Author: Dan Michaluk

Nova Scotia CA Favours Open Courts Over Youth Privacy in Facebook Defamation Case

The Nova Scotia Court of Appeal has just issued a decision in which it affirmed a decision to deny a potential defamation claimant the use of a pseudonym (initials) in pursuing a defamation claim.

The appeal was brought by a 15-year-old girl who has taken issue with an individual who created a fake and allegedly defamatory Facebook profile in her name. In May 2010, she succeeded in arguing for production of the identity of the individual associated with the fake profile before LeBlanc J. of the Nova Scotia Supreme Court. At the same time, LeBlanc J. denied the appellant an order permitting the use of a pseudonym and denied her a publication ban.

Saunders J.A. wrote today’s judgment for the Court of Appeal. He upholds LeBlanc J.’s order on a deferential standard, but nonetheless makes some broad and principled statements in favour of the open courts principle. More specifically, he says:

  • that a court should not apply its parens patriae jurisdiction to allow a child to sue anonymously for defamation (para. 65);
  • that an order to shield the identity of a defamation plaintiff (regardless of age) is an anathema to an action in defamation, which is about public vindication of reputation (paras. 80 to 85); and
  • that the presumed damage to reputation that flows from a defamation finding does not excuse a party who is seeking a restrictive order from proving “a serious risk to the proper administration of justice” as called for by the Dagenais/Mentuck test (para. 96).

Saunders J.A. ends by saying that openness will produce a laudatory result in the circumstances: “The public will be much better informed as to what words constitute defamation, and altered to the consequences of sharing information through social networking among “friends” on a 21st century bulletin board with global reach.”

A.B. v. Bragg Communications Inc., 2011 NSCA 26.

Alberta Court set to Hear Faculty E-mail Case

On February 22nd, the Alberta Court of Queen’s Bench issued a procedural order dealing with two judicial review applications about a request for e-mail communications between a University of Alberta faculty member and a selection committee of the Social Sciences and Humanities Research Council.

The university brought an application to quash a decision in which the OIPC found that the e-mails sought by the requester were under its custody or control. The Association of Academic Staff of the University of Alberta brought its own application, and also claimed it ought to have been given notice and standing by the OIPC. Over the university and OIPC’s objection, the Court earlier held the the association’s application could proceed based on this very significant procedural ground. On February 22nd the Court held that the two applications should be heard consecutively, with the association’s application proceeding first.

University of Alberta v. Alberta (Information and Privacy Commissioner), 2011
ABQB 100.

Alberta OIPC Decision Quashed for Reasonable Apprehension of Bias

On February 22nd, the Alberta Court of Queen’s Bench quashed an Alberta OIPC decision because comments made by the Commissioner in the decision gave rise to a reasonable apprehension of bias.

The decision involved an objection to the Commissioner’s jurisdiction to inquire into a complaint made against the Alberta Teachers’ Association. The ATA lodged its objection several months after it had successfully obtained an Alberta Court of Appeal ruling in a separate matter that held the Commissioner had lost jurisdiction for failing to comply with time limits. (The appeal of the Alberta Court of Appeal ruling was just recently heard by the Supreme Court of Canada.) In this context, the ATA raised its jurisdictional objection in a manner that was somewhat snarky. It stated, “you should have come already to the conclusion that you have no more power to continue with the inquiry and should so notify the parties.” And also, “Kindly confirm to the parties at your very earliest opportunity that the inquiry is hereby terminated.”

The Commissioner dismissed the objection and made the following comment:

I make some concluding observations. One is that objections to time extensions add steps that themselves extend the time a matter takes, and expend the resources of this office that could otherwise be used to decide substantive issues. The ATA’s complaint is about the time taken on this matter, yet its objection has further delayed the process.

Further, the objection seems intended to ultimately defeat the purposes of the Act. I recognize that a party acts within its rights in bringing an objection based on timing, and organizations that are prejudiced in their ability to respond by the passage of time should not hesitate to do so. However, the ATA has not indicated how it would be prejudiced if the matter were to proceed. A primary purpose of the Act is to enable me to provide direction to organizations as to whether they are in compliance with their duties under the legislation. In the absence of such prejudice, I would ask respondent organizations, even private ones, to consider whether it is in their own and the public interest to make objections for the purpose of avoiding direction as to how to meet their duties under the legislation. As well, it is disingenuous for organizations to selectively rely on the timing provisions of the Act, or not, depending on whether doing so meets their own interests.

