The Global Reach of Canadian Privacy Law

Federal Court Issues Landmark Ruling in Globe24h

^{[A downloadable PDF of this update is available below]}

By Alex Cameron, Toronto and Claire Feltrin, Toronto

On January 30th 2017, the Federal Court released a landmark decision in A.T. v. Globe24h.com (PDF). This decision established that the Personal Information Protection and Electronic Documents Act (“PIPEDA”) applies to activities carried out abroad that have an impact on persons resident in Canada, and that Canadian courts can assume jurisdiction to make extra­ territorial orders against foreign entities.

The Federal Court ordered a Romanian website operator to remove all documents containing the personal information of Canadian citizens from its website, as well as from search engine caches. This decision will potentially have far­reaching implications for those engaged in disputes involving illegal conduct on the internet, including in relation to defamation, intellectual property infringement, and personal information.

Facts

As described in the decision, Globe24h.com is a website hosted and operated in Romania, which systematically republishes public documents, including Canadian court and tribunal decisions containing personal information. Globe24h.com then makes a profit by charging fees to remove this information from its website.

The applicant was a Canadian citizen whose personal information in a decision was republished on Globe24h.com, and as a result, also appeared on third party search engines such as Google.

The Office of the Privacy Commissioner of Canada (“OPC”) had received over 40 complaints from Canadians in relation to Globe24h.com over the last few years. The complainants alleged that decisions posted on the site contained sensitive personal information in relation to personal matters such as divorce proceedings, immigration, health matters, and personal bankruptcies. Although the complainants recognized that these decisions would be published online in specialized legal databases like CanLII (which is not indexed by search engines), Globe24h.com’s republishing of the decisions meant that the decision would appear as a result of casual internet searches of litigants’ names.

The issues at play in this case were: a) whether PIPEDA can apply to activities carried out abroad that nonetheless have an impact on Canada residents; b) whether Globe24h.com’s purpose for collecting, using, and disclosing personal information was “appropriate” under paragraph 5(3) of PIPEDA; and c) what remedies a Canadian court could order in the circumstances.

The Decision

a)PIPEDA has extra­territorial application where there is a “real and substantial link” to Canada

The Court rejected Globe2h4.com’s argument that PIPEDA did not have extra­territorial application because the activities were conducted from a foreign website. In doing so, the Court examined the statute’s jurisdictional provisions, finding that although section 4 of PIPEDA is silent with respect to the statute’s territorial reach, the absence of clear statutory guidance allows the Court to interpret PIPEDA as applying in all circumstances in which there exists a “real and substantial link” to Canada.

Following the Supreme Court of Canada’s decision in Society of Composers, Authors and Music Publishers of Canada v. Canadian Assn. of Internet Providers (PDF), the Federal Court considered the following “connecting factors” in finding that there was sufficient connection between Canada and the activity in question for the Court to apply PIPEDA consistent with the principles of order and fairness and international comity:

• the content at issue involved Canadian court and tribunal decisions containing personal information which was copied by the respondent from Canadian legal websites;
• the website directly targeted Canadians by specifically advertising that it provided access to “Canadian Caselaw” and the majority of Globe24h.com’s visitors were from Canada; and
• the impact of the website was felt by members of the Canadian public, including distress, embarrassment and reputational harm due to the republishing of personal information and making it accessible via third party internet search engines.

Finally, the Court noted that its legitimate judicial acts in this case would not offend the principle of comity, as Romanian authorities had cooperated with the OPC investigation. It was also noted that Romanian officials had taken independent action to curtail the respondent’s activities by imposing a fine for the contravention of Romanian data protection laws, which Globe24.com had violated by charging a fee for the removal of personal information.

b) Globe24h.com’s purpose for collecting, using, and disclosing personal information was not appropriate under PIPEDA and was not exclusively “journalistic” in nature

After determining that PIPEDA applied, the Court turned to the question of whether Globe24h.com had in fact violated PIPEDA by collecting, using and disclosing personal information for an improper purpose contrary to subsection 5(3). Here, the Court engaged in a balancing exercise, noting that the open courts principle and importance of online access to court records must be weighed against the privacy and security interests of participants in judicial proceedings. In concluding that the respondent’s conduct resulted in the unnecessary exposure of sensitive personal information of participants in the justice system via search engines, the Court explicitly noted that websites such as CanLII ensure that Canadian court decisions are not indexed by search engines.

The respondent was also unsuccessful in advancing its defences. First, the Court found that the purpose underlying Globe24h.com’s republishing of Canadian court decisions was not exclusively journalistic in nature. Rather, the respondent’s purpose was to incentivize individuals to pay to have their sensitive personal information removed from the website, thereby generating revenue.

Second, the Court found that the ‘publicly available’ exception under PIPEDA did not apply to the personal information published on Globe24h.com, since the purposes of republishing decisions did not “relate directly” to the purpose for which the personal information appears in the decisions (i.e. the open courts principle).

c) A Canadian court may grant a corrective order to force the operator of a foreign website to remove documents containing personal information from a website and third party search engines

Although the Court emphasized that courts must generally exercise some restraint in granting remedies that carry international ramifications, it granted declaratory relief that Globe24h.com had contravened PIPEDA (and $5,000 in damages), as well as a corrective order that Globe24h.com remove all Canadian court and tribunal decisions containing personal information from the website and to take necessary steps to remove these decisions from search engine caches.

In doing so, the Court followed the recent decision of Equustek Solutions Inc. v. Google Inc., finding that because personal jurisdiction over the respondent had been established, the Court could make an order with extra­territorial effects without being concerned about the effects of the order on activities in other jurisdictions (see our analysis of Equustek in another bulletin here [1]). Notably, the Equustek case was heard by the Supreme Court of Canada in December 2016 and is currently under reserve.

Implications of the Decision

A.T. v. Globe24h.com is expected to have widespread implications. In particular, the Court made an important finding that in determining whether a real and substantial link to Canada exists, the fact that the only “connection” between Canada and the conduct in question is electronic is not a bar to a Canadian court assuming jurisdiction over a dispute. With the global reach of the internet and ease with which information may now be disseminated, this decision therefore may provide corporations and individuals with an effective avenue to pursue foreign­based entities and enforce their rights with respect to disputes involving illegal, defamatory or malicious online activity originating abroad.

In terms of relief, plaintiffs may be able to secure judicial orders not only to remove sensitive personal information or defamatory comments from foreign websites, but also from third party search engines, such as Google. Although the enforceability of judgments against foreign parties can pose various challenges, we may see Canadian courts beginning to issue more corrective orders in the future as a practical method of mitigating harm caused by foreign entities with respect to the privacy rights of Canadians. Foreign businesses would therefore be well­advised to ensure compliance with PIPEDA insofar as they are dealing with the personal information of Canadians and are otherwise subject to the legislation.

Finally, it will be important to watch for the Supreme Court of Canada’s decision in the Equustek case mentioned above, particularly on the issue of extra­territorial orders by Canadian courts. This case was heard in December 2016, and, with the Globe24h case, may carry the potential to introduce in Canada a right similar to the “right to be forgotten” [2] which has emerged in the EU.

1. B.C. Court of Appeal Decision Prohibits Google from Delivering Offending Search Results

2. Factsheet on the “Right to be Forgotten” ruling (PDF)

acameron@fasken.com    cfeltrin@fasken.com

http://www.fasken.com

© 2017 Fasken Martineau DuMoulin LLP