individuals for profit. In at least one case, the respondent has refused to remove information which is subject to a publication ban in Canada. [101] The evidence demonstrates that the impugned disclosure has been extensive. The respondent engaged in bulk downloading of Canadian court and tribunal decisions, republished them on Globe24h.com, and made the personal information at issue easily accessible on the Internet by allowing the decisions to be indexed by search engines, including the names of parties and other individuals referred to in the decisions. The respondent’s actions have violated the privacy rights afforded to individuals, including the applicant in this case, without the consent of the individuals concerned. [102] Section 16 of PIPEDA provides no guidance as to the quantum of damages that may be granted. In Nammo, above, an award of $5,000 was used to compensate for a “serious breach involving financial information of high personal and professional importance”. In Girao v Zarek Taylor Grossman, Hanrahan LLP, 2011 FC 1070, [2011] FCJ No 1310, I awarded $1,500 in damages taking into account the impact of the breach on the applicant, who claimed mental anguish, the conduct of the respondent both before and after the breach and whether the respondent benefitted from the breach. In that instance, only the impact of the breach was a significant factor as the respondent had not received any material benefit and had acted promptly to rectify the matter. [103] In this case, I am satisfied that a damages award would be appropriate based largely on the conduct of the respondent. It is clear from the record that the respondent has commercially benefited from the breach through targeted advertising and by requiring a fee for removing the personal information of individuals contained in the decisions. The respondent has also acted in bad faith in failing to take responsibility and rectify the problem. In the circumstances, I consider that an award of $5000 would be appropriate. VII. COSTS https://www.canlii.org/en/ca/fct/doc/2017/2017fc114/2017fc114.html 15/21