My final observation relates to the tone of the ATA’s letter. It states:

As neither of the tests in paragraph 35 [of the ATA case] can be satisfied in this case, I have concluded that this notice of your default is necessary and should suffice to terminate the inquiry process, in accordance with the presumptive consequence set out in paragraph 37(2) [of the ATA case].

Kindly confirm to the parties at your very earliest opportunity that the inquiry is hereby terminated. Thank you for your immediate attention to this matter.

The decision as to whether this inquiry is to continue must be made by me having regard to the submissions of both parties and the facts and law I regard as relevant. This demand that I terminate the inquiry, at my earliest opportunity, simply on the basis of the ATA’s “notice of my default”, reflects a misunderstanding of the different roles of the parties and the decision maker in this process. The ATA may put forward its views and make submissions, but it is not the decision-maker. Furthermore, while parties need not be deferential, they must be appropriately respectful of the role of the tribunal. I concur with the comment of the Complainant in this case that the demand made by the ATA, as quoted above, is not appropriately respectful.

Justice Graesser held that this comment, and in particular its attribution of dishonesty or a lack of candor to the ATA, gave rise to a reasonable apprehension of bias. He made clear, however, that it was okay for the Commissioner to “call a spade a spade” by criticizing the ATA’s presumptuous and disrespectful submission.

Justice Graesser rejected the ATA’s request to issue an order that would terminate the matter and, instead, ordered its objection to be re-heard by another adjudicator of the OIPC or otherwise delegated decision-making powers by the Commissioner.

Hat tip to Linda McKay-Panos at ABlawg, who summarizes the decision here.

Alberta Teachers’ Association v. Alberta (Information and Privacy Commissioner), 2011 ABQB 19 (CanLII).

Arbitrator Picher Okays Collection of Personal Communication Device Records

Arbitrator Michel Picher issued a notable decision last June that recently came to my attention. He held that Canadian Pacific Railway could establish a policy of investigating serious accidents or incidents by asking employees to produce personal communication device records (with the content of messages and information about the identity of parties to communications redacted).

The company did a good job of establishing the serious risk of distraction posed by the use of personal communication devices and the need for the policy, which Mr. Picher upheld on an application of the Office of the Privacy Commissioner of Canada’s four-part reasonableness test. He summarized his views as follows:

As the cases cited above amply reflect, arbitrators are properly sensitive to the encroachment of employers into the personal and private lives of employees, particularly as relates to non-work related activity. The reasoning in those cases, however, has little or no bearing on the instant dispute. This grievance is about whether the employer can make reasonable inquiries to establish or rule out the use of a personal cell phone or other electronic communication device by an employee while he or she is on duty. To the extent that that inquiry relates only to a serious accident or incident and does not touch on the content of personal communications, it is difficult to see on what responsible basis it could be concluded that there can be no legitimate employer interest to justify the inquiry.

Mr. Picher did stipulate that the company limit its request to the period of time pertinent to its examination.

Canadian Pacific Railway Company and Teamsters Canada Rail Conference, unreported (23 June 2010, M.G. Picher).

Court Grants Ex Parte Order to Preserve Facebook

On February 4th, the New Brunswick Court of Queen’s Bench issued an ex parte order that required the plaintiff in a motor vehicle action to print and otherwise preserve the contents of her Facebook. Significantly, the order required the plaintiff’s own solicitor to appoint an agent to initiate and supervise the preservation process before speaking with his client.

The Court held that there was reason to believe the plaintiff had not produced evidence from her Facebook that would meet the “semblance of relevance” test for production. The plaintiff claimed that she could not travel by motor vehicle for more than one hour without discomfort, suffered headaches four to five days per week and could not carry groceries or any object that weighs more than five to ten pounds. However, the public part of her Facebook contained a number of pictures of her riding a “zip line” and there was (untested) evidence that these photographs were taken after the accident that gave rise to her claim. For example, the plaintiff publicly posted a photo in an album entitled “USVI 2010,” which contained a picture of her lying on a beach with “St. John USVI 2010” scrolled in the sand.

