We’ve published or Privacy Post caselaw digest, covering relevant developments in Canadian information management and privacy law. The link is here. And the following is our lead-in.

So what’s new?

Much has been said about Leduc v. Roman, the case in which Mr. Justice Brown of the Ontario Superior Court of Justice granted leave to cross-examine a plaintiff in a motor vehicle accident suit about the nature of content he posted on his Facebook profile. This is the second Ontario case in which a judge has shown little appreciation for an argument that information .posted in a “friends only” section of a social networking profile page should be treated as private in considering the appropriateness of production. Leduc is significant, but there are a number of other decisions we’ve reported that also demonstrate an intensifying new dialogue on the law of production and personal privacy. If you’re interested in this subject, Warman v. Wilkins-Fournier (on anonymous internet use) and British Columbia (Director of Civil Forfeiture) v. Angel Acres Recreation and Festival Property Ltd. (on non-party participation rights) are worth a read.

We’ve also covered the numerous recent “lawful access” cases – cases in which criminal defendants have argued that their Charter right to be free from unreasonable search and seizure has been violated because police have requested and obtained information from organizations to further an investigation, without seeking a warrant. For what these cases mean to employers, please see our recent client bulletin, Pretty Please: Police requests for employee personnel files.

Please check it out and enjoy!

On April 20th, the Alberta Court of Queen’s bench quashed several Alberta OIPC orders made against a doctor and a medical spa in relation to the maintenance and use of a database of contact information used to market medical and medspa services and fundraise for a related charitable foundation.

The complainants were patients of the doctor who claimed to have received mailings without having provided consent. Both asked not to be identified in the course of the OPIC’s inquiry because they feared reprisal from the doctor and had an ongoing need for his services.

The Court held that the OIPC erred in agreeing with the complainants’ request for anonymity and withholding their identities. It held that the OIPC must meet a “fairly stringent” standard of fairness and did not meet this standard in the circumstances. It discounted the complainants’ concern about access to medical services given they lived in a major centre and held the prejudice to the respondents from non-identification was significant. The Court said:

Had the applicants been provided with the identity of the complainants, they could have checked their records to confirm whether consent had been provided or refused, or may have had an explanation as to why the complainants continued to receive solicitations despite their wishes to the contrary if that in fact was the case. Here the applicants were forced to accept the evidence of the complainants that they had not provided consent, without being given the opportunity to rebut the evidence. In my view this was unfair and wholly inappropriate given the reliance of the Privacy Commissioner on the complainants’ evidence of no consent and the applicants’ evidence that documentation was available which could potentially support their position that consent was obtained. Relevant documentation would likely have constituted the best evidence as to whether or not consent was given to the use that was made of the information.

Even more significantly, the Court held the OPIC erred in finding that the Alberta Health Information Act prohibits the collection and use of individually identifying health information for marketing and fundraising purposes with or without consent. In doing so, the Court recognized that the general purpose of privacy legislation is to give people control the use of their personal information. It held the OIPC’s interpretation was inconsistent with this purpose, inconsistent with evidence of legislative intent and inconsistent the text of the statute.

Lycka v. Alberta (Information and Privacy Commissioner), 2009 ABQB 245.

Here are some of my tweets of the week on information management and privacy law:

• Commented on @kaplanmyrth‘s post on employees who complain online: http://post.ly/NAR Thanks Andy!
• RT @caparsons: New blog post: Facial Blurring = Securing Individual Privacy? http://tinyurl.com/d226sg
• Another Facebook production case from Ontario:http://bit.ly/KMr6T
• Commented on Brian Bowman’s “Technology drives need for new privacy legislation” http://bit.ly/12FMvh
• Some (information management related) question’s about Ontario’s workplace violence bill: http://bit.ly/NLdXR
• RT @PrivacyLaw “Student outcry puts privacy policy on hold”http://tinyurl.com/csl7xp (Wow! Thx for the good Can-con.)
• Can.Ct.: journalists may not publicize information obtained as a result of a breach of confidence: http://bit.ly/SRvDY via @sectorprivate
• Life (and a Lifetime) After the Massacre: http://bit.ly/tfft[Gun control op. ed. by @cbsandrewcohen rltd to Columbine and VTech anniv’s.]

I heard a bump in the night this week, freaked-out and immediately removed all pictures of Hugo, our son, from the public internet. Sounds paranoid, but I recently heard a story about a Toronto break-in that makes the risk feel quite real. I’m as proud a father as any, but any risk at all is not worth it. I’d still like to share a little something personal in these weekly posts, but you’re likely to hear more about me and Seanna from here on in.

