Earlier this year, a Canadian trial court ruled that Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) has extra-territorial application and restricts the dissemination of personal information of Canadians, even where the information is already public, and even though it is made available from outside Canada.
In A.T. v. Globe24h.com et al., 2017 FC 114, the Federal Court applied PIPEDA expansively and granted declaratory and injunctive relief against a Romanian national operating a Romanian-based website. At issue was personal information about identifiable individuals contained in publicly available Canadian court decisions that Globe24h.com had copied and republished without consent from the individuals involved in the underlying cases. In many cases, those decisions involved immigration, labour, family law, and bankruptcy matters, and contained sensitive personal information about those involved. Globe24h.com allowed the republished decisions to be indexed by Google and other search engines. In consequence, the decisions appeared in Internet searches for the identifiable individuals’ names and provided notoriety to matters that would otherwise likely have gone unnoticed. Globe24h.com charged a fee to de-index the decisions and suppress the information.
After receiving numerous complaints from individuals, the Office of the Privacy Commissioner of Canada found the complaint well-founded and supported the applicant’s position before the Court. After concluding that the underlying dispute had a sufficient nexus with Canada to establish jurisdiction under Canadian conflict of law principles, the Court rejected Globe24h.com’s attempt to justify the dissemination of personal information on the basis that it was being done for journalistic purposes. The Court also found that the “publicly available” exception to PIPEDA did not apply to the personal information because Globe24h.com was not using the information for purposes directly related to the purpose for which the information appeared in the decisions.
In the final judgment, the Court:
- Declared that Globe24h.com was in violation of PIPEDA;
- Ordered Globe24h.com to remove any decisions containing personal information from its website and take all necessary steps to remove these decisions from search engine caches;
- Enjoined Globe24h.com from further copying or republishing Canadian court and tribunal decisions containing personal information; and
- Ordered Globe24h.com to pay the applicant CAD$5000 (approximately US$3800) in damages.
This decision underscores the broad application that Canadian courts will give to PIPEDA in order to prevent the use and dissemination of personal information of Canadians. While Globe24h.com’s scheme to profit from the misuse of personal information was particularly offensive, the implications of this decision extend beyond the particular facts. Companies, regardless of the jurisdiction in which they are operating, that possess personal information of Canadians can expect to have their use of that information scrutinized for compliance with PIPEDA.
To subscribe for updates from our Data Protection Report blog, visit the email sign-up page.