Workplace privacy panel notes and case citations attached

I greatly enjoyed sitting on a panel with Professor Avner Levin on workplace privacy today!  

Dr. Levin and other members of the Ryerson University Privacy and Cyber Crime Institute at the Ted Rogers School of Management have recently published a leading study on the perceptions of risk of young Canadians engaged in online socializing and how their behaviors meet with the use of online social networks by business for commercial and human resources purposes. Dr. Levin’s work raises some important and difficult questions about whether the law should cause companies who provide social networking platforms that are used predominantly by youth to take greater responsibility for user privacy (and other content-related disputes). I commend it to you.

I did promise to provide a copy of my preparatory notes (most of which we did not touch on) as well as coordinates for some of the cases that came up in discussion. Here are the notes and the cases:

Take care!

Dan

Case Report – Challenge to “lawful access” exemption in privacy legislation dismissed

On January 26th, the Saskatchewan Provincial Court dismissed a Charter challenge to a provision in the Saskatchewan Freedom of Information and Protection of Privacy Act that allows the Saskatchewan government and its agencies to answer law enforcement requests for personal information without obtaining individual consent.

The police identified an IP address of a computer used to share child pornography on the internet and made a warantless request for subscriber records to SaskTel in order to identify the accused as being associated with the computer. SaskTel provided the information without consent based on the exemption in section 29(2)(g) of Saskatchewan FIPPA, a relatively characteristic “lawful access” provision – i.e. one that allows an entity bound by privacy legislation to answer law enforcement requests for personal information. The accused claimed that this permissive provision allowed the police to conduct a search in violation of two Charter rights: (1) the section 7 right not to be deprived of liberty except in accordance with the principles of fundamental justice (on the basis of the provision’s overbreadth and vagueness); and (2) the section 8 right to be free from unreasonable search and seizure.

The Court dismissed both claims with little reasoning. It quoted extensively from the Crown’s factum and held that the accused person’s position was inconsistent with the Supreme Court of Canada’s judgement in R. v. Plant and the Saskatchewan Court of Appeal’s judgement in R. v. Cheung. The Court’s decision will lack authority because the Court did not fully engage in the issues, but it does show that the “lawful access” issue is very live.

R. v. Trapp, 2009 SKPC 5.

Information Roundup – 1 February 2009

The depths of winter are upon us, and what a winter it has been! I hope you are all coping. I’m doing okay, but did have to book a plane ticket to Halifax for a couple of weekends from now to give me something to look forward to. It doesn’t matter if it’s cold, as long as surf is involved I’ll be revived.

Here are some recent developments in the domain that you may find noteworthy. They are about child pornography reporting, why FOI in Ontario has not yet met e-discovery and why there is no “bright line” test for improper “campus speech.”

Child pornography reporting

Kelly Harris of Canadian Lawyer InHouse recently wrote on Ontario’s new child pornography reporting law. Kelly quoted me, and in prepping for his call I did a bit more thinking about the law than I had at the time I first reported on it. The reporting duty applies to “persons,” and though one might argue a corporation/system owner has a duty to report, the law is clearly geared at individuals. But as I told Kelly, corporations can’t wash their hands of the duty to report material found on their computer systems. It’s good workplace policy for employers to support the members of their IT staff, but employers also need to protect themselves from potential criminal liability.

In my view, one of the things the legislation does is engage “the course of justice” as soon as a person discovers what might reasonably be child pornography. The suspected pornography, which is in the custody of the employer, is now evidence and must be treated carefully given the potential for obstruction charges. This is a significant change, and rules out dealing with the found material as an internal, employment-related matter.

As for policy-buliding, Ontario school boards have great reporting protocols that employers may look at to get started. Search “child in need of protection” and “district school board.”

Why FOI in Ontario has not yet met e-discovery

Decisions about how to conceive of a “record” are so fundamental that they tend to get information and privacy people like me excited. The January 19th Arizona Court of Appeals decision that metadata is not a “public record” under Arizona open government legislation has attracted such a buzz. Here is K&L Gates’ summary of the case, which I have scanned but not read.

Our freedom of information law in Ontario is different, and allows for access to records in electronic form (see the Gombu case for an example). That said, we have not seen an escalation of electronic production demands that even remotely resembles that demonstrated in the American e-discovery experience or even the relatively mild Canadian e-discovery experience. Paper-based production in Ontario FOI procedure still prevails, likely because the system is a user-pay system where escalation does not serve requesters and because the regulation does allow for full recovery of the “invoiced costs” of e-discovery. I’m aware of just one IPC/Ontario order upholding the recovery of such costs, but it’s an important one if escalation is to be avoided.

