Summary[1]
Quantz v. Ontario is a key decision, arising from an accidental disclosure of Ontario Disability Support Program client information, that will have an influence on future privacy class actions. The Ontario Superior Court of Justice dismissed the certification motion and described important limitations on the tort of intrusion upon seclusion.[2] The court emphasized that the tort requires a deliberate invasion of privacy and clear evidence of wrongdoing, rather than an accidental leak. This decision is consistent with recent Court of Appeal cases, such as Owsianik v. Equifax Canada and Del Giudice v. Thompson, by which the court restricted the scope of liability for privacy breaches.[3]
Background
On December 20, 2018, an ODSP case worker emailed a spreadsheet containing approximately 45,000 ODSP client names, emails addresses, and ODSP identification numbers to all Ministry case workers. That email was not an improper disclosure of confidential data, as the recipient case workers would already have had access to this information.[4] However, one of the case workers then forwarded the email with the spreadsheet to 103 ODSP clients.[5]
The plaintiff, who was one of the individuals listed on the spreadsheet, claimed that the disclosure of the spreadsheet to the 103 clients identified those ODSP clients thereby stigmatizing them, and impaired their privacy rights as the files contained confidential medical and financial information.[6] The plaintiff asserted several causes of action including intrusion upon seclusion, negligence, breach of confidence, and publication of private facts. The defendant argued that no actionable tort occurred, that the email was sent without willful intent, and that there was no harm or loss.[7] The plaintiff did not allege harm other than anxiety caused by learning of the email.
The tort of intrusion upon seclusion addresses the wrongful access of private information by someone who does not have the right to the information. The Court of Appeal recognized this tort for the first time in 2012 (Jones v. Tsige).[8] This tort differs from other torts commonly used in privacy law as it can be found even when there is no evidence of damages.[9]
Intrusion upon Seclusion
There are three elements to the tort of intrusion upon seclusion. First, the defendant’s conduct must be intentional or reckless. Second the defendant must have invaded, without lawful justification, the plaintiff’s private affairs or concerns. Finally, it must be determined that a reasonable person would regard the invasion as highly offensive causing distress, humiliation, or anguish.[10]
The first element was highly contentious at the Quantz certification hearing. The parties disagreed on whether the individual’s intention should relate to the action (i.e., did the individual intend to send the email?), or to the result of the action (did the individual intend to intrude on the plaintiff’s privacy?). The plaintiff argued that intention should relate to the action itself because, by attaching the spreadsheet to an email sent to Ministry case workers, the individual who sent the email created the risk that unauthorized persons would receive the data too.[11] However, the defendant argued that the intention should relate to the result. The court held that the alleged tortfeasor must have understood (or been reckless as to) the risk to privacy and chose nevertheless to access the information. The court found that there was no evidence that the person who sent the email did so with the intention of exposing private information. Therefore, the first element of the tort could not be satisfied.
In addition, the court found that for there to be “intrusion” the information must have been accessed by “an outsider or a rogue insider”.[12] The Court of Appeal addressed this situation in Owsianik where a third-party hacker accessed a database of confidential information. The Court of Appeal held that the database administrator could not be liable for intrusion upon seclusion when it was not involved in the intrusion of the privacy breach.[13] Based on these findings, the court held that it was not plain and obvious that the claim for intrusion upon seclusion would succeed.
Other Causes of Action
The plaintiff argued that he and the other class members suffered damages due to the defendant’s negligence including stigma, psychological harm and exposure to fraud and identity theft.[14] This must amount to more than ordinary emotional disturbances and instead be serious and prolonged enough to qualify as a recognizable psychological injury.[15] The pleading contained no material facts that the harm reached this level of mental injury as the plaintiff did not plead any medical issues, doctor’s visits, counselling or psychiatric care.[16]
As well, pleading that the class members could experience harm in the future through identity theft or exposure to fraud is not evidence that they have suffered harm, so this pleading was found to speculative.[17] Therefore, the court found the negligence claim could not succeed.
