SUPERIOR COURT OF JUSTICE - ONTARIO

COURT FILE NO.: CV-10-00624370

DATE: 20210310

RE: Catharina Demme, Plaintiff

AND:

Healthcare Insurance Reciprocal of Canada, Defendant

BEFORE: Mr. Justice Chalmers

COUNSEL: M. Burgar, for the Plaintiff

M. Girard, for the Defendant

HEARD: December 17, 2020, by videoconference

ENDORSEMENT

OVERVIEW

[1] Catharina Demme brings this motion for a declaration that the Healthcare Insurance Reciprocal of Canada (“HIROC”) owes a duty to defend her in various civil actions in which she is named as Defendant. HIROC issued a policy of insurance (the “Policy”) to the Brampton Civic Hospital (the “Hospital”). The Policy provided coverage to the Hospital and its employees in the course of their employment. Ms. Demme takes the position that she is an insured pursuant to the Policy. She seeks reimbursement of the costs she has incurred to date and a declaration that HIROC is obliged to pay her future defence costs until the various actions are concluded.

[2] Ms. Demme is a former registered nurse. While employed at the Hospital, she misused an automatic dispensing unit (“ADU”) to obtain Percocet tablets. Ms. Demme would access patient records so the ADU would trigger a disruption of those records to show that the patient received an “as needed” Percocet tablet when, in fact, the patient had not received a tablet. Ms. Demme dispensed the pills, which she then took for herself. From 2006-2016, Ms. Demme accessed the records of 11,358 patients, which allowed her to obtain 23,932 Percocet tablets. When the Hospital discovered Ms. Demme’s activities, it sent form letters to the patients whose medical records had been improperly accessed.

[3] Eight civil actions were brought against Ms. Demme and the Hospital, including Stewart v. Demme, Court File No.: 17-S74S74-00CP (the “Stewart Action”). The essence of each claim is that Ms. Demme wrongfully accessed patient files and thereby committed the tort of intrusion upon seclusion. HIROC denied Ms. Demme’s request to defend her in the actions on the basis that the alleged injuries did not arise out of an occurrence and therefore the claims do not fall within the insuring agreement. HIROC also relied on two exclusions: for injury “expected or intended from the standpoint of the Insured”, and for injury “arising out of the performance of a criminal act”.

[4] For the reasons set out below, I conclude that there is no coverage available to Ms. Demme and no duty on HIROC to defend her. The Plaintiff’s motion is dismissed.

THE ISSUES

[5] This endorsement will deal with the following issues:

a. Is this an appropriate case for summary judgment?

b. Is there a duty to defend Ms. Demme?

• What are the general principles of the duty to defend?

• Is extrinsic evidence admissible on the motion to determine if there is a duty to defend?

• Do the claims against Ms. Demme fall within the insuring agreement of the Policy?

• If the claims fall within the insuring agreement, are the claims excluded by the intentional act and/or criminal act exclusions? and

• Does a finding of no coverage for the tort of intrusion upon seclusion nullify the insurance coverage for privacy claims?

ANALYSIS

Is this an appropriate case for summary judgment?

[6] The court shall grant summary judgment if it is satisfied that there is no genuine issue requiring a trial. Although both parties agree to have this case determined by summary judgment, I must be satisfied that it is appropriate: Rules of Civil Procedure, R. 20.04(2)(b). In determining whether summary judgment is appropriate, I must consider the entire evidentiary record and the framework set out in Hryniak v. Mauldin, 2014 SCC 7, [2014] 1 S.C.R. 87, at paras. 81-84.

[7] The analytic approach set out in Hryniak is summarized as follows:

a. The motion judge is to first determine if there is a genuine issue requiring a trial based only on the evidence on the motion, without resorting to the enhanced fact-finding powers under R. 20.04(2.1).

b. If there appears to be a genuine issue requiring a trial, the motion judge must determine if a trial could be avoided by using the enhanced powers under R. 20.04(2.1), which allow the judge to weigh evidence, evaluate the credibility of a deponent and draw any reasonable inference from the evidence: see Royal Bank of Canada v. 1643937 Ontario Inc., 2021 ONCA 98, at para. 24.

[8] The overarching rule is that summary judgment will be appropriate only if it allows for a fair process that results in a just adjudication on the merits: see Royal Bank of Canada, at para. 25. There will be no genuine issue requiring a trial where a judge is able to reach a fair and just determination on the merits of the motion because the record before the court:

a. Allows the judge to make the necessary findings of fact,

b. Allows the judge to apply the facts to the law, and

c. Is a proportionate, more expeditious and less expensive means to achieve a just result than going to trial: see Hryniak, at paras. 49 and 66.

[9] An insurer’s duty to defend is determined on the allegations made in the Statements of Claim and the wording of the policy. No other evidence is generally admissible: see Monenco Ltd. v. Commonwealth Insurance Co., 2001 SCC 49, [2001] 2 S.C.R. 699, at paras. 28-35. In this case, there are no disputed facts and no issues of credibility. I conclude that the issue of whether HIROC owes a duty to defend Ms. Demme can be determined on the record before me, with the certainty required by Hryniak.

Is there a duty to defend to Ms. Demme in the Stewart Action?

