Privacy law in Canada moves slowly. Even though there has been a sharp increase in class actions over the past few years, these cases tend to settle, resulting in little case law. A.T. v. Globe24h.com, published by the Federal Court just over a month ago, arguably moves the needle a little bit by becoming the first decision resulting in an order under the Personal Information Protection and Electronic Documents Act against a business with no physical presence in Canada. However, there is nothing really surprising or groundbreaking in this decision.

Globe24h.com was a Romanian-based website (as of today, it appears to no longer be online) that republished Canadian court and tribunal decisions found on other websites, then charged concerned individuals exorbitant prices to remove their personal information. Case law has been published online in Canada for several years by courts, tribunals and sites like the Canadian Legal Information Institute. These sites apply the robots exclusion standard to prevent indexing by search engines, so that the contents of court and tribunal decisions will not appear in search engine results. This provides litigants with a bit of practical obscurity for what can be extremely sensitive personal information, while at the same time recognizing the importance of the open courts principle.

Globe24h allowed its site to be indexed, exposing all personal information to search engines. This resulted in dozens of complaints to the Office of the Privacy Commissioner, which found that Globe24h’s activities violated PIPEDA. Globe24h initially responded to the commissioner’s investigation and removed some personal information from its site, but later refused to cooperate at all. Because the commissioner cannot make orders, one complainant applied to the Federal Court and obtained: a declaration that Globe24h had violated PIPEDA; an order requiring Globe24h to remove Canadian cases containing personal information from its site; and, an order for $5,000 in damages.

The Federal Court decision, which is aligned with the commissioner’s findings on virtually all points, is mostly common sense. Despite having no physical presence in Canada, the court nonetheless determined that Globe24h had a “real and substantial connection to Canada” because the site collected information about Canadians, collected it from Canadian sources, and directly affected the privacy of Canadians. PIPEDA was therefore found to apply, which should come as no surprise, as the Federal Court came to the same conclusion on similar facts ten years ago.

As expected, the court also agreed with the commissioner that Globe24h was engaged in commercial activity and did not publish court and tribunal decisions for exclusively “journalistic” purposes, which would have excluded its activities from PIPEDA. Although there remains little guidance on the scope of this exclusion, the journalistic purpose argument in this case was very weak. The court stated as follows: “the respondent adds no value to the publication by way of commentary, additional information or analysis. He exploits the content by demanding payment for its removal.”

To summarize, the court found that PIPEDA applied to Globe24h because it had a real and substantial connection to Canada, and it was collecting, using and disclosing personal information in the course of commercial activity. Further, there were no exceptions that would allow Globe24h to collect and use personal information without consent.

The court then took the logical next step of ordering Globe24h to change its practices to comply with PIPEDA. Specifically, the court ordered that Globe24h “shall remove all Canadian court and tribunal decisions containing personal information from Globe24h.com and take the necessary steps to remove these decisions from search engines caches.” Again, this is the first time an order has been made under PIPEDA against a foreign company with no physical presence in Canada.

There has been quite a bit of commentary on this case, much of which emphasizes the extraterritorial impacts, some going so far as to suggest that it has opened the door for a “right to be forgotten” in Canada. However, I think its significance may have been overstated.

First, while courts have historically exercised caution in making orders against foreign persons — particularly where it is unlikely that they can be enforced — it is hardly an extraordinary remedy in this case given: a) the clear violation of PIPEDA; and b) the explicit authority under PIPEDA to “order an organization to correct its practices.” In my view, it would seem odd if the court went so far as to find Globe24h non-compliant, then refused to make an order. This is nothing like, for example, ordering Google to block a website from appearing in it search results anywhere in the world to protect a Canadian company from intellectual property infringement, as the British Columbia Court of Appeal recently did (a controversial case that was recently heard by the Supreme Court on appeal).

Second, I do not think a case with such simple and straightforward facts offers any meaningful insight on the extremely complex question of whether there is (or should be) a right to be forgotten in Canada; e.g., a right to ask search engines to remove links to information that is inadequate, irrelevant, or no longer relevant. A.T. v. Globe24h.com should be taken for what it is: an acknowledgement that the Federal Court can make orders against non-Canadian companies that flagrantly violate PIPEDA by exploiting personal information about Canadians for financial gain.