Next, a claim for breach of confidence requires proof of three elements: that the information conveyed was confidential, that the information was conveyed in confidence, and that the confidential information was misused by the party to whom it was communicated to the detriment of the confider.[18] The court found that the first two elements had been met as the information was confidential and conveyed in confidence with the expectation that it would not be made public. The last element was the most contentious. It was not met as the court found that the disclosure was accidental and not misused for an improper purpose.[19] The court held that there was no cause of action in breach of confidence.
The elements of a cause of action for public disclosure of private facts are: (i) the defendant gives publicity to a matter concerning the private life of another; (ii) the matter publicized, or the act of publication, would be highly offensive to a reasonable person; and (iii) is not of legitimate concern to the public.[20]
The main factor of public disclosure of private facts is that the more broadly publicized the offending material is, the more applicable the cause of action. This situation did not meet the criteria as it did not involve a publication, but rather an accidental email to a group of individuals, none of whom were likely to want to publicize the information further. There was also nothing in the material that met the highly sensitive and grossly offending level of revenge pornography uploaded by a former intimate partner, which this cause of action was designed to address. Therefore, this last cause of action also did not apply, and the court dismissed the case.
Plaintiff Compromises Case on Social Media
Another important point is that the information was not released in a manner accessible to the general public. It was released in an email that was sent solely to a small group of individuals who were all contacted and asked to delete it shortly after. Despite expressing concern about the publicity of this confidential information, the plaintiff publicly announced and joked about it on Facebook, thereby identifying himself as an ODSP recipient in the process.[21]
Observations for Future Intrusion upon Seclusion Cases
The Quantz case reaffirms the Court’s decision in Del Giudice v. Thompson [22] where the Court of Appeal held that the requirements of intrusion upon seclusion were not met when an authorized case worker improperly mishandled confidential information, because the conduct is not of a highly offensive nature as required under the final step of the test.[23] In Quantz, the Ministry case worker was authorized to have access to this information but mishandled the confidential information by making a mistake which was not highly offensive.
It is also notable that the discussion surrounding how the court should interpret intention appears somewhat reminiscent of the distinction between general and specific intent in criminal law. The court took an approach more closely related to specific intent for this step in the intrusion upon seclusion test.
The decision in Quantz is consistent with recent jurisprudence that highlights the requirement for intentional conduct for this tort. While privacy concerns will continue to grow alongside the advancement of technology, this case shows that plaintiffs will still face significant obstacles when bringing claims of intrusion upon seclusion for accidental leaks. Plaintiffs will need to demonstrate a stronger factual basis in similar privacy breach cases in order to be successful.
[1] The author is an Articling Student at the Ontario Ministry of the Attorney General, Crown Law Office – Civil. The views expressed in this article are those of the author and do not represent the views of the Attorney General or the government of Ontario. The author is grateful for the insightful comments of Christopher Wayland in reviewing this article.
[2] Quantz v. Ontario, 2025 ONSC 90.
[3] Owsianik v. Equifax Canada, 2022 ONCA 813; Del Giudice v. Thompson, 2024 ONCA 70.
[4] Ibid at paras 4-5.
[5] Ibid at para 6.
[6] Ibid.
[7] Ibid at para 8.
[8] Jones v. Tsige, 2012 ONCA 32.
[9] Ibid at para 71.
[10] Quantz v. Ontario, 2025 ONSC 90 at para 38.
[11] Ibid at para 42.
[12] Ibid at para 51.
[13] Owsianik v. Equifax Canada, 2022 ONCA 813 at para 59.
[14] Quantz v. Ontario, 2025 ONSC 90 at para 59.
[15] Ibid at paras 61-62.
[16] Ibid.
[17] Ibid at para 72.
[18] Ibid at para 74.
[19] Ibid at para 85.
[20] Ibid at para 92.
[21] Ibid at para 60.
[22] Del Giudice v. Thompson, 2024 ONCA 70 at para 34-35.
[23] Quantz v. Ontario, 2025 ONSC 90.
