Case Summary and Outcome

The Federal Court of Canada found a Romanian individual, Sebastian Radulescu, to be in breach of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) by operating a Romanian-based website that republished and indexed Canadian court and tribunal decisions. PIPEDA is a statute that is intended to safeguard the privacy of individuals through the protection of their personal data. In 2015, a Canadian-Romanian individual initiated an action against Mr. Radulescu for publishing a Labour Board decision concerning him. This decision had also been indexed by Mr. Radulescu so it could be easily found through a Google Search. It came to light that the website was operating a profit-making scheme through which it would ask individuals to pay a fee in exchange for removing their personal information from the decisions published on the site. The Federal Court held that the PIPEDA had extraterritorial application to the website. After finding that the website’s collection, use and disclosure of court decisions were not permissible under PIPEDA, the court issued a corrective order against the website, as well as declaratory relief and damages.

Facts

The Respondent, Sebastian Radulescu, was the operator of Globe24h.com, a Romanian-based website that republished Canadian court and tribunal decisions that could otherwise be accessed through legal databases such as CanLii. The difference between Globe24h.com and other legal websites was that decisions on Globe24h.com could be located through third-party search engines such as Google, whilst decisions on Canadian legal websites were generally not indexed in this way.

Between October 2013 and April 2016, the Office of the Privacy Commissioner of Canada (Privacy Commissioner) received around 49 complaints relating to Globe24h.com. The complainants alleged that decisions republished on the site contained personal information about them and/or family members in relation to personal matters (e.g. divorce proceedings, immigration matters, bankruptcies).

The Applicant, referred to as A.T. in the judgment, alleged that a decision from the Alberta Labour Board concerning labour relations with his former employer could be found on the site through a Google Search. He contended that the personal information in the decision would affect his future employment prospects. Before filing a complaint to the Privacy Commissioner, the Applicant directly contacted the Respondent demanding the removal of the decision. He was told by the Respondent that he would have to pay a fee to have the information removed from the website and deindexed. The Applicant’s complaint was not with publication of the decision by the Labour Board, but with the ease of accessing the information about his case through search engines. In June 2014, the Applicant filed a complaint to the Privacy Commissioner against Globe24h.com under the Personal Information Protection and Electronic Documents Act (PIPEDA), the legislation regulating the processing of personal data in Canada.

In May 2014, the Privacy Commissioner commenced its first investigation into Globe24h.com. During the investigation, the Respondent had acknowledged republishing decisions without knowledge or consent from the concerned individuals or the relevant courts and tribunals. The Respondent alleged that the website’s purpose was exclusively journalistic and the content was already publicly available. The Respondent also justified soliciting money from individuals in exchange for removing personal information from the site based on the need to limit the volume of anonymous requests received by email and to prevent fraudulent removal requests. During the course of the investigation, the Privacy Commissioner had found that the website displayed advertisements alongside the decisions and sold space on the website to advertisers. Following the investigation, the Privacy Commission concluded that the Applicant’s complaint against the Respondent was well-founded.

In October 2014, the Romanian authority overseeing data processing considered a complaint from the Applicant and fined the Respondent for contravening Romanian Data Protection law.

In July 2015, the Applicant filed an application before the Federal Court of Canada against the Respondent. The reliefs sought by the Applicant included damages, declaratory relief and an order obligating the Respondent to correct its practices in accordance with PIPEDA.

Decision Overview

Before establishing whether the Respondent had violated PIPEDA, the Federal Court of Canada (Court) first had to consider whether the statute could apply to activities abroad that have an impact on persons residing in Canada. While PIPEDA was silent on this issue, the Court drew on jurisprudence from the Supreme Court of Canada on the extraterritorial application of copyright laws. According to this jurisprudence, the operative question was whether there is a “real and substantial” connection between Canada and the activity in question. [para. 52] The Court reasoned that the relevant connecting factors for a foreign-based website include “(1) the location of the target audience of the website, (2) the source of the content on the website, (3) the location of the website operator, and (4) the location of the host server.” [para. 53]

In this case, the Court held that while the operator and server of Globe24h.com were located in Romania, the activities had targeted the Canadian public through the disclosure of personal information and had specifically advertised the website as providing access to “Canadian Caselaw.”  The court also held that the general principle of international comity would not be violated by subjecting the Respondent to PIPEDA because the Court’s finding would, in fact, complement the ongoing actions taken by the Romanian authorities against the Respondent.

Next, the court agreed with the Privacy Commissioner’s finding that the Respondent was an “organization” within the meaning of paragraph 4(1)(a) of PIPEDA. It affirmed the finding that the respondent’s activities were commercial in nature because it had generated revenue from advertisements and the fees solicited from individuals to remove their personal information. Therefore, PIPEDA was applicable to the Respondent’s activities. The Respondent could escape liability under PIPEDA if the collection, use and disclosure of the personal information was (i) for exclusively journalistic purposes, (ii) for purposes that a reasonable person would consider are appropriate in the circumstances, or (iii) in relation to personal information that appeared in a publicly-available document of a judicial or quasi-judicial body where the collection, use and disclosure “relate directly to the purpose for which the information appears” in the document. The Court considered these three issues in turn.

The Court held that the collection, use and disclosure of the personal information did not meet the “exclusively journalistic purpose” exception under PIPEDA. The Court held that the Respondent’s primary purpose was to incentivize individuals to pay to have their personal information removed from the website. The Court also drew attention to the fact that the Respondent adds no value to the publication by way of commentary, additional information or analysis. The Court reasoned that even if the Respondent’s activities did amount to journalism, they were not “exclusively” journalistic.

The Court then addressed whether the Respondent’s collection, use, and disclosure of the personal information was “appropriate” under subsection 5(3) of PIPEDA. The Court first looked at whether the “collection, use or disclosure of personal information is directed to a bona fide business interest”, and then considered “whether the loss of privacy is proportional to any benefit gained.” [para. 74] In considering these two factors, the Court noted that the Canadian Judicial Council’s policy on court records discouraged the indexing of decisions by search engines. The Court noted that this “policy recognises that a balance must be struck between the open courts principle and increasing online access to court records where the privacy and security of participants in judicial proceedings will be at issue.” [para. 75] The Court concluded that the Respondent’s activities resulted in needless exposure of personal data, and was therefore not “appropriate” under PIPEDA.

Lastly, the Court held that the “publicly available” exception under section 7 of PIPEDA did not apply to the personal information republished on Globe24h.com. The Court found that the Respondent’s purposes in republishing the decisions were not “directly related” to the purpose for which the information appeared in the decisions. The Court highlighted that the Respondent’s activities were unrelated to the open court principle and instead served to “undermine the administration of justice by potentially causing harm to participants in the justice system.” [para. 76]

As to the reliefs sought by the Applicant both in law and equity, the court first granted the requested corrective order. It said that even though courts are generally reluctant to issue extra-territorial orders; in this case there was a “real and substantial” connection between the Respondent’s activities and Canada, and a corrective order against the Respondent could assist the Applicant in pursuing his remedies in Romania. Accordingly, the court ordered the Respondent to remove all Canadian court and tribunal decisions containing personal information from Globe24h.com and take the necessary steps to remove these decisions from search engines’ caches. The Court also agreed to issue declaratory relief that would enable the Applicant and other affected individuals to submit a request to Google or other search engines to remove links to decisions on Globe24h.com from their search results. It said that such a broadly drafted remedy was “required in order to ensure that the organization’s practices going forward did not result in further violations of constitutional and quasi constitutional rights.” [para. 95] Finally, the Court ordered the Respondent to pay a total of $5,000 in damages and $300 in legal costs.