The Extra-Territorial Reach of PIPEDA: T. (A.) v. Globe24h.com

Practical Law Canada Legal Update w-005-9407 (Approx. 6 pages)

The Extra-Territorial Reach of PIPEDA: T. (A.) v. Globe24h.com

by Practical Law Canada Commercial Transactions

Background

Canadian court and tribunal decisions are published on various Canadian legal websites including judicial and administrative tribunal sites. These websites generally follow the Canadian Judicial Council's Model Policy for Access to Court Records in Canada, Canadian Judicial Council, September, 2005 which discourages indexing of decisions published online. Globe24h.com, a Romanian based website which republished a significant number of Canadian decisions, permitted these to be indexed and located by search engines such as Google. Such indexing meant that highly sensitive personal information ranging from divorce and immigration issues to personal bankruptcies and health particulars could be easily searched by anyone using a basic search engine. The Federal Court in T. (A.) v. Globe24h.com, 2017 CarswellNat 184 (F.C.),ordered removal of all Canadian decisions containing personal information from Globe24h.com and any further copying and republishing of such Canadian decisions, along with damages of $5000. This case confirmed that the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA), applies to foreign based organizations where there is a "real and substantial connection" and that Canadian privacy rights will be enforced by the courts across borders.8

Facts

Globe24h, a Romanian-based website with its website operator and server located in Romania, republishes public documents from a number of countries including Canada. Globe24h republished a significant number of Canadian decisions containing sensitive personal information which were allowed to be indexed and thereby easily searchable using any search engine. When complainants contacted Globe24h requesting removal of their personal information, Globe24h demanded fees for such removal of their personal information including additional fees for removing variations or translations of the same material. Complainants were advised that free removal could take six months or more. The Office of the Privacy Commissioner of Canada (OPCC) requested that Globe24h remove complainant personal information and while Globe24h initiated compliance, it ultimately refused to comply. The Romanian equivalent of the OPCC fined Globe24h for contravening data protection laws which Globe24h appealed and at the time of the court's decision, such proceedings were ongoing.

The principal remedies sought by the parties, including the OPCC were:

A declaration that Globe24h contravened PIPEDA by disclosing personal information contained in Canadian decisions without consent.
Removal of the Canadian decisions containing the personal information from the Globe24h.com site along with steps for removal of these from search engine caches.
The owner refraining from any further publication of Canadian decisions containing personal information.

The Court's Deliberations and Findings

The Court considered the following four principle issues:

Does PIPEDA Have Extraterritorial Application?

The court noted that PIPEDA is silent with respect to the statute's extra-territorial reach and in the absence of such provisions in the statute, the court interprets the statute to apply where there is a "real and substantial link" to Canada, in keeping with applicable jurisprudence.

The court identified the underlying question as determining whether there is a sufficient connection between the country in question and Canada to apply its law consistent with: the principles of fairness and international comity.

The court determined there was a sufficient connection between Globe24h, a foreign organization and Canada using the test in Lawson v. Accusearch Inc. 2007 CarswellNat 247 (F.C.) consisting of:

The location of the target audience.
The source of the content on the website.
The location of the website operator.
The location of the server.

While Globe24h's website operator and server were in Romania, the court cited that the courts found these to not be determinative given that the nature of telecommunications is that it is not in one place.

The court found:

The content was Canadian and targeted Canadians specifically through advertising.
A majority of its users were Canadian.
The impact of the website was felt by the Canadian public.

With respect to comity, the court found that its judgement would not offend the principle of comity but rather that the Federal Court's findings would be complementary to any further action taken by the Romanian court.

Is the Collection, Use and Disclosure of Personal Information Appropriate?

In assessing whether the collection, use and disclosure of personal information was appropriate, the court applied the test from Turner v. Telus Communications Inc., 2005 CarswellNat 3954 (F.C.) of whether:

The collection was for a bona fide business interest.
The loss of privacy was proportional to any benefit to be gained.

The court found that a reasonable person would not consider there to be a bona fide business interest in this case. The court considered the balance between the open courts principle and the increased access to decisions that would compromise the privacy and security of judicial participants. The court assessed that the publishing of indexed decisions by Globe24h resulted in the "needless exposure of sensitive personal information".

Is the Publicly Available Exception Applicable to the Republication of Decisions by Globe24h?

The court looked to the regulations in interpreting the "publicly available" exception under section 7 of PIPEDA and found that while the decisions republished by Globe24h may be considered publicly available, the republication did not relate directly to the purpose for which the personal information appears in the decisions.

What Are the Appropriate Remedies Under Section 16 of PIPEDA?

The court remarked that while the jurisprudence states that the court must grant remedies that have an international impact with restraint, where there is a real and substantial connection between the organization and Canada, extraterritorial orders are granted.

The court declared that the owner of Globe24h contravened PIPEDA in collecting, using and disclosing personal information for inappropriate purposes and without consent. The court ordered removal of all Canadian decisions containing personal information from Globe24h.com including taking steps for removal from search engine caching and any further copying and republishing of such Canadian decisions, along with damages of $5000.

Significance of the Decision on Privacy and Jurisdiction for Counsel to Consider

Privacy law has extra-territorial application where there is a real and substantial connection between the foreign organization and Canada and a physical presence is not required. This case confirms for counsel advising on the application of PIPEDA that the jurisprudence recognizes that a physical presence or actually doing business in Canada is not required to establish a real and substantial connection in the context of e-commerce.
Allowing indexing of personal information for search engines will have an impact on privacy. In reviewing the Canadian "open courts principle" the court emphasised the distinction of the availability of sensitive personal information on websites generally, from being published and indexed by search engines, which becomes searchable in a casual web search.
The court's remedy is seen as a strong recognition of the importance of enforcing the right to privacy across borders, in keeping with what has been termed the "right to be forgotten" in similar European cases and lengthening the reach of privacy legislation across borders. The court issued its declaration and order, recognizing that the order would allow complainants to submit these to Google and search engines to show that the content of the website had been declared unlawful.
A narrow construction of the "publicly available" exception under Section 7 of PIPEDA. Counsel should note that while the republished decisions on Globe24h's website were publicly available decisions from court, tribunal and other Canadian websites, the court found that the "publicly available" exception did not apply to Globe24h's purpose for republishing of the decisions, as it did not "relate directly" to the reason the personal information appeared in the decisions.
The court underscored the international jurisprudence in Internet cases that an order affecting other jurisdictions does not bar the court from making an order; as such orders having international ramifications are necessary in the context of Internet abuse cases. The court cited the recent important decision in Google Inc. v. Equustek Solutions Inc., 2016 CarswellBC 397 (S.C.C.) in support of this comment. In Equustek, the BC Supreme Court granted an interlocutory order which required Google to refrain from indexing certain infringing websites in an intellectual property case. This case, once released, may provide further insight for counsel advising on the courts' jurisdiction in Internet cases.

The Extra-Territorial Reach of PIPEDA: T. (A.) v. Globe24h.com | Practical Law