The picture below is from a beautiful surf spot in Chile. It’s very well known, but I’ll refrain from naming out of respect for convention anyway. I spent a week in 2004 staying solo right up from where the picture was taken, was blown away by the beauty of the place and was freaked out by some big waves. They’re at least triple-overhead in this picture. I managed the very hard paddle out later in the day when it came down a bit and after getting ripped down the point and spit out on the beach two times. I’d encourage everyone (surfers and others) to take a trip to Chile’s coast and take an interest in the local environmental issues. It’s a wonderful place.

See ya!

Dan

On April 14th, the Ontario Superior Court of Justice dismissed a motion for an order requiring three plaintiffs in a personal injury action to list the current content of their Facebook and MySpace pages.

Master Haberman took issue with the timing of the motion, which she heard a month before a fixed trial date and almost three years after the matter was set down for trial. She held that she had no jurisdiction to make an order that was certain to interfere with the fixed trial date and, in any event, would not have granted leave in the circumstances. She rejected the defendant’s claim that the February 2009 decision in Leduc v. Roman (summarized here) brought about a “substantial change” which justified leave to conduct pre-trial discovery and held that there was no evidence that proceeding without disclosure of the requested information would cause an injustice.

Master Haberman also held, in obiter, that the request for disclosure from the injured plaintiff’s family members, who had claimed only for loss of care and companionship under the Family Law Act was improper.  She said, “Before Leduc can be invoked, there must be something to suggest at least some possible connection between the matters in issue and the documents sought.”

Kent v. Laverdiere, 2009 CanLII 16741 (ON S.C.).

I’m not sure where it’s written that May/June is prime time for continuing education conferences, but it sure seems to be that way. Here’s my schedule of public appearances over the period.

• “Best Practices for Document Retention and Destruction,” at The Canadian Institute”s Meeting Your Privacy Obligations conference – May 27 & 28 in Toronto. I plan to present broadly on “The Anatomy of a Retention Rule” and deal with privacy and regulatory compliance, risk management, production-related issues and other practical considerations. Looks like a very solid lineup, with commissioners Jennifer Stoddart and Frank Work and privacy lawyers and bloggers David Fraser and Brian Bowman on the roster.
• Workplace Privacy segment at the OBA’s Hot Topics in Privacy Law – Morning of June 8 in Toronto. This program has a segment on privacy breaches then a series of rapid-fire presentations, mine on workplace privacy. I have ten minutes to present three important ideas relating to e-mail investigations, audits and surveillance.
• “E-mail as Evidence” at Osgoode PDP’s Obtaining, Producing and Presenting Electronic Evidence – June 11 & 12 in Toronto. Thrilled to be co-presenting with John Gregory on this one. We’re meeting soon to prepare, but the session billed has a focus on e-mail management.
• Pre-conference workshop at the Canadian Association of College and University Student Service’s annual conference – June 14th in Waterloo. This is billed as a case law update relating to student discipline and related issues, but I’ll strive to keep the discussion practical. I did this session two years ago and focused on information management, threat assessment and the duty of care. We had a great discussion and I hope to facilitate the same this time around. It’s always a pleasure to engage with student services administrators, whose skills in making practical judgement calls are tested day-in and day-out.

I’m looking forward to meeting people and advancing my thoughts this conference season. Please browse these programs and consider signing up. And if you’re attending (or even if not) and have any questions, issues or suggestions that might help me to develop relevant content, please comment or e-mail. I’d appreciate any input you can provide!

Dan

I’ve been on vacation for the last two weeks and have changed-up my reading pattern in an attempt to write a couple papers for some May/June conferences (which are soon to be promoted here). I have managed to follow the buzz on Twitter though. Here are some links in the domain you might like:

• RT @sectorprivate Principal advocates testing Manitoba students for drug, alcohol use http://bit.ly/ACl9n [Heard (CBC) this has pop. sup’t!]
• @chronicle on university e-mail outsourcing http://bit.ly/3MlELH I’m open on issue and wld benefit from comment on this opinionated p-cast
• RT @DetentionSlip Progress Report: SCHOOL SAFETY- Are we just hitting the Panic Button? http://tinyurl.com/ck5u6c
• RT @Privacylaw EFF: “Computer Science Student Targeted for Criminal Investigation for Allegedly Sending Email” http://tinyurl.com/dhujsq
• @Privacylaw “Exigent Seizure of a Computer” http://tinyurl.com/cojmpv
• Pretty Please: Managing police requests for employee personnel files: http://bit.ly/W4Z25
• RT @rcalo Online public salaries sparks dispute http://tiny.cc/1mXRZ [Internet’s effect on openness v. privacy balance an issue to follow.]
• RT @erikmagraken Personal Injury Claims and Privacy – Can ICBC access your Facebook Account? http://tinyurl.com/cc63dr [Nice find Erik!]

