IPC Ontario says a disclosure on the internet is just another disclosure

The Information and Privacy Commissioner/Ontario issued a notable investigation report on March 20th. It held that the City of Vaughan did not breach the Municipal Freedom of Information and Protection of Privacy Act by publishing personal information from a minor variance application on the internet.

The information in a minor variance application is required by statute to be accessible to the public, but by statutory language that speaks to “making available” and allowing for “inspection.” The complainant did not take issue with access to her information, but did not want her information published on the internet. The IPC essentially held that disclosure was authorized, and also that disclosure by internet publication was just another disclosure. Its key text is as follows (with my emphasis):

A concern raised in Gombu was that disclosing records in an electronic format was detrimental
to privacy because it removed the de facto privacy protection created by the relative obscurity of
paper records. As noted by the Court, circumstances have changed such that records are expected
to be provided in electronic format. Part of this is the ease of use for individuals wishing to
access records and databases which in turn increase transparency. Indeed, in Gombu this was the
complainant’s stated purpose for requesting an electronic copy of the database.

In confirming that the records could be disclosed in bulk electronic format, the Court noted that
this would make them more easily accessible with minimal further intrusion upon personal
information contained within given that they were already subject to disclosure.

In the circumstance of this complaint, sections 1.0.1. and 44(10) of the Planning Act and 253 of
the Municipal Act, taken together, specifically override the privacy interest of individuals
engaging the minor variance process and, as in Gombu, mandate the disclosure of personal
information in association with that process. I conclude that the City’s decision to disclose the
complainant’s personal information in electronic format is in compliance with the Act.

In response to the argument that this information should not be disclosed via the Internet, in the
circumstances of this complaint I cannot identify any basis that would prohibit information
otherwise subject to the section 32 exceptions from being disclosed via the Internet. I note that
Committees of Adjustment are required to demonstrate accountability via a transparent process
that permits individuals to participate, scrutinize and to hold institutions such as the City
accountable. As such, making these records available online facilitates this goal in a manner
consistent with the Act.

The IPC praised the City for administering a public record redaction procedure that allows individuals to request redaction. It also said the City should explore the use of web search exclusion technologies so that personal information it publishes on the internet is not readily searchable. This seems like a recommendation about best practices rather than one that is rooted in the statute.

Privacy Complaint Report MC13-67

Case Report – Court denies ex parte motion to preserve Facebook

On October 29th, Price J. of the Ontario Superior Court of justice denied a motion for an ex parte order for preservation of a plaintiff’s Facebook.

The motion was brought by a defendant to a personal injury claim. It brought its motion ex parte on the basis that the plaintiff would be likely to destroy evidence if notified. It therefore had to meet the three-part test from R.J.R.-MacDonald in order to receive interim relief pending a return to court to deal with the matter of production. The Defendant brought its motion on the strength of several photos it had obtained from non-password protected Facebook pages. These showed the plaintiff  after the date of the accident doing things that were arguably consistent with her claim for damages in respect of a significantly curtailed lifestyle – i.e. the pictures showed her sitting and reclining on a floor. Neither these photographs nor any other records from the plaintiff’s Facebook were disclosed in her Affidavit of Documents.

The Court held that the defendant had not adduced any evidence that allowed it to conclude that the plaintiff’s Facebook was likely to contain relevant information and that it would not infer from the nature of the Facebook service that the plaintiff’s Facebook was likely to contain such information. On the inference, Price J.’s decision ought to be viewed to be in conflict with the Court’s prior decisions in Leduc v. Roman and Wice v. Dominion General Insurance Company of Canada. Price J. says:

I do not regard the mere nature of Facebook as a social networking platform or the fact that the Plaintiff possesses a Facebook account as evidence that it contains information relevant to her claim or that she has omitted relevant documents from her Affidavit of Documents. The photographs that the Defendant has obtained from the Plaintff’s account in the present case do not appear, on their face, to be relevant.

Price J. did grant leave to cross-examine the plaintiff on her Affidavit of Documents. He forgave the defendant for not doing so at the plaintiff’s examination for discovery “because Facebook is a relatively recent phenomenon” but specified that the defendant would pay the costs of the examination should it prove fruitless.

Finally, in addressing the balance of convenience, Price J. made the following statement about the balance of convenience:

The Plaintiff has set her Facebook privacy settings to private and has restricted its content to 67 “friends.” She has not created her profile for the purpose of sharing it with the general public. Unless the Defendant establishes a legal entitlement to such information, the Plaintiff’s privacy interest in the information in her profile should be respected.

The concept (reflected in this paragraph) that an expectation of privacy can be maintained despite a limited disclosure of information is supported by privacy advocates, but is not often accepted by courts.

Schuster v. Royal & Sun Alliance Insurance Company of Canada, 2009 CanLII 58971 (S.C.J.).

Case Report – Court orders disclosure of anonymous message board users’ identities

On March 23rd, the Ontario Superior Court of Justice ordered the owner/operator of a right-wing internet message board to disclose the identities of eight John Doe defendants who had posted commentary about lawyer Richard Warman.

There are two significant aspects of the decision.

First, the Court seemed to distinguish the BMG case (where the Federal Court of Appeal endorsed a protective balancing test) on the basis that the plaintiff filed an action directly against the website owner/operator. Website owner/operators may question whether their status as first or third parties should really make a difference.

Second, the Court relied on recent search and seizure cases that have endorsed voluntary identification of internet users by ISPs to police based on permissive ISP terms of service. It used these cases to draw a general conclusion that individuals cannot reasonably expect online anonymity. Though specific terms of service should govern, this aspect of the decision illustrates that ISP policy favouring disclosure to police may affect users’ right of anonymity as against potential civil claimants.

Hat tip to Michael Geist for his leading post.

Warman v. Wilkins-Fournier (23 March 2009, Ont. S.C.J.).