The Court did not apply the test for an Anton Piller order, but did question whether it was proper to grant ex parte relief. In resolving this question, it relied on the following evidence about the difficulty in determining whether Facebook data has been deleted.

Most importantly to the ex parte nature of the Motion, Mr. McNulty deposes that the creator of a Webpage on Facebook can add or delete to and from the site without leaving an electronic trail that can be followed by anyone seeking to data mine what may have been posted on that personal site over time and subsequently removed. Thus a forensic reconstruction of “dumped” data that might ordinarily be undertaken with respect to a computer hard drive is not an available option unless access to the relevant social network computers located elsewhere in the world was feasible and some data trail was able to be followed by an expert in the field of computer data retrieval or reconstruction at that site.

Notably, this evidence is about the consequences of deletion rather than the likelihood that the plaintiff would actually delete once put on notice. In fact, the Court judged the plaintiff’s disposition positively, suggesting she likely failed to produce the contents of her Facebook page out of mere ignorance.

The Court also recognized that an order requiring the plaintiff’s lawyer to help ensure the pages were properly preserved could do serious harm to the solicitor-client relationship, but felt that an ex parte preservation procedure was warranted and felt that it did not have the power to order a search by a neutral. As a kind of compromise, the Court ordered the plaintiff’s lawyer to appoint an agent to schedule a meeting with the plaintiff, advise her of the order, observe the printing and downloading of content and obtain and seal copies of the same for delivery to the plaintiff’s lawyer. The most troubling part of the order is that it bound the plaintiff’s lawyer to initiate this process without advising his client.

Hat tip to @pegduncan and @jfderico for pointing to this case.

Sparks v. Dubé, 2011 NBQB 40 (CanLII).

Ontario Arbitrator Says Employers Entitled to More Than a Bare Medical Certification

On January 27th, Ontario labour arbitrator George Sudykowski issued an award about the scope of information employers may generally require in a medical certificate. He held that employers need not accept a bare statement from a doctor confirming an employee’s illness:

I agree with the thrust of the British Columbia jurisprudence that it is not inordinately invasive for an employer to ask that a medical certificate include the reason for incapacity, which would appropriately consist of a general statement of the nature of the disabling illness or injury, without diagnosis or symptoms. It is not unreasonable for an employer to require an employee to provide the reason for her absence or claim for STD benefits, and the mere fact that providing that reason (i.e. the nature of her illness or injury) may suggest a diagnosis does not excuse the employee from providing the reason in order to satisfy the onus on her to justify her absence and claim for benefits even in the first instance.

He also said:

I also respectfully disagree with Arbitrator (as he then was) Whitaker’s conclusion in Re Hydro Agri Canada, supra (at page 108), that an employer is generally not entitled to require that a medical certificate include the date(s) of the relevant visit(s) to the medical health professional who provides the certificate. Not only is this at best remote confidential medical information, the date of visit(s) will both tend to confirm that the medical health professional actually saw the employee for the purpose of the certificate, and will reveal the timeliness of the visit relative to the absence in issue, which is a relevant consideration.

Arbitrator Surdykowski rejected a seemingly impassioned presentation by the Union in which it argued the importance of medical privacy, the reliability of physician statements and the weak distinction between information about “nature of the illness” and information about “diagnosis.” Mr. Sudykowski said the Union’s case rested on “selective optimism.” He also acknowledged that the disclosure of information about the nature of the illness may indicate a diagnosis, but suggested that the routine disclosure of “nature of the illness” information for the purpose of medical certification is nonetheless reasonable and appropriate.

Providence Care, Mental Health Services v. Ontario Public Service Employees Union, Local 431, 2011 CanLII 6863 (ON L.A.).

Alberta CA Addresses Jurisdiction to Consider Alleged Privacy Breach by Privacy Commissioner

On February 3rd, the Alberta Court of Appeal considered who has jurisdiction to consider an alleged privacy breach by the Alberta Office of the Information and Privacy Commissioner. It held that the proper means to allege a breach of the OPIC’s confidentiality duty in the Alberta Personal Information Protection Act is by filing an application for judicial review and not by seeking appointment of a special adjudicator under the Alberta Freedom of Information and Protection of Privacy Act.