1) What are the general principles of the duty to defend?

[10] The law with respect to the duty to defend is not in dispute. The Court of Appeal summarized the governing principles in Tedford v. TD Insurance Meloche Monnex, 2012 ONCA 429, 112 O.R. (3d) 144, at para. 14:

The following principles emerge from the case law governing the duty to defend:

(1) The insurer has a duty to defend if the pleadings filed against the insured allege facts which, if true, would require the insurer to indemnify the insured: Monenco Ltd. v. Commonwealth Insurance Co., 2001 SCC 49, [2001] 2 S.C.R. 699, (S.C.C.), at para. 28.

(2) If there is any possibility that the claim falls within the liability coverage, the insurer must defend: Nichols v. American Home Assurance Co., 1990 144 (SCC), [1990] 1 S.C.R. 801 (S.C.C.), at p. 810.

(3) The court must look beyond the labels used by the plaintiff to ascertain the “substance” and “true nature” of the claims. It must determine whether the factual allegations, if true, could possibly support the plaintiff's legal claims: Monenco, at paras. 34-35; Scalera, at para. 79.

(4) The court should determine if any claims plead are entirely “derivative” in nature, within the meaning of that term as set out in Scalera. A derivative claim will not trigger a duty to defend.

(5) If the pleadings are not sufficiently precise to determine whether the claims would be covered by the policy, “the insurer's obligation to defend will be triggered where, on a reasonable reading of the pleadings, a claim within coverage can be inferred”: Monenco, at para. 31.

(6) In determining whether the policy would cover the claim, the usual principles governing the construction of insurance contracts apply, namely, the contra proferentem rule and the principle that coverage clauses should be construed broadly and exclusion clauses narrowly: Monenco, at para. 31; Scalera, at para. 70. As well, the desirability, where the policy is ambiguous, of giving effect to the reasonable expectations of the parties: Scalera, at para. 71.

(7) Extrinsic evidence that has been explicitly referred to in the pleadings may be considered to determine the substance and true nature of the allegations: Monenco, at para. 36; see 1540039 Ontario Ltd. v. Farmers’ Mutual Insurance Co. (Lindsay), 2012 ONCA 210 (Ont. C.A.).

2) Is extrinsic evidence admissible on a duty to defend motion?

[11] Ms. Demme sought to introduce into evidence the report of Dr. Veennman dated November 7, 2019, which was prepared in the course of the defence of the Stewart Action. The report is not referred to in the pleadings and is therefore not admissible on this duty to defend motion: see Monenco, at para. 36. For the purposes of this motion, I have considered only the allegations contained in the Statements of Claim, admissions made by Ms. Demme in her Statement of Defence and the Policy wording.

3) Do the claims against Ms. Demme fall within the insuring agreement of the Policy?

[12] Ms. Demme has the onus to establish that the claims, as pleaded, fall within the insuring agreement of the Policy. Each element of the insuring agreement must be established.

[13] In determining whether there is a duty to defend, it is necessary to undergo a three-step process. The first step is to review the pleadings to determine the true nature of the claims. The court is required to determine which of the plaintiff’s allegations are properly pleaded. The court is not bound by the words used by the plaintiff’s lawyer in drafting the claim. The second step requires the court to determine if any claims are wholly derivative in nature. The third step is to decide whether any of the properly pleaded, non-derivative claims could potentially trigger the insurer’s duty to defend: see Non-Marine Underwriters, Lloyd’s of London v. Scalera, 2000 SCC 24, [2000] 1 S.C.R. 551, at paras. 50-52.

a) The Statements of Claim

[14] Eight separate actions have been brought against Ms. Demme. Each claim alleges the tort of intrusion upon seclusion. In addition, some of the claims allege negligent conduct. In argument, the parties focused their submissions on the allegations set out in the Statement of Claim in the Stewart Action.

i) The Stewart Action

[15] The Amended Statement of Claim in the Stewart Action includes a claim for intrusion upon seclusion. It is alleged that there was unauthorized access to the Stewart plaintiffs’ confidential medical information. The unauthorized access occurred when Ms. Demme used the ADU to obtain the information necessary to dispense Percocet tablets. The relevant paragraphs in the Statement of Claim in the Stewart Action are as follows:

13. Beginning on a date which is known to the Defendants, but which the Defendants have not disclosed to the Plaintiff, and which is at least ten years ago, but probably more, and continuing until at least April 2017, the Defendant, Demme surreptitiously accessed the confidential information of the Plaintiff and of the Class Members without their knowledge or consent. In so doing, she committed the tort of intrusion upon seclusion.

14. The intrusion upon seclusion in issue occurred at least hundreds and possibly thousands of times and were committed by Demme for the purpose of obtaining illicit access to the narcotic drug, Percocet, which she was both selling on the street for a profit and consuming herself.

15. The Defendant, Demme kept her unlawful invasions of privacy a secret from the Plaintiff and the Class Members. In fact, the Defendant, Demme’s unlawful invasions of privacy went undetected by any Class Members until April 2016, when the Defendant, Osler wrote to the Plaintiff and other class members to advise that their privacy had been invaded.