The douchebag case – why there is no “bright line” test for improper “campus” speech

I ignored my friends’ tweets about “the doucebag case” for about two days until, with some time to kill in the back of a cab, I linked through one friend’s tweet and realized all the buzz was about a student speech case – one about a high school student who was sanctioned for referring to her school administrators as “douchebags” in her personal blog. The news that’s got people talking (or tweeting as they may) is a Connecticuit court’s January 15th partial dismissal of the student’s claim. Mary-Rose Papendrea has posted an excellent summary and critique of the judgement on the Citizen Media Law Project’s blog. She says:

…courts should be reluctant to apply Fraser to off-campus Internet speech because that case does not require a showing that the offensive expression disrupted or could reasonably be expected to disrupt school activities. Because Fraser does not require the school to make this showing, schools could restrict any indecent speech by a student, anywhere regardless of where he engages in it, without any additional showing. The idea that schools could regulate offensive speech on the Internet without showing any harm to the school would give school officials virtually limitless authority to police their students’ expression, and this should give courts pause. Although students have somewhat limited free speech rights while they are at school, they are entitled to full free speech protections outside of school.

To suggest that a sanction must be based on reasonably foreseeable harm to a legitimate interest is reasonable, but let’s look at the moral panic that this case has caused.

The article I linked through to on my cab ride was one about a proposal by a Connecticut legislator that was made in response to the case. In the name of clarity, this legislator has proposed a “bright line rule” – one that would “prohibit school authorities from punishing students for the content of electronic correspondence transmitted outside of school facilities or with school equipment, provided that such content is not a threat to students, personnel, or the school.”

To be fair, even the legislator’s proposed rule builds-in a harms-based test. The focus on the locus of the communication, however, is misplaced. I make no comment on the outcome in the douchebag case, but I do agree with the Court’s comment that locus of the communication has become less and less relevant to the balancing of interests that is required in resolving student speech cases. The Court said, “Off-campus speech can become on-campus speech with a click of the mouse.” This is indisputable. So rather than generate some false sense that individuals will not be accountable for harms caused or likely to be caused by communication made from a home computer and on a personal blog, policy should focus on the real issue – what standard of harm or foreseeable harm to the school environment justifies a restraint on speech in what circumstances. To suggest answering this question is as easy as looking at the locus of the communication is misleading.

***
I’ve been wordy today, but I’ve been enjoying using this space for telling personal stories. That’s what online social networking is about right?

We refer to this photo as “the men photo.” There’s a copy on our living room wall at home and I send it around to friends once and a while because it brings back such good memories of our time in Maui.

n655200596_4992568_8951The guy in the tux is my friend Artur Szpunar, and this was his wedding day. Art went down to Maui with me for a windsurfing trip after finishing first year of an engineering degree at Queen’s University and has never left. When I packed my bags to return home, I left Art with less than $100 and a few days of paid-up rent. Now, 11 years later, he’s got a happy family and an awesome gig as sail designer for Maui Sails.

Art’s wedding was about four years after his arrival on Maui and just a month or two after he survived a crazy and serious battle with necrotizing fasciitis (Streptococcus A or the “flesh eating bacteria”). I owe Art big, because I became infected by the Strep A bacteria shortly after him, and the only thing that convinced the hospital to take my case seriously at first was my pleas about what happened to Art. Given the early attention, I ended up checked into the hospital for only a week. I frequently wheeled myself down to visit Art, who by then was on the mend.

To Art’s right is my good friend Dan Kaseler, also a sail designer, now based out of Washington state and designing windsurf and other sails through his own company. To Art’s left is Johnny Boyle, a Scottish hellman who has now settled down with family in California. The other fellow is John’s brother “Moxie.”

The wedding plan was to have guests congregate with the groom in the parking lot of the Iao Valley State Park before hiking to meet Art’s bride-to-be, Amanda. If it was sunny Amanda would be in one place and if it was rainy she would be in another. Not a bad plan if the Iao Valley wasn’t one of those places in Hawaii where it’s almost always sunny and rainy at the same time. So it took us all a few wrong turns to find Amanda, but all worked out. Art and Amanda got married, Art healed and got back in the water and they now have a beautiful three-year-old daughter.

Telling a Maui story always reminds me that there’s more than one way to go about living life. It also helps warm my heart and put a smile on my face, even in the depths of winter. Thanks for listening!

Dan

Case Report – Court excludes evidence for unlawful police access to passenger manifest

On December 19, the Nova Scotia Supreme Court excluded evidence supporting drug trafficking charges after finding that the RCMP breached PIPEDA by reviewing a WestJet passenger manifest without making a formal request.