The complainant first filed a complaint to the OPIC under PIPA. He later took issue with the OIPC itself when it copied the respondents on a letter dismissing his complaint as constituting an abuse of process. The complainant alleged a breach of section 41 of PIPA, which imposes a duty of confidentiality on the OPIC that expressly permits disclosures that are necessary for the purposes of conducting an investigation and inquiry. He sought and obtained an order appointing a special adjudicator to investigate a complaint against the Commissioner under provisions allowing for such an appointment in the Alberta FIPPA.

The Court of Appeal held that the adjudicator did not have jurisdiction to hear the complaint because of an exclusion provision in Alberta FIPPA for “a record that is created by or for or is in the custody or under the control of an officer of the Legislature and relates to the exercise of that officer’s functions under an Act of Alberta.” The Court held that the adjudicator (deciding on his own jurisdiction) and the reviewing judge erred by finding that this provision excluded certain records from the right of public access but did not exclude complaints about the disclosure of personal information in such records. It held that absolute exclusion was supported by the plain language of the exclusion and a contextual reading of the exclusion. It commented on the appropriate remedial path as follows:

However, some recourse does exist in situations where the Commissioner has allegedly improperly disclosed confidential information. He acknowledges that his actions are subject to judicial review, that he may face an action based on abuse of public office given his role as a public official and, also, that he is subject to sanction or removal by the legislature should he engage in improper conduct. That said, somewhat ironically, s. 4(1)(d) protects him from the operation of the same statutory complaint mechanisms as apply to others should he improperly disclose confidential information. This result concerned the Adjudicator and the reviewing judge. If it applied, such a mechanism would provide less expensive, cumbersome and uncertain recourse than that available through judicial review or removal from office by the legislature. However, had the legislature wished the Commissioner to be subject to the same sanctions as other people, it could have included an express provision in FOIPPA to create that result while nonetheless protecting him from release of information properly required in the exercise of his functions.

The Court also held that the adjudicator and reviewing judge erred by grounding jurisdiction in section 77 of the Alberta FIPPA, which grants a right to review certain decisions of the Commissioner when acting as head of the OIPC. It held that the Commissioner does not act as head of the OPIC when exercising his adjudicative functions.

The Court’s interpretation of the records-based exclusion has some significance given the existence of similarly worded exclusions in other public sector access and privacy statutes.

Alberta (Information and Privacy Commissioner) v. Alberta (Freedom of Information and Protection of Privacy Act Adjudicator), 2011 ABCA 36 (CanLII).

Workplace Privacy Here and Now

I had fun speaking at the OBA Institute privacy session today. I did a hot topics presentation on (1) the blurring boundary between work and private life, (2) access to stored communications on corporate systems, (3) PIPEDA application to employment in the provinces and (4) the remedial approach to dealing with employees who breach privacy rules.

Case references here:

HO-010 is quite the case for Ontario health information custodians. It’s controversial because of the following paragraph on dealing with employees who breach privacy rules:

For other staff members of the hospital involved, knowing that all of the details of the disciplinary action imposed will be publicly disclosed, should serve as a strong deterrent. This is especially true if those details also become known to other employees, either through the actions of the aggrieved individual, the custodian, or both. Employees must understand that, given the seriousness of these types of breaches, their own privacy concerns will take a back seat to the legitimate needs of the victims involved to have a full accounting of the actions taken by the health information custodian. Our primary concern must lie with the aggrieved party, whose privacy was completely disregarded.

This statement suggests (very mildly) that employers should publish information about the outcome of the disciplinary process as a means of remedying a data breach that is caused by intentional employee misconduct. As I comment in the slides below, this suggestion should be approached with great caution.

Thanks to the program chairs and the other speakers. I enjoyed the afternoon!

Investigating Computer Abuse – Help for Human Resources

My colleague Kathryn Bird and I presented today at the HRPA 2011 conference on “Investigating Computer System Abuse – Help for HR.” It was our aim to help human resources professionals charged with investigating computer-related misconduct to identify issues, ask proper questions of internal IT and know when to get professional IT forensics and legal help. We covered investigation basics, sources of digital evidence, preservation best practices, interview tips and managing the investigation record. Big thanks to Kevin Lo of Froese Forensics for reflecting on some of our ideas over beers. Slides are below.