16. The Defendant, Demme took active steps to conceal her unlawful invasions of privacy, including in particular using identification credentials and passwords of her colleagues to access the Plaintiff’s computer system. The crudity and simplicity of the Defendants, Osler’s systems permitted her both to do this, and to escape detection for an entire decade.

17. The Defendant, Demme had no valid reason to access the personal information of the Plaintiff and Class Members on the occasions in issue. She did so solely in order to gain illegal access to the narcotic drug, Percocet which she was selling on the street for an enormous profit.

18. The Plaintiff states and the fact is that the Defendant, Demme had no legitimate purpose, whether business, medical or otherwise in accessing the confidential information of the Plaintiff and the Class Members. She was an electronic thief, stealing the Plaintiff and Class Members’ data for her own personal gain.

[16] Ms. Demme delivered a Statement of Defence in which she pleads that she developed a narcotic painkiller addiction. She admits to misusing the ADU to procure Percocet tablets. She entered guilty pleas to the criminal charges of theft under $5,000 and breach of trust in relation to her acquisition of Percocet from the Hospital. Ms. Demme, in her reply factum, takes the position that the Statement of Defence may be considered in the context of the pleadings rule. I have considered only those aspects of the Statement of Defence which are admissions made by Ms. Demme.

[17] The Stewart Action proceeded to a certification motion and summary judgment motions brought by Ms. Demme and the Hospital. In reasons dated January 6, 2020, Morgan, J. certified the Stewart Action as a class action. He granted partial summary judgment and dismissed the claims based in negligence.

ii) Other actions

[18] HIROC takes the position in its factum that the determination of the duty to defend in relation to the Stewart Action will apply to all other actions involving Ms. Demme. Ms. Demme does not agree. She notes that the other seven actions are pleaded differently than the Stewart Action. Although all the claims allege intrusion upon seclusion, some also include allegations of negligence.

The Calbretta, Darraugh, D’Cruz, Munt and Emoff actions

[19] The Statements of Claim in the actions brought by Calbretta, Darraugh, D’Cruz, Munt and Emoff contain virtually the same allegations against Ms. Demme. The relevant sections of the Statement of Claim from the Calbretta action are as follows:

6. [T]he Defendant, Catharina Demme, accessed the Plaintiff’s personal patient file gaining unauthorized access to personal, private and confidential information such as name, address, patient number, allergies and other information not yet known. The Defendant, Catharina Demme, used this access and information to obtain narcotics, particularly Percocet for non-hospital-related use.

7. C. AS TO THE NEGLIGENCE OF THE DEFENDANT, CATHARINA DEMME FOR WHICH THE DEFNDANT, WILLIAM OSLER HEALTH SYSTEM IS LIABLE IN LAW:

a. She failed to ensure that the Plaintiff’s personal and health information remained confidential and was not disclosed;

b. She used the Plaintiff’s personal and health information for improper purposes;

c. She took advantage of vulnerabilities in the computer and/or security system to obtain personal and health information of the Plaintiff;

d. She took advantage of vulnerabilities in the computer and/or security system to use the improperly accessed information to obtain narcotics for non-hospital-related use;

e. She took advantage of the Plaintiff’s trust in her, as a nurse, to obtain and use the Plaintiff’s personal and health information;

f. She caused and allowed the Plaintiff’s medical record to inaccurately state that the Plaintiff had received prescription medication that he had not; and

g. She caused and allowed the plaintiff to go without the medication to which he was entitled and which he needed.

10. The Plaintiff pleads that the Defendants improperly accessed and disclosed personal and medical information and intruded on the seclusion of the Plaintiff from these successive breaches of privacy.

11. The Plaintiff further alleges that the Defendant, Catharina Demme intentionally invaded, without lawful justification, the Plaintiff’s private affairs and concerns in a highly offensive manner causing distress, humiliation and anguish.

The Hanson action

[20] The relevant sections of the Statement of Claim issued in the Hanson action are as follows:

10. Angela states that the Defendant Nurse Demme for whose intrusion upon seclusion the Defendant Hospital is in law responsible, wrongfully and intentionally accessed Angela’s personal health information without consent or authorization. The Defendant Nurse Demme had no legitimate purpose in accessing this information and it was outside the scope of her duties to do so. On the contrary, Nurse Demme was motivated by a desire to unlawfully obtain narcotics. This motivation was improper.

[21] The plaintiff alleges that Ms. Demme was convicted of theft as a result of the series of events respecting her breaches of privacy. There are no claims in negligence alleged against Ms. Demme in the Hanson action.

The Draga action

[22] The relevant sections of the Statement of Claim issued in the Draga action are as follows:

11. In a letter dated August 2, 2017, William Osler Health System informed Mr. Draga that while he was a patient at the Day Surgery Unit at Brampton Civic Hospital, his personal health information was inappropriately used by a hospital employee within Brampton Civic Hospital in order to access narcotic medication, namely, Percocet, and which, as a result of the breach was never provided to Mr. Draga. Mr. Draga was not aware that his personal health information had been breached as such until he received the said letter, which is enclosed herein.