The issue of law enforcement’s access to personal information held by business organizations has arisen in a number of recent criminal cases, and it is becoming common for courts to judge the reasonableness of a police search in light of standards set by PIPEDA. PIPEDA restricts regulated organizations from disclosing personal information without consent, but includes the following key exemption:

7(2) For the purposes of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowedge and consent of the individual only if the disclosure is…

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province…

In this case, the RCMP reviewed a passenger manifest from a domestic flight, identified a passenger who had paid by cash shortly before the flight and who only had one piece of luggage and proceeded to search that passenger’s luggage. It found drugs and laid charges.

The Court held the RCMP breached PIPEDA because it did not make a “request” required by section 7(3)(c.1) given its “cozy” relationship with WestJet:

It might be a fair comment to say the officers had assumed they had permission to look at the manifest from their daily discussions and associations with the staff at Westjet.  However, in my mind that is not a satisfactory answer to the problem.  There were certain obligations upon the RCMP officers in reviewing the manifest which were legislated under PIPEDA and applied when they went to look at this manifest without a warrant.  Mr. Plimmer said Westjet put a protocol on procedures in place for the police to follow in order to see manifests.  The police were aware of the procedure they had to follow.  I find they didn’t do so in this case, but rather cavalierly walked into Westjet and simply started looking at manifests.

In addition to signaling that the procedural requirements in section 7(3)(c.1) are likely to be read strictly, the judgement is notable for its close consideration of WestJet’s privacy policy. The policy said that WestJet might be “required by legal authorities” to disclose personal information without consent, but did not say that WestJet would voluntarily cooperate with law enforcement. The Court said the policy “seems to emphasize that WestJet would only collect and disclose what is required by law and nothing more.” This weighed in favour of finding the search to be unreasonable and therefore unconstitutional.

The Court then excluded the evidence based on an application of the Collins test. In characterizing the breach as serious it said, “It is not the rights of a drug trafficker here that I am protecting.  It is the rights of a member of society who chooses to give personal information to an airline ticket agent which is recorded on a flight manifest.”

R. v. Chehil, 2008 NSSC 357 (CanLII).

OPC releases “Guidelines for Processing Personal Data Across Borders”

On January 27th, the federal Privacy Commissioner released a document entitled “Guidelines for Processing Personal Data Across Borders.” The guidelines reflect the OPC’s pragmatic approach to the issue, but seem to put slightly greater emphasis than in prior commentary on the need for organizations to examine local and polictical factors in their due dilligence process:

In the case of outsourcing to another jurisdiction, PIPEDA does not require a measure by measure comparison by organizations of foreign laws with Canadian laws. But it does require organizations to take into consideration all of the elements surrounding the transaction. The result may well be that some transfers are unwise because of the uncertain nature of the foreign regime or that in some cases information is so sensitive that it should not be sent to any foreign jurisdiction.

The Guideline is available here.

Case Report – NBCA says Federal Court is proper forum for PIPEDA challenge

On January 22nd, the New Brunswick Court of Appeal held that the Federal Court is the proper forum for a broad challenge to the powers granted to the federal Privacy Commissioner by PIPEDA.

The Court held that the matter was essentially a request for judicial review of an OPC decision despite the applicant’s constitutional validity argument, which it had made in the alternative. Given this characterization, the Court held that the Federal Court was the proper forum.

This is not a privacy judgement, but it is nonetheless worth note given the thrust of the applicant’s substantive objection. As a defendant’s insurer, it claimed the OPC had no jurisdiction to deal with its video surveillance of a plaintiff. The Court explained the argument as follows:

State Farm raises a core issue in its application: whether it engaged in “commercial activity” within the meaning of PIPEDA when it collected information about Mr. Gaudet in discharging its duty to defend Ms. Vetter. It contends that the only relationship that exists between Mr. Gaudet and Ms. Vetter stems from the accident, which is not a commercial activity. Section 4 of PIPEDA applies to the collection, use and disclosure of personal information in the course of commercial activities. “Commercial activity” is defined in PIPEDA as a transaction, act, or regular course of conduct that is of a “commercial character”. Whether State Farm’s actions amounted to “commercial activity” is the very question the Privacy Commissioner must investigate and report on in accordance with her mandate and expertise.

The resolution of this argument would have broad significance in defining the meaning of PIPEDA’s application provision, which triggers application where an organization collects, uses or discloses personal information “in the course of commercial activity.” The OPC considered a similar case in 2006 and held, perhaps surprisingly, that it had jurisdiction to investigate two lawyers who collected information on behalf of their “commercial” clients. Some would argue that Parliament did not intend a collection through a paid agent to trigger application. Others would argue that application based on this theory raises constitutional issues where it attracts PIPEDA application to information flows that are, in their essence, about matters within the exclusive jurisdiction of the provinces such as property and civil rights and employment.