We’ve been in on Halifax’s Eastern Shore, a place which we hold dear. I got my surf fix in – with better swell than expected for this time of year – and Seanna and I managed to entertain The Bug and ourselves with good daily activities and meet-ups with awesome local friends. Here are a few pics of the highlights.

See ya!

Dan

[2 pics deleted – sorry!]

This is a title of a recent client bulletin I drafted after receiving a run of inquiries from clients faced with police requests for access to information about employees and former employees.  Please download a copy here.

Yesterday the Supreme Court of Canada issued its judgement in R. v. Patrick. It unanimously held that the police did not violate an accused person’s right to be from unreasonable search and seizure by seizing information:

• mixed in with garbage…
• in opaque garbage bags…
• inside garbage cans without lids…
• that were placed in an open receptacle…
• on the accused individual’s property.

The case is about the concept of abandoning one’s subjective expectation of privacy. In a memorandum written by Binnie J., the six-judge majority framed the test for abandonment as follows: ” The question is whether the claimant to s. 8 protection has acted in relation to the subject matter of his privacy claim in such a manner as to lead a reasonable and independent observer to conclude that his continued assertion of a privacy interest is unreasonable in the totality of the circumstances.” The majority held that this test was satisfied in the circumstances, taking special note of the identifying information that would be mixed-in with the accused individual’s household garbage long after the “bag of information” itself was no longer sitting outside of his home:

Clearly, the appellant intended to abandon his proprietary interest in the physical objects themselves. The question is whether he had a reasonable continuing privacy interest in the information which the contents revealed to the police. There was some discussion at the bar that a privacy interest does not cease until garbage becomes “anonymous”, but as Conrad J.A. noted, much garbage never becomes anonymous, e.g. addressed envelopes, personal letters and so on. In this case, the garbage included invoices for the purchase of chemicals used in the preparation of the drug Ecstasy. The idea that s. 8 protects an individuals’s [sic] privacy in garbage until the last unpaid bill rots into dust, or the incriminating letters turn into muck and are no longer decipherable, is to my mind too extravagant to contemplate. It would require the entire municipal disposal system to be regarded as an extension, in terms of privacy, of the dwelling-house. Yet if there is to be a reasonable cut-off point, where is it to be located? The line must be easily intelligible to both police and homeowners. Logically, because abandonment is a conclusion inferred from the conduct of the individual claiming the s. 8 right, the reasonableness line must relate to the conduct of that individual and not to anything done or not done by the garbage collectors, the police or anyone else involved in the subsequent collection and treatment of the “bag of information”.

This reasoning limits the impact of the majority judgement. It is about the reasonableness of asserting an expectation of privacy after disposing of household waste in a manner that leaves it identifiable. The outcome may have differed if the accused individual had shredded his bills and other identifying information.

At the same time, the majority did make some more principled comments about the right to be free from unreasonable search and seizure. Here are two other “quotables”:

• On the perspective from which section 8 disputes are assessed: “Privacy analysis is laden with value judgments which are made from the independent perspective of the reasonable and informed person who is concerned about the long‑term consequences of government action for the protection of privacy.”
• On whether one can have an interest in information that reveals criminal activity: “A warrantless search of a private place cannot be justified by the after-the-fact discovery of evidence of a crime.”

Abella J. wrote a concurring opinion on her own. She held that the accused individual had a reduced expectation of privacy in the circumstances, but that this expectation was sufficient to warrant intrusion based on the “reasonable suspicion” standard. She stressed the sensitivity of the personal information contained in household waste and, unlike the majority, noted that the manner in which household waste is disposed is not entirely voluntary.

For more, see David Fraser’s comment here. David’s comment also raises the issue of voluntariness.

R. v. Patrick, 2009 SCC 17.

Yesterday, the British Columbia Supreme Court ordered a hard drive to be produced to a neutral expert to identify and extract information about the amount of time the plaintiff spends on Facebook between eleven at night and five in the morning. It held that this information met the standard of relevance for production given the plaintiff had claimed that fatigue is preventing him from maintaining employment. It also characterized the scope of the defendant’s request as narrow and suggested the privacy interest of the plaintiff and other users of the (home) computer were resolved by engaging a neutral.

Thank you to Erik Magraken of the ICBC Law blog for posting on this decision first.

Bishop v. Minichiello, 2009 BCSC 358.