12. It is the Plaintiff’s position that the invasion of the Plaintiff’s personal health information was intentional and/or reckless. Secondly, the Plaintiff’s private affairs were invaded without lawful justification. Finally, a reasonable person would regard the invasion as highly offensive and resulting in serious distress, humiliation and anguish.

[23] The plaintiff alleges that Ms. Demme was charged with breach of trust and theft. There are no allegations of negligence against Ms. Demme in the Draga action.

b) The Policy wording

i) Insuring agreement

[24] The Policy provides liability coverage to the William Osler Health System and its employees who are in the course of their employment. The Policy provides as follows:

The Policy defines Insured to include Additional Insureds but only in respect of liability arising from the operations of the NAMED INSURED:

(i) All employees of the NAMED INSURED, but only in the course of their employment on behalf of the NAMED INSURED….

[25] The Policy provides coverage for claims for bodily injury arising out of an occurrence. The insuring agreement of the Policy provides as follows:

1. COVERAGE A – BODILY INJURY

To pay on behalf of the Insured all sums which the Insured shall become legally obligated to pay as damages because of bodily injury, sickness or disease, including death at any time resulting therefrom, by any person or persons and arising from an occurrence during the POLICY PERIOD.

[26] The Policy includes an expanded definition of “bodily injury”:

[T]he term, “bodily injury” means bodily injury, sickness or disease, including death and shall also include injury arising out of:

c) Invasion or violation of the right to privacy, wrongful eviction or wrongful entry;

d) Mental anguish, injury, shock, humiliation, disease, sickness or disability….

[27] Under Special Provisions in the Policy, the term “occurrence” is defined as follows:

The word “occurrence” as used in this policy, including any Certificate of Insurance issued hereunder, shall mean an accident, including continuous or repeated exposure to substantially the same general conditions, which results in bodily injury or property damage neither expected nor intended from the standpoint of the Insured.

ii) Exclusions

[28] The Policy excludes coverage for damage intended on the part of the insured and for damage arising out of the performance of a criminal act. The Policy provides as follows:

This insurance shall not provide insurance against liability:

Arising out of:

(b) Bodily injury or Property Damage expected or intended from the standpoint of the Insurance. This exclusion does not apply to bodily injury resulting from use of reasonable force to protect persons or property;

(e) Bodily injury, sickness or disease, including death at any time resulting therefrom, arising out of the performance of a criminal act, except in respect of the coverage provided in C1. This exclusion shall not apply to any Insureds not having knowledge of or being a party to such a criminal act.

c) What is the true nature of the claims?

[29] The first step in the analysis is to review the pleadings to determine which of the Plaintiffs’ allegations are properly pleaded. The substance of the allegations contained in the pleadings are to be examined to determine the true nature of the claims. I am not bound by the words used by the Plaintiffs’ lawyers in drafting the claims.

[30] All the claims allege that the plaintiffs sustained injury as result of intrusion upon seclusion committed by Ms. Demme. It is alleged that she accessed their personal medical records without authorization. As noted by Morgan, J. in Stewart v. Demme, 2020 ONSC 83, at para. 55, intrusion upon seclusion is a fairly recent tort and can be traced from the Court of Appeal’s judgment in Jones v. Tsige, 2012 ONCA 32, 108 O.R. (3d) 241, which provides the following definition:

[70] I would essentially adopt as the elements of the action for intrusion upon seclusion the Restatement (Second) of Torts (2010) formulation which, for the sake of convenience, I repeat here:

One who intentionally intrudes, physically or otherwise, upon the seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the invasion would be highly offensive to a reasonable person.

[71] The key features of this cause of action are, first, that the defendant’s conduct must be intentional, within which I would include reckless; second that the defendant must have invaded, without lawful justification, the plaintiff’s private affairs or concerns; and third, that a reasonable person would regard the invasion as highly offensive causing distress, humiliation or anguish. However, proof of harm to a recognized economic interest is not an element of the cause of action. I return below to the question of damages, but state here that I believe it important to emphasize that given the intangible nature of the interest protected, damages for intrusion upon seclusion will ordinarily be measured by a modest conventional sum.

d) Limitations

[72] These elements make it clear that recognizing this cause of action will not open the floodgates. A claim for intrusion upon seclusion will arise only for deliberate and significant invasions of personal privacy. Claims from individuals who are sensitive or unusually concerned about their privacy are excluded: it is only intrusions into matters such as one’s financial or health records, sexual practices and orientation, employment, diary or private correspondence that, viewed objectively on the reasonable person standard, can be described as highly offensive.

See also Hopkins v. Kay, 2015 ONCA 112, 124 O.R. (3d) 481, at para. 48.

[31] One of the elements of the tort of intrusion upon seclusion is intentionality. As noted by the Court of Appeal, a claim can arise only for deliberate invasions of personal privacy. There can be no liability for the tort of intrusion upon seclusion unless there is a finding that the defendant intended to intrude upon the seclusion of another.

[32] Ms. Demme argues that she did not intend any injury to the plaintiffs. She makes a distinction between an intention to access medical records for the purpose of obtaining Percocet tablets and an intention to breach the patients’ privacy. As noted by Morgan, J., Ms. Demme accessed the health records to satisfy her craving for narcotics and “not to satisfy any other need for patient’s health information”: Stewart, at para. 17.

