Canada Federal Court of Ottawa’s against Globe24h.com
The Canada Federal Court of Ottawa, in the person of Mr Justice Mosley, issued on 30th January 2017 decision (docket T-1248-15) as between A.T. applicant, Globe24h.com and Sebastian Radulescu respondents and the Privacy Commissioner of Canada added respondent relating to personal information protection.
The Court declares and orders (official):
1) It is declared that the Respondent, Sebastian Radulescu, contravened the Personal Information Protection and Electronics Documents Act, SC 2000, c5 by collecting, using and disclosing on his website, www.Globe24h.com (“Globe24h.com”), personal information contained in Canadian court and tribunal decisions for inappropriate purposes and without the consent of the individuals concerned;
2) The Respondent, Sebastian Radulescu, shall remove all Canadian court and tribunal decisions containing personal information from Globe24h.com and take the necessary steps to remove these decisions from search engines caches;
3) The Respondent, Sebastian Radulescu, shall refrain from further copying and republishing Canadian court and tribunal decisions containing personal information in a manner that contravenes the Personal Information and Electronic Documents Act, SC 2000, c5: a) The Respondent, Sebastian Radulescu, shall pay the Applicant damages in the amount of $5000; b) The Applicant is awarded costs in the amount of $300; and c) The style of cause is amended to substitute the initials “A.T.” for the name of the applicant.
Journalism is the sole scope of Globe24h.com
A Romanian citizen runs a server located in his state. He is the owner of a site called Globe24h.com whose name testifies what should be his activity’s scope: journalism. News and information available worldwide 24 hours a day. In his conception of information that everyone should be granted to reach, judicial precedents are included.
For this reason, in 2013 Mr Sebastian Radulescu makes a virtual trip to Canada and takes back a lot of souvenirs. Specifically, he visits two legal sites, Canadian Legal Information institute and Société Québécoise d’Information Juridique and starts to download. By automatic and manual means he downloads huge amount of data then, makes them available to search engines for indexing.
Indexing is not always a good thing for privacy
The first problem is that downloaded data are all decisions from Canadian courts, a total of 245, and the second is that legal sites stored their content only to the purpose to be consulted within the site, forbidding third parties to index it. Indexing consent search engines to make content available to any user entering a query in their search box, even if not interested at all in judicial matters.
However, Mr Radulescu can not help himself to limit his downloading and the Canadian Legal Information Institute soon begins to suspect something is going wrong. Once the Canadian site registers a bulck download from a Romanian IP address, bans the IP address blocking any further action.
Not long after, the same site receives a lot of complaints.
Personal data under everybody’s eyes
They are filed by parties which participated to proceedings and whose names where reported within decisions’ text. It happens that any user of Google, or of any other search engine that indexed Globe24h.com content, entering one’s name could be acquainted with him or his family personal information.
Sensitive data like divorce, immigration, health issues and personal bankruptcies are immediately under friends, co-workers, neighbours, children’s eyes. And, to add insult to injury, on the search results pages of Globe24h.com ads with pornographical content are displayed right beside decisions with personal data.
Swamped with complaints, the owner of Globe24h.com makes requesters sure that he can easily remove the decisions. Here comes another problem or the methods of removal.
Indeed, requesters are allowed to choose method.
Choosing the method of removal, by payment or for free
The express removal of personal information is processed within 72 hours by paying a € 19 fee per document. It guarantees data removal from Google index too, but you have to pay before even asking, you know, to dissuade individuals making fraudulent removal requests.
Time passed and things changed. Globe24h.com updates its method and charges € 200 to fully remove one decision from its own server and from Google within 24 hours, but only after the payment is confirmed.
The second method is contacting Globe24h.com staff if you prefer the decision to be edited form errors or data that may infringe privacy rights. A formal request must be send via email attaching an exact issue description and a link to the document.
Well, it is a pity that it would take Globe24h.com a minimum of 180 days and Google 1 year but at least it is for free. Globe24h.com updates the free removal method too.
As time of process is shortened from 180 to 15 days, the amount of information needed is increased. They ask requesters not only reference to decision but also: full name or his legal authority to act on behalf of another person, complete address and phone number, email, signature, a notarized and a printed copy of a government-issued photo identification document.
Besides, the requester can choose to seek for removal by entering a form to which attach all the above-mentioned data with the exception of phone number.
Globe24h.com will process the request within 15 days but will not remove full document from the server or from Google or any other search engine’s cache limiting the removal to personal data.
One particular among many requesters does not agree with the proposed methods nor with the fact that a decision regarding his labour relations with his former employer could be easily read by any Google’s user and pulls the trigger to the case.
The court case
The Office of the Privacy Commissioner of Canada was submitted with the applicant’s claim on May 2014. Following an in-depth investigation, the OPCC released a report of findingsagainst Globe24h.com for infringement of Personal Information Protection and Electronic Documents Act (PIPEDA). On October 2015 the case is set before the Canada Federal Court of Ottawa, which issued the decision on 30th January 2016.
OPCC, applicant and respondent thesis
The Office of the Privacy Commissioner of the Canada (OPCC) concludes that the respondent republishes online publication of Canadian court and tribunal decisions containing personal information to make profit. It permitts search engines to relocate decisions returning them among search results although forbidden by Canadian legal webistes because who is seeking a decision must go to the legal site and search for direct information. The OPCC received 38 complaints while the Canadian Legal Information Insititute received over 150 complaints prior to April 2016.
