Privacy Tracker | Globe24h PIPEDA ruling should be no surprise Related reading: Privacy Bar attendees meet George Jepsen

rss_feed
PrivacyTraining_ad300x250.Promo1-01
OneTrust_Square Banner_300x250_DD_ROS_01_19
PrivacyCore_ad_300x250-01

Privacy law in Canada moves slowly. Even though there has been a sharp increase in class actions over the past few years, these cases tend to settle, resulting in little case law. A.T. v. Globe24h.com, published by the Federal Court just over a month ago, arguably moves the needle a little bit by becoming the first decision resulting in an order under the Personal Information Protection and Electronic Documents Act against a business with no physical presence in Canada. However, there is nothing really surprising or groundbreaking in this decision.

Globe24h.com was a Romanian-based website (as of today, it appears to no longer be online) that republished Canadian court and tribunal decisions found on other websites, then charged concerned individuals exorbitant prices to remove their personal information. Case law has been published online in Canada for several years by courts, tribunals and sites like the Canadian Legal Information Institute. These sites apply the robots exclusion standard to prevent indexing by search engines, so that the contents of court and tribunal decisions will not appear in search engine results. This provides litigants with a bit of practical obscurity for what can be extremely sensitive personal information, while at the same time recognizing the importance of the open courts principle.

Globe24h allowed its site to be indexed, exposing all personal information to search engines. This resulted in dozens of complaints to the Office of the Privacy Commissioner, which found that Globe24h’s activities violated PIPEDA. Globe24h initially responded to the commissioner’s investigation and removed some personal information from its site, but later refused to cooperate at all. Because the commissioner cannot make orders, one complainant applied to the Federal Court and obtained: a declaration that Globe24h had violated PIPEDA; an order requiring Globe24h to remove Canadian cases containing personal information from its site; and, an order for $5,000 in damages.

The Federal Court decision, which is aligned with the commissioner’s findings on virtually all points, is mostly common sense. Despite having no physical presence in Canada, the court nonetheless determined that Globe24h had a “real and substantial connection to Canada” because the site collected information about Canadians, collected it from Canadian sources, and directly affected the privacy of Canadians. PIPEDA was therefore found to apply, which should come as no surprise, as the Federal Court came to the same conclusion on similar facts ten years ago.

As expected, the court also agreed with the commissioner that Globe24h was engaged in commercial activity and did not publish court and tribunal decisions for exclusively “journalistic” purposes, which would have excluded its activities from PIPEDA. Although there remains little guidance on the scope of this exclusion, the journalistic purpose argument in this case was very weak. The court stated as follows: “the respondent adds no value to the publication by way of commentary, additional information or analysis. He exploits the content by demanding payment for its removal.”

To summarize, the court found that PIPEDA applied to Globe24h because it had a real and substantial connection to Canada, and it was collecting, using and disclosing personal information in the course of commercial activity. Further, there were no exceptions that would allow Globe24h to collect and use personal information without consent.

The court then took the logical next step of ordering Globe24h to change its practices to comply with PIPEDA. Specifically, the court ordered that Globe24h “shall remove all Canadian court and tribunal decisions containing personal information from Globe24h.com and take the necessary steps to remove these decisions from search engines caches.” Again, this is the first time an order has been made under PIPEDA against a foreign company with no physical presence in Canada.

There has been quite a bit of commentary on this case, much of which emphasizes the extraterritorial impacts, some going so far as to suggest that it has opened the door for a “right to be forgotten” in Canada. However, I think its significance may have been overstated.

First, while courts have historically exercised caution in making orders against foreign persons — particularly where it is unlikely that they can be enforced — it is hardly an extraordinary remedy in this case given: a) the clear violation of PIPEDA; and b) the explicit authority under PIPEDA to “order an organization to correct its practices.” In my view, it would seem odd if the court went so far as to find Globe24h non-compliant, then refused to make an order. This is nothing like, for example, ordering Google to block a website from appearing in it search results anywhere in the world to protect a Canadian company from intellectual property infringement, as the British Columbia Court of Appeal recently did (a controversial case that was recently heard by the Supreme Court on appeal).

Second, I do not think a case with such simple and straightforward facts offers any meaningful insight on the extremely complex question of whether there is (or should be) a right to be forgotten in Canada; e.g., a right to ask search engines to remove links to information that is inadequate, irrelevant, or no longer relevant. A.T. v. Globe24h.com should be taken for what it is: an acknowledgement that the Federal Court can make orders against non-Canadian companies that flagrantly violate PIPEDA by exploiting personal information about Canadians for financial gain. 

3 Comments

If you want to comment on this post, you need to login.

  • comment Christopher Berzins • Mar 9, 2017
    Shaun,
    I fully agree with your analysis, especially with respect to the recognition of a right to be forgotten. There is nothing surprising with this outcome given the particular facts - this was simply an extortion racket that was clearly off-side PIPEDA. If anything, the OPC's earlier investigation report is potentially more illuminating in terms of a potential recognition of a right to be forgotten - it states very clearly that Canadians would not reasonably expect that court and tribunal decisions containing their personal information would be accessible through search engine queries. The real test will come when a complaint is made to the OPC against a search engine seeking to have such information removed from its search results or asking that a government body ensure that decisions containing personal information cannot be indexed by search engines. 
    Chris Berzins
  • comment Amalia Steiu • Mar 10, 2017
    It is very impressive what the OPC was able to achieve her. But I heard this story many times with no detail around what did the Romanian regulators do? This is a a EU country subject to very powerful privacy legislation. What were the steps taken by the Romanian regulators to support Canada. This goes to a much bigger question and something I have been trying to get an answer...from the OPC. What about protection of Canadian personal information in the US? If this is to set a precedent, how will such precedent support our rights as Canadian citizens in the US? What is our right of appeal in the US, under a similar circumstance? EU seems to have secured a modality - that's Privacy Shield.
  • comment David Fraser • Mar 10, 2017
    An additional reason to be cautious about relying on this case as a strong precedent for a finding of a "right to be forgotten" in Canada is that it was unopposed. There was nobody in court questioning any of the findings of the OPC, particularly in areas that might find a foothold in any future case such as freedom of expression, the appropriate remedy and the scope of the order.