[33] HIROC argues that the fact that Ms. Demme intended to access medical records necessarily results in a finding that she intended to cause injury to the plaintiffs. The injury sustained by a person whose private records have been improperly accessed is the loss of control over their private information. It is the invasion itself which results in the injury. HIROC argues that the same allegations which establish the tort of intrusion upon seclusion establish an intent to injure. As stated by Morgan, J. in Stewart, at para. 68:

It must also be kept in mind that physical injury or monetary loss is not a necessary ingredient for liability under intrusion against seclusion. Every member of the class has suffered the same loss – a loss of control over their private information. As noted in Jarvis, para 134, quoting A.F. Westin, Privacy and Freedom (1970), p. 7, privacy is “the claim of persons to ‘determine for themselves when, how, and to what extent information about them is communicated to others’”. The intrusion – the loss of control – is its own harm.

[34] I am of the view that the true nature of the claims against Ms. Demme is the intentional tort of intrusion upon seclusion.

d) Are the claims derivative in nature?

[35] The second stage requires a determination of whether any of the claims made against the insured are entirely derivative in nature. A duty to defend will not be triggered if there are alternative pleadings in negligence and the alleged negligence is based on the same harm as the intentional tort: see Scalera, at para. 51.

[36] The negligence allegations against Ms. Demme and the Hospital in the Stewart Action were considered by Morgan, J. He granted partial summary judgment and dismissed the negligence claims. He noted that negligence requires there be actual harm caused by the wrongdoing. The Statement of Claim in the Stewart Action pleads that, as a result of the breach of the private medical records, the plaintiffs experienced inconvenience, discomfort and distress. Morgan, J. noted that the Supreme Court of Canada established that damages for “‘upset, disgust, anxiety, agitation or other mental states that fall short of injury’ do not constitute compensable damages in a negligence claim”: Stewart, at para. 87, citing Mustapha v. Culligan of Canada Ltd., 2008 SCC 27, [2008] 2 S.C.R. 114, at para. 9.

[37] Some of the other actions brought against Ms. Demme make allegations of negligence. It is alleged that Ms. Demme failed to ensure that the plaintiffs’ personal and health information remained confidential and was not disclosed. It is also alleged that Ms. Demme was negligent in using the plaintiffs’ personal and health information for improper purposes.

[38] Ms. Demme argues that the allegation of negligence is a separate alternative claim and not derivative of the tort of intrusion upon seclusion. She takes the position that, based on the pleadings, there is at least a “mere possibility” that there could be a finding at trial that she is liable for negligent access of the plaintiffs’ medical records. At issue is whether there can be a negligent intrusion upon seclusion, or whether the allegations of negligence are wholly derivative of the tort of intrusion upon seclusion.

[39] The tort of intrusion upon seclusion is an intentional tort. To succeed, the plaintiff must establish that the defendant intentionally intruded upon the seclusion of another and that the intrusion would be highly offensive to a reasonable person. If the plaintiffs succeed, Ms. Demme must be presumed to have intended to injure them, given that the harm is the loss of the plaintiffs’ right to control their private information. The same facts that prove the tort of intrusion upon seclusion prove an intent to injure: see Scalera, at para. 53.

[40] Here, it is alleged that the plaintiffs were injured as a result of the intentional access of their private medical records. The claims in negligence are based on the same harm as the intentional act. If the plaintiffs succeed against Ms. Demme in the intrusion claims, then she must be presumed to have intended to injure the plaintiffs. If the plaintiffs do not establish the tort of intrusion upon seclusion, the plaintiffs’ actions will have no chance of success and there will be no possibility for a claim for indemnity under the Policy: see Scalera, at para. 53.

[41] It is my view that the claims in negligence are entirely derivative of the true nature of the claims, which is the intentional tort of intrusion upon seclusion.

e) Can any of the properly pleaded, non-derivative claims potentially trigger the insurer’s duty to defend?

[42] The non-derivative claims in the actions against Ms. Demme are for the tort of intrusion upon seclusion. HIROC’s duty to defend will be triggered if there is a “mere possibility” that this could fall within coverage. The HIROC Policy is an occurrence-based policy. Therefore, the claims could fall within coverage if the injuries or damages arose out of an accident and were neither expected nor intended from the standpoint of the insured. The onus is on Ms. Demme to prove that the injuries alleged were caused by an occurrence and that she did not expect or intend the injuries to the plaintiffs.

[43] Ms. Demme takes the position that, although she intended to access the ADU to obtain Percocet tablets, she did not realize the risk of injury to the plaintiffs and did not intend or expect the specific damage that resulted. She states that where there is no intention to cause the damage that resulted, the loss is caused by an occurrence and therefore falls within the insuring agreement: see University of Western Ontario (Board of Governors) v. Yanush (1988), 1988 4588 (ON SC), 67 O.R. (2d) 525 (H.C.).