Requests of the applicant
The applicant objectes that Globe24h.com asked for payment to remove one version of the decision and the free removal service requires a written applicance with further personal information and a higher timeline to obey. He seeks for an order for all damages suffered; an order to correct the practices, an order to publish a notice of corrected practices complying with PIEPDA provisions, an order for an injunction, a declaration of infringement of privacy legislation, an order of removal of the decisions, an order that the respondent is a vexatious litigant and an order for costs.
Publicly available exception
The respondent Radulescu, that does not partecipate to the proceedings, formerly communicated to OPCC that no consent of the concerned individuals was required because Globe24h.com’s purpose is exclusively journalistic and outlined a publicly available exception because the content was already publicly available. About the removal on payment, the respondent mantains that the purpose is to prevent fraudolent removal requests.
The Ottawa court’s decision motivated
The case is summoned under Section 14 of the Personal Information Protection and Electronic Documents Act, SC 2000, c. 5 or PIPEDA under these premises. Globe24h.com collectes and republishes decisions from judicial and administrative websites without consent of concerned individuals or courts, allowing these decisions to be indexed by search engines. Moreover, Globe24h.com seeks for payment to remove information, increasing the amount of the fee to fasten the process while imposing requester’s additional personal information to make it for free. Furthermore, Globe24 sells spaces to advertisers on the pages containing decisions.
Why PIPEDA has been applied to the case
Analyzing whether PIPEDA should be applied to Globe24h.com, the court finds that, being it a foreign based organization, being PIPEDA part of an international legal system of law entitled to protect the privacy of individuals as well as European Data Protection Directive does, and with regards to judicial precedents, PIPEDA can be applied to cross-border activities that have any real and substantial connection with Canada, as unlawful consequences, without offending the principle of comity.
Second, the court acknowledges that collecting, using and disclosing personal information in the course of commercial activities makes Globe24h.com an organization thus falling under PIPEDA provisions.
Moreover, its commercial purpose of organization is revealed by generating revenues from advertisements displayed on its pages and from the fees charged to remove personal information of the concerned individuals.
Third, the court finds that Globe24h.com purposes cannot be considered exclusively journalistic; in fact, the decisions were already accessible for free by Canadian legal websites.
The real purpose considered is the exploitation of the content, incentivizing individuals to pay to have their personal information removed from Globe24h.com and generating advertising revenue by driving traffic to his website from search engines.
Fourth, the court finds that Globe24h.com does not complies with PIPEDA on the basis of bona fide business interest and loss of privacy proportional to benefits gained since Canadian legal websites do not allow republishing their content by third parties to prevent information to be unintentionally available through search engines.
Otherwise, it enables users not actually interested in finding court records harming privacy and security of partecipants.
Fifth, the court outlines that records or documents of judicial bodies in question are not to be considered publicly available since it is missing the purpose for which the personal information appears in the decision under Regulations Specifying Available Information paragraph 1(d). Globe24h.com purpose of exploitation is not related to the open courts principle that requires court proceedings to be open and accessible to the public and to the media.
Corrective order, declaratory relief and their extraterritorial effects
Therefore, the court grants a corrective order combined with a declaratory relief with extraterritorial effects requiring the respondent to correct his practices in order to comply with PIPEDA provisions under sections 5 to 10 to the extent that the respondent, although Romanian, downloads personal information from Canadian websites and makes profit from Canadian by the fees.
The court, considers justifiable the broad effect because the respondent’s actions are not confined to the single applicant at issue.
Furthermore, it entitles every concerned individual to submit a request to Google or other search engines to remove links to decisions on Globe24h.com from their search results, to the extent that Google’s policy allow users to submit such a request where a content is judicially declared unlawful.
As to the damages, the court awards the applicant of $5000 considering the commercial exploitation and act in bad faith over further $ 300 of pocket costs.
The decision is issued pursuant to Personal Information Protection and Electronic Documents Act, SC 2000, c 5 related to definition of organization, of purpose to govern collection, use and disclosure of personal information in technology era recognizing the right of privacy, of application and limits, of acting without knowledge or consent, of examination, application, and remedies proposed by the court.
Recurring problems on the right to be forgotten
The decisions outlines recurring problems in the field of relationship between technology and law. Specially when it is involving protection of open data as to say judicial decisions with parties names, the only available remedies appear to be prohibition of indexing decisions or limiting their use to the same purpose with they came, but often they are weakened by public interest in the name of principle of open court.
Model Policy in Canada
As to Canadian law in question, the Canadian Judicial Council’s Judges Technology Advisory Committee posted a “Model Policy for Access to Court Records in Canada” concerning electronic access to court records where it is stated that the open court principle is restricted when is needed to address risks to individual privacy and security rights or proper administration of justice but only if benefits of restrictions outweigh their negative effects on the open court principle; anyway, if a decision is posted on internet, the Model Policy states, website that locate it should not permit indexing and cache storing from web spiders in order to avoid common availability of infomation.
Secondly, judgements and consequent orders are often against non-resident organizations, raising issues in terms of extraterritoriality of the data protection laws. Courts, EU and abroad, use to apply internal law to the extent that the actions examined are directly affecting the State or its citizens but corrective orders are so not enforceable abroad that Ottawa’s court suggested concerned citizens to make up by themselves through Google’s removal forms.
It could be considered another example of how much government and internet provider are getting a closer cooperation.
Other similar cases
The decision in case is consistent with a landmark decision in the matter of search engine and respect of personal data, Google v Costeja Gonzalez, issued by EU Court of Justice.
Other similar cases are recorded in France and Germany where courts ordered search engines to de-index contents with personal information in it to help enforce privacy injunctions.