State Farm Mutual Automobile Insurance Company v. Privacy Commissioner of Canada, 2009 NBCA 5 (CanLII)

Case Report – SCC broadens scope of Crown’s “first party” disclosure duty and more

On January 16th, the Supreme Court of Canada issued a unanimous judgement that broadens the scope of the Crown’s duty of disclosure to an accused person and facilitates an accused person’s right to third-party production.

On Crown-to-accused (“first party” or Stinchcombe) production, the Court held that the Crown is not a single entity for the purposes of its obligation to disclose information in its possession and control. It did, however, stress that the “investigating Crown” has a positive duty to build-out the Crown brief by making “reasonable inquiries” of other Crown agencies and departments. This duty, said the Court, includes a duty to collect and disclose records of police misconduct, at least where an officer is likely to be a witness at trial has record with some arguably relevant blemishes. The broadening of the Stincombe duty means that accused persons will no longer face the prospect of fishing for records of police misconduct or other similar information by bringing third-party (O’Connor) motions.

The Court also modified the two stage O’Connor process: an accused person must still establish “likely relevance” to justify a court review of third-party records, but at the second stage reviewing judges must now focus on the “true relevance” of the records rather than the competing interest in protecting personal privacy. If a judge concludes that records examined are truly relevant, the Court held they should be ordered to be disclosed despite any subject’s competing privacy interest. Reviewing judges should still be concerned with personal privacy, but the Court suggested that barring production was a less appropriate means of protecting personal privacy than means such as redaction and protective orders. While establishing this production-favoring rule, the Court stressed that there is a higher standard for production of records in sexual assault cases as such production is governed by the Criminal Code and Mills.

The Court has posted two more detailed summaries of the judgment, here (by Tilley) and here (by Warkentin).

R. v. McNeil, 2009 SCC3.

Case Report – Alta. C.A. says plaintiff’s mother need not answer questions about son’s injuries

On January 13th, the Alberta Court of Appeal held that a third party (who was also the plaintiff’s next friend and mother) was not required to answer questions at examinations for discovery relating to the injuries suffered by the infant plaintiff.

The plaintiff claimed against a school bus operator for injuries arising out of an accident. The defendant third partied the mother, alleging that she was negligent in failing to provide instruction to her son. The mother denied negligence and causation but did not dispute the plaintiff’s claim against the defendant or the quantum of damages claimed.

In these circumstances, the Court held that the mother was adverse in interest to the defendants on the issue of liability and therefore could be examined. However, it also held that the defendant could not ask questions about the plaintiff’s injuries on discovery because it was not adverse in interest to the mother on the damages issue:  “In this case, the happenstance that the third party is the mother of the plaintiff should not be allowed to extend the scope of discovery beyond what is ‘relevant and material’ in the pleadings.”

Briggs Bros. Student Transportation Ltd. v. Collacutt, 2009 ABCA 17 (CanLII).

Case Report – Charter challenge to investigation allowed by PIPEDA rejected

On January 20th, the Ontario Court of Appeal affirmed the dismissal of a Charter application that claimed RBC violated section 8 of the Charter in investigating a case of mortgage fraud.

RBC had collected information from T-D Bank which allowed it to pursue an alleged fraud. Both banks are members of the Bank Crime Investigation Office of the Canadian Bankers Association, a designated “investigative body” under PIPEDA. They relied on sections 7(3)(d)(i) and (h.2) of PIPEDA in sharing the information. The Applicants took issue with these provisions and RBC’s actions taken in reliance on these provisions. They read:

(3)… an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is

(d) made on the initiative of the organization to an investigative body… and the organization…

(i) has reasonable grounds to believe that the information relates to a breach of an agreement or a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or is about to be committed…

(h.2) made by an investigative body and the disclosure is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province…

In February, the Superior Court of Justice held this grant of discretion to make disclosures did not necessarily threaten Charter rights, so was not unlawful itself. It also held that RBC was not acting as a government agent in its investigation and therefore was not bound directly by the Charter.

The Court of Appeal affirmed the application judge’s reasoning and added that the “main protagonist” was in a solicitor-client relationship with RBC that stripped him of standing to make a section 8 claim: “In the circumstances, he cannot lay claim to a reasonable expectation of privacy in the records relating to the receipt and disbursement of funds received from his client concerning the suspect mortgage transactions.”

Royal Bank of Canada v. Ren, 2009 ONCA 48.