[44] Ms. Demme relies on Oliveira v. Aviva Canada Inc., 2017 ONSC 6161, 139 O.R. (3d) 618, aff’d 2018 ONCA 321, in support of her position that the claim of intrusion upon seclusion falls within the insuring agreement. In Oliveira, the plaintiff, J.L., was admitted to the Norfolk General Hospital as a result of post-partum psychosis. It was determined that Ms. Oliveira, a nurse at the hospital, repeatedly accessed J.L.’s records even though she was not involved in J.L.’s care. J.L. alleged that this was a breach of her privacy and pleaded the tort of intrusion upon seclusion. Aviva had issued a policy to the hospital that provided coverage for civil proceedings alleging damages because of bodily injury or personal injury. Personal injury was defined in the policy to include “invasion of privacy, invasion or violation of the right to privacy”: Oliveira, at para. 9. The complete policy wording is not set out in the decision. It is not clear from the decision whether it was a claims-based policy, which would be triggered by a proceeding that alleges bodily injury or personal injury, or an occurrence-based policy, which would be triggered by bodily injury or personal injury arising out of an occurrence.

[45] In Oliveira, the insurer took the position that it provides coverage for employees of the hospital only when they are acting under the direction of the hospital. The insurer argued that Ms. Oliveira was not acting under the direction of the hospital when she accessed J.L.’s records. The court found that at the time the records were accessed, Ms. Oliveira was subject to the direction of the hospital and therefore she was an insured and entitled to a defence to the claims for intrusion upon seclusion. The court did not address whether the damages claimed arose out of an occurrence. The court also did not address the intentional act or criminal act exclusions.

[46] Here, HIROC does not deny that Ms. Demme was in the course of her employment or under the direction of the Hospital at the time the medical records were accessed. HIROC instead takes the position that the injuries alleged by the plaintiffs were expected or intended on the part of Ms. Demme and therefore did not arise out of an occurrence. Oliveira does not address the issue of whether the alleged injuries arose out of an occurrence. That decision dealt with whether the nurse was acting under the direction of the hospital when she was on duty. This is not an issue on the motion before me.

[47] HIROC argues that the injuries alleged by the plaintiffs were not caused by an occurrence. The plaintiffs allege that they sustained injury from Ms. Demme’s intrusion upon their seclusion. The injury occurred when each plaintiff lost control over their personal information. HIROC states that proof of the intention to access the records is proof of the intention to cause the injury, and therefore the injuries arising out of the intrusions upon seclusion were not caused by an occurrence.

[48] I am of the view that the injuries alleged by the plaintiffs do not arise out of an occurrence and, as a result, the claims do not fall within the insuring agreement. It is alleged that Ms. Demme accessed private patient records and thereby committed the tort of intrusion upon seclusion. The tort requires an intention to access private patient records. Once the records are accessed, there is injury to the patients because of the loss of control over their private information. Therefore, the intention to access the records is an intention to cause injury.

[49] I conclude that the non-derivative claims of intrusion upon seclusion did not result in injuries that were unexpected or unintended on the part of Ms. Demme. Therefore, these are not injuries caused by an occurrence. The claims do not fall within the insuring agreement and there is no duty on HIROC to defend Ms. Demme. I am satisfied that, based on the allegations set out in the claims, there is no “possibility” that the claims against Ms. Demme for the tort of intrusion upon seclusion could fall within the insuring agreement.

4) Are the claims excluded by the intentional act and/or criminal act exclusions?

[50] I conclude that the claims against Ms. Demme do not fall within the insuring agreement and therefore there is no coverage pursuant to the Policy. Had I found the claims fell within the insuring agreement, I would have concluded that they were excluded pursuant to the intentional act and criminal act exclusions.

[51] The onus is on the insurer to establish that an exclusion applies. I am satisfied that HIROC fulfilled its onus.

a) Intentional act exclusion

[52] The intentional act exclusion applies if the insured intended the harm that resulted. Ms. Demme argues that she did not intend to cause harm to the patients whose records she accessed. She states that she accessed the records only for the purpose of obtaining narcotics and that the access to private information was an unintended consequence.

[53] Ms. Demme takes the position that there is at least a “mere possibility” that she could be found to have not intended the injury that resulted. She takes the position that the issues of the unforeseen consequences of her actions and the intent to injure must be determined and therefore there is a duty to defend: see R.D.F. (Litigation Guardian of) v. Co-operators General Insurance Co., 2003 MBQB 190, 176 Man. R. (2d) 316), aff’d 2004 MBCA 156; Kaler v. Red River Valley Mutual Insurance Co. (1995), 1995 11044 (MB CA), 102 Man. R. (2d) 136 (C.A.).

[54] It is alleged in the Statements of Claim that Ms. Demme accessed patient records and committed the intentional tort of intrusion upon seclusion. The injury in a claim for intrusion upon seclusion is the loss of control over private information; as noted by Morgan, J., the access of the records is the injury. Therefore, if the plaintiffs establish the tort of intrusion upon seclusion, there will be a finding that Ms. Demme intended to cause the injuries and the intentional act exclusion will apply. If the plaintiffs do not prove intrusion upon seclusion, there will be no claim to be indemnified and therefore no duty to defend: see Scalera, at para. 53.

