Every day, people post scores of comments online under avatars and pseudonyms thinking no one will know who they are.
But two recent Ontario court rulings have struck a blow to the notion of a “reasonable expectation of privacy” on the Internet.
In March, Ottawa lawyer Richard Warman took on the issue in a libel case against Constance Wilkins-Fournier, Mark Fournier, and eight John Does before the Ontario Superior Court.
Warman, well known for challenging operators of far-right websites for alleged human-rights infringements, is seeking redress for what he says are defamatory comments made on the freedominion.ca forum.
He, of course, doesn’t know who the John Does who allegedly posted the comments under pseudonyms are, which led him to bring a motion before the court in January to have the website operators, the Fourniers, provide him with information such as e-mail addresses, Internet Protocol addresses, and anything related to their account registration.
In their submissions, Warman’s lawyers argued the Fourniers had a duty to disclose the names during discovery under the rules of civil procedure, Justice Stanley Kershman wrote in his judgment in
Warman v. Wilkins-Fournier.
“My firm belief is they’re named parties to an action whether they’re John Does or not. They shouldn’t be able to use privacy arguments to shield themselves from civil liability,” says James Katz, an associate with Ottawa-based BrazeauSeller LLP who is representing Warman in the case.
Kershman ruled in Warman’s favour, a decision the Fourniers plan to continue to fight. “We were granted leave [to appeal] on the grounds that the case raised important issues related to anonymity and privacy on the Internet,” says their lawyer, Barbara Kulaszka.
The move comes as the courts continue to grapple with questions of Internet privacy in criminal investigations. In the recent Ontario Superior Court decision in
R. v. Wilson, for example, Justice Lynne Leitch considered an accused man’s challenge of Bell Canada’s decision to turn over his IP address information to police conducting a child pornography investigation.
Charged with possessing and making child pornography available, St. Thomas resident Miles Wilson argued the court shouldn’t admit evidence stemming from Bell’s actions since, by failing to get a warrant first, police had violated his rights against unreasonable search or seizure under the Charter of Rights and Freedoms.
In 2007, the investigating officer contacted Bell asking for information about the account holder of an IP address he had linked to illicit images.
In doing so, he referred to exemptions under the Personal Information Protection and Electronic Documents Act that allow businesses like Internet Service Providers to release otherwise private details to a government institution identifying its lawful authority to do so.
The officer also referred to his duties to conduct investigations under the Police Services Act, while the judgment notes Bell’s terms of service agreement with its customers allows it to disclose information when required by law.
Referring to those facts, Leitch ruled against Wilson’s motion. But in what surprised some observers, she decided that information related to an IP address isn’t private in the first place. “In my view, the applicant had no reasonable expectation of privacy in the information provided by Bell considering the nature of that information.
One’s name and address or the name and address of your spouse are not ‘biographical information’ one expects would be kept private from the state. It is information available to anyone in a public directory and it does not reveal, to use the words of Sopinka J. in Plