There was a huge, huge, huge (no really it was huge) internet law case that came out of the Federal Court about a month ago. “If it was so huge, why are you only writing about it now?” you are asking me. Shut up is why.
This case was so huge, so important, that all three of my internet law idols (yes I have internet law idols) – Barry Sookman, Eloïse Gratton, and Michael Geist – addressed it in the immediate aftermath of its release on January 30th. “So what took you so long?” you are asking me. I told you to. Shut. Up.
So the case is A.T. v. Globe24h.com. Catchy! It’s from the Federal Court, which has jurisdiction over… not a lot of things. Some federal laws, one of which is PIPEDA, the federal privacy and collection of personal information law that I hope you have heard of after 5 years of reading this blog. The facts of the case are actually pretty straightforward for a change. A.T., oh fuck I guess I have to explain why the Applicant is only written with letters. Oh fuck I guess I have to explain why he is called an Applicant and not a plaintiff. OK, not so simple!
A.T. is called A.T because:
At his request, and having considered the open court principle, the Court has agreed to substitute initials for his name to offer a measure of protection of his identity
As this case is about privacy (well, you’ll soon see why as it is about privacy, although you can guess that because it is about PIPEDA, a privacy law), it is understandable that the Court would do this (and we’ll come back to this). As for why A.T. is called an “Applicant” and not a “Plaintiff” like he would be in normal court, it is because the Federal Court is stupid. At least the Federal Court building in Montreal is gorgeous, unlike the normal court building which is a dump. OK OK, there is an explanation. You very rarely “sue” someone in Federal Court (and thus would be a plaintiff). You often make some sort of “application” under a law for the Court to make some sort of determination. In this case, an application was made under s. 14 of PIPEDA which says:
A complainant may, after receiving the Commissioner’s report… apply to the Court for a hearing in respect of any matter in respect of which the complaint was made
“apply to the Court” –> application –> Applicant. Simple! Globe24h.com and its operator are the “Respondents” because they, uh, responded to the application. Although technically in this case they didn’t respond they just ignored the whole thing and didn’t show up. Bad move!
OK back to those simple facts. There is this website, globe24h.com (dead now!) which is (was?) run out of Romania by a Mr. Radulescu. The servers were also in Romania. Note the Romanian part, it’s important. So the website republished a bunch of public documents, lots from Canada. Some of these public documents were court decisions. While the text of the court decisions on the original site and Globe24h was the same, there is a big difference between the way court decisions are published on sites like CanLII (the source of the decision in question) and what Globe24h was doing:
The difference between these other websites and Globe24h.com is that the respondent has permitted the decisions that are republished on his website to be located via third party search engines such as Google. Moreover, because decisions on Globe24h.com are indexed by search engines, a decision containing an individual’s name will generally appear in search results when the individual’s name is searched on such search engines.
So A.T. had a court decision that Google could discover if you searched his actual name, only because the decision was republished on Globe24h. And A.T. wasn’t alone! The Canadian Privacy Commissioner’s Office (the “OPCC”) had received a shitload of complaints (well, 49) about this site over the last three or four years, including from A.T. These complainants:
alleged that the decisions posted on Globe24h.com contained sensitive personal information about them and/or their family members in relation to personal matters such as divorce proceedings, immigration matters, health issues and personal bankruptcies
Who among us hasn’t had a personal bankruptcy or two? Globe24h said they could take down the posts if you complained to them, but it might take up to six months. Or you could pay a bunch of Euros and get it removed pretty quickly. Who among us hasn’t been subject to an extortion or two?
So A.T. had his name published on Globe24h as part of a Labour Relations Board matter he had with his employer. He contacted the site, they extorted him (well, attempted to) and he complained to the OPCC. The OPCC said you have a point, this is terrible! But since the OPCC doesn’t really do anything, they told A.T. he could apply (ha!) to the Federal Court for relief of some sort. So he did:
The essence of the applicant’s complaint is not with the publication of the decision by the Board but with the ease of accessing the information about his case through online search engines.
He also complained to the Romanian privacy authority. And to clear up the “A.T.” anonymity thingy, the Court writes:
The applicant advised this Court at the hearing that he and his family in Romania have received verbal threats for pursuing the complaint. For that reason, and because of his concern that the publication of this decision would again expose his personal information to public attention, the applicant requested that the Court order that his identity be protected.
Yikes. Anyway, A.T. complained to the OPCC, the OPCC made some findings that Globe24h was terrible in many ways. The OPCC asked the Respondent nicely to remove the personal information from the court decisions on Globe24h. They did for a while, but then later said blow me, those people should pay. The OPCC wrote a big fancy report that said the website was doing crappy things, and that PIPEDA applied to a Romanian website because it was using Canadian info (a “real and substantial connection” to Canada in lawyer-speak).
So A.T. asked the Court for a bunch of stuff. Monetary damages. An injunction to get the Board’s decision removed if it has personal info. A proclamation that the website is terrible and violates privacy laws. Also to have the decisions with private info be removed from search engine caches. The court had four questions it decided to answer, let’s take ’em one by one.
1. Does PIPEDA have an extraterritorial application to Globe24h.com as a foreign based organization?
Yes! Real and substantial connection dammit. That’s a fine traditional Canadian legal principle which applies here. We apply it to other laws (the Copyright Act, for example) we can apply it to PIPEDA. There are some factors we can look at (and the Court does). They are using Canadian content and targeting Canadian internet surfers. There is some other discussion which is good stuff for the future. A very reasoned analysis about why a Canadian law can have extra-territorial effects; very important in the wired world.
2. Is the respondent collecting, using and disclosing personal information in the course of ‘commercial activities’?
Yes! Advertisements and extortion are commercial. This is only important because PIPEDA (well, part of it) applies only in this circumstance. Moving on.
3. Are the respondent’s purposes exclusively ‘journalistic’ in nature?
No! This is important because it would be an exception that the part of PIPEDA that applied in number 2 wouldn’t apply. Suck it, Respondent. Moving on.
4. Is the respondent’s purpose for collecting, using and disclosing personal information “appropriate” under subsection 5(3) of PIPEDA?
So section 5(3) of PIPEDA says the following:
An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.
Man that is the most legal hedging bullshit provision you can write. “Reasonable” and “appropriate in the circumstances” are classic lawyer-speak. ANYWAY, uh, no. The Court says “I agree with the OPCC that a reasonable person would not consider the respondent to have a bona fide business interest.” Yeah, they are slime.
5. Does the “publicly available” exception apply to the personal information republished on Globe24h.com under section 7 of PIPEDA?
Wait, you said there were 4 questions! Yeah, I agree with you. The Court did a weird numbering / lettering thing here, even I am confused. ANYWAY, the section 7 is about if you are going to collect personal info without the person’s knowledge and consent, you gotta have a good reason. Extortion is not a good reason.
6. What remedies should this Court grant under section 16 of PIPEDA?
Man these “four” questions are starting to remind me of an “increasingly inaccurately named trilogy.” ANYWAY, the Court has some good stuff here, about what they can or cannot do under PIPEDA and under the circumstances. Justice Mosley is willing to do a lot of shit. Let’s pull some quotes:
I do not find that there is either a jurisdictional or a practical bar to granting a corrective order with extraterritorial effects
I agree that the circumstances of this case justify a broadly crafted corrective order
In this case, I am satisfied that a damages award would be appropriate based largely on the conduct of the respondent
So basically the judge goes ahead and does all of that. He says the Respondent violated PIPEDA; he awards the Applicant $5000 in damages; he orders that the Respondent never copy Canadian court decisions that have personal information again, and perhaps most importantly for purposes of our discussion he orders that:
The Respondent, Sebastian Radulescu, shall remove all Canadian court and tribunal decisions containing personal information from Globe24h.com and take the necessary steps to remove these decisions from search engines caches
Superterriffic happy funtime analysis hour discussion
So the discussion and commentary on this case has certainly been about the “right to be forgotten.” Let’s go back to my internet law idols and their post titles:
Sookman: “PIPEDA’s global extra-territorial jurisdiction and right to be forgotten: A.T. v. Globe24h.com”
Geist: “Did a Canadian Court Just Establish a New Right to be Forgotten?”
You may have forgotten the right to be forgotten. I wrote about it back in 2014 when it happened. In that case, the EU Court of Justice ordered Google to remove some search results based on the privacy rights of an individual. Read that again. The Court there “ordered Google”. That did not happen here. Here the court ordered the publisher of the info to remove it from his own site, and to have that person “take necessary steps” to remove it from search engine “caches”. That to me, is a huge fucking difference from ordering Google directly to remove search engine results. That would be a right to be forgotten. This is less than that. I could walk into court tomorrow and get a site operator to remove something if it violated some sort of law. That is not the right to be forgotten.
However, this decision is a big step in the right direction! The court recognizes that the internet should have plenty of extra-territorial application of Canadian laws. That is important, making an order against a Romanian website. As a practitioner, I am very happy that happened. It’s also good that the court shot down this extortion scheme; I have seen enough websites (*COUGH* *COUGH*) that do that every day.
As a practitioner, I get a lot of requests from people who want search results removed. I have to tell them that there is no “right to be forgotten” in Canada. This decision does not change that imho. NOW, this decision, in combination with a future Supreme Court of Canada decision in the Equustek case could mean a right to be forgotten in Canada. In Equustek, the issue is in fact directly ordering Google to remove its search engine results. Not in a privacy context but a trademark one. But combine the Supreme Court upholding the order for Google to remove results and this order that PIPEDA has extra-territorial application, then maybe you’ve got a right to be forgotten in Canada. Until then, fuggedaboutit.