[55] The intentional act exclusion also applies if the insured commits a deliberate act that was the dominant cause of the plaintiff’s injuries and the injuries are foreseeable: see Buchanan v. GAN Canada Insurance Co. (2000), 2000 5756 (ON CA), 50 O.R. (3d) 89 (C.A.), at para. 14. If the tort is intended, it does not matter that the result is more harmful than the defendant should or could have foreseen: see Meadows v. Meloche Monnex Insurance Brokers Inc., 2010 ONCA 394, 102 O.R. (3d) 312, at para. 23.

[56] Here, it is alleged that Ms. Demme intentionally accessed patient records. The foreseeable consequence of this act is that she will see the patients’ private information. At that point, the patients lose the ability to control their private information and suffer an injury. The loss of control of their private information is the foreseeable and inevitable consequence of Ms. Demme’s intentional act.

[57] I conclude that the claims against Ms. Demme are excluded from the Policy pursuant to the intentional act exclusion.

b) Criminal act exclusion

[58] In the Stewart Action, in addition to the tort of intrusion upon seclusion, it is also alleged that Ms. Demme was an electronic thief and stole the plaintiff and class members’ data for her personal gain. In the other actions, it is alleged that Ms. Demme intentionally accessed medical records without lawful justification. In her defence to the Stewart Action, Ms. Demme pleads that she entered pleas of guilt to the criminal charges of theft under $5,000 and breach of trust in relation to her acquisition of Percocet from the Hospital.

[59] HIROC argues that coverage is excluded pursuant to the criminal act exclusion. Ms. Demme argues that she pled guilty only to the theft of the Percocet tablets. She did not plead guilty to any crime with respect to accessing the patients’ files. She takes the position that there is no causal link between the theft of the Percocet tablets and the injuries claimed by the plaintiffs. She further argues that, because of her addiction, she could not form the intent to commit a criminal act and therefore the criminal act exclusion does not apply.

i) Causal link between the criminal act and the plaintiffs’ alleged damages

[60] In the Statements of Claim, the plaintiffs do not allege that they sustained any injury as a result of the theft and sale of the Percocet. It is alleged that the plaintiffs sustained injuries as a result of Ms. Demme accessing their personal data without lawful justification. Ms. Demme argues that the pleadings do not allege a causal link between the criminal act of stealing the Percocet and the injuries to the plaintiffs.

[61] I am of the view that the causal link between the theft of the Percocet tablets and the intrusion upon seclusion is set out in the Statement of Claim in the Stewart Action. Paragraph 15 of the claim provides as follows:

The intrusions upon seclusion in issue occurred at least hundreds, and possibly thousands of times and were committed by Demme for the purpose of obtaining illicit access to the narcotic drug, Percocet, which she was both selling on the street for a profit and consuming herself.

[62] Similar allegations are made in the Statements of Claim issued in the other actions.

[63] The criminal act exclusion applies to injuries arising out of the performance of a criminal act. It is conceded that Ms. Demme stole the Percocet tablets. To steal the tablets, it was necessary for her to access the patient files. The access to the patient files was a necessary and integral part of the performance of the criminal act of theft. As noted by Morgan, J. in Stewart, at para. 7:

At issue in the Plaintiff’s claim is not the theft of medication by Ms. Demme but rather the methodology of that theft. She accomplished her acquisition of drugs by misusing her position as a nurse at the Hospital to access medical files of patients at the Hospital. Her modus operandi was to access without authorization and use patient information in order to dispense Percocet pills which she then took herself.

[64] It is my view that there is a direct causal link between the theft of the Percocet tablets and Ms. Demme’s access of the medical files. It is alleged that Ms. Demme intentionally accessed the patient records for the purpose of stealing Percocet tablets. Accessing the patient records was part and parcel of the theft of the medication and arose out of the performance of a criminal act: see Belair Direct v. Penny Moar Shoup et al., 2012 44957 (Ont. S.C.), at para. 16.

ii) No criminal intent

[65] Ms. Demme argues that her capacity to commit a criminal act or formulate an intention was affected by her drug addiction; she could not form the criminal intent to commit a crime. She also argues that the criminal defence of automatism may apply and that there is at least a “mere possibility” that a court could find that her drug-induced behaviour did not result in criminal intent.

[66] The criminal act exclusion does not require a criminal conviction or criminal intent. The exclusion provides that injury arising out of the performance of a criminal act is not covered by the Policy. An intention to cause the injury is not included in the wording of the exclusion. As noted by the Court of Appeal in Eichmanis v. Wawanesa Mutual Insurance Company, 2007 ONCA 92, 84 O.R. (3d) 668, leave to appeal refused, [2007] S.C.C.A. No. 178, at para. 27:

In my view, the law on the criminal act exclusion is correctly stated in the following passages in C. Brown, Insurance Law in Canada, loose-leaf, 4th ed. (Toronto: Carswell, 2002), at 18-181 to 18-182:

Some policies exclude claims arising from injury or damage “caused by any intentional or criminal act or failure by any person insured by this policy”. It is a necessary requirement under such policy wording that the criminal act caused the loss. If it did not, the exclusion will not apply.

The exclusion applies even without proof of intention to cause the injury or damage, so long as the act or omission that causes the harm is criminal in nature. This is especially important in certain criminal offences where mens rea or criminal intent is not an element of the offence, such as criminal negligence, and of certain criminal failures to act, such as failure to provide the necessaries of life and neglect to obtain assistance in child-birth.

A criminal conviction is not required by the exclusion. If there is a conviction, it is prima facie proof of the fact.

The exclusion applies to injury “caused by any intentional or criminal act”. A number of courts have held that this exclusion is clear and unambiguous. Intention is not a required element of the criminal act for at least two reasons. First, the word “or” is disjunctive: the word “intentional” does not modify “criminal”. The second reason is even more compelling. If the criminal act has to be intentional, there would be no need to include the “criminal act” wording. The intentional act portion of the exclusion would apply, and the “criminal act” wording would be rendered superfluous. An insurance contract is not to be interpreted so as to render terms meaningless. [Emphasis Added.]

[67] Ms. Demme relies on two cases of the New Brunswick Court of Appeal in support of her position that the criminal act exclusion does not exclude coverage: Gamblin v. O’Donnell, 2001 NBCA 109, 244 N.B.R. (2d) 102 and Optimum Insurance Company Inc. v. Donovan, 2009 NBCA 6, 340 N.B.R. (2d) 45. It is my view that these decisions do not apply to the circumstances of this case. Here, the criminal act is the theft of the Percocet tablets. This is not a crime that includes a negligence component, such as the negligent use of a firearm or criminal negligence. As a result, there cannot be a finding that the injury arose out of negligence and not the criminal act.

[68] I am of the view that neither a criminal charge nor a criminal conviction is required for the criminal act exclusion to apply. The exclusion does not state that the insured must be charged and convicted of a crime. The exclusion also does not provide that the insured must have had the criminal intent to commit a crime. Here, it is alleged that Ms. Demme committed theft of the Percocet tablets. The exclusion applies to all damages arising out of the performance of that criminal act, regardless of whether Ms. Demme had the criminal intent to steal the Percocet.

[69] I conclude that the claims against Ms. Demme are excluded from coverage pursuant to the criminal act exclusion.

5) Does a finding of no coverage for intrusion upon seclusion nullify all privacy claim coverage?

[70] Ms. Demme takes the position that if the tort of intrusion upon seclusion is not covered by the HIROC policy, the result is a nullification of the privacy claim coverage. She notes that breach of privacy is specifically included in the expanded definition of bodily injury and, therefore, the parties must have intended that there would be coverage in actions in which a breach of privacy is alleged. Ms. Demme argues that courts should avoid interpretations of policies that substantially nullify coverage: see Consolidated Bathurst Export Ltd. v. Mutual Boiler & Machinery Insurance Co., 1979 10 (SCC), [1980] 1 S.C.R. 888, at para. 27. HIROC argues that the Policy provides coverage for breaches of privacy but does not provide coverage for breaches of privacy that result in injury that is expected or intended on the part of the insured.

[71] As noted in Oliveira, legal liability for breach of privacy includes public disclosure of embarrassing facts about the plaintiff, publicity that places the plaintiff in a false light in the public eye, appropriation of the plaintiff’s name and likeness and intrusion upon seclusion: see Oliveira at para. 16. Intrusion upon seclusion is, by definition, an intentional tort that requires an intention to access private information. Other privacy torts do not necessarily include an element of intentionality. One could imagine a wide range of claims for a breach of privacy that was not intentional, including a negligent release of private information, improper faxing of private information, incorrectly sent e-mails, erroneous attachments to correspondence or e-mail, loss of medical records, records improperly disposed of and negligent storage of records. Those claims for negligent privacy breaches would fall within the insuring agreement of the Policy.

[72] I am satisfied that the finding that there is no coverage for the claims for intrusion upon seclusion does not nullify all privacy coverage under the Policy.

Conclusions

[73] The insurer has a duty to defend if there is a “mere possibility” that the claims as pleaded fall within the Policy wording. I am of the view that there is no possibility of coverage for Ms. Demme. It is alleged in the claims that she intentionally accessed patients’ personal medical data and is liable pursuant to the tort of intrusion upon seclusion. The tort of intrusion upon seclusion results in an injury to patients whose records are accessed because there is a loss of control over their personal information. The injury is the access. As a result, an intention to access the records is an intention to injure the patients. I conclude that the intentional tort of intrusion upon seclusion is not covered under the occurrence-based policy issued by HIROC.

[74] I am satisfied that the claims as pleaded against Ms. Demme do not fall within the insuring agreement of the policy because the damages claimed were not caused by an occurrence. Even if I had found that the claims fell within the insuring agreement, they would be excluded on the basis that Ms. Demme intended or expected the damages that resulted from her actions, and that the injuries to the plaintiffs arose out of the performance of a criminal act.

DISPOSITION

[75] The motion brought by Ms. Demme for an order that HIROC is under a duty to defend is dismissed.

[76] HIROC is successful on the motion and is presumptively entitled to its costs. If the parties cannot come to an agreement as to costs, HIROC may file written submissions of no more than 3 pages in length, excluding bill of costs and caselaw within 21 days of the date of this endorsement. Ms. Demme may file her written submissions in response on the same basis within 21 days of receiving HIROC’s cost submissions.

DATE: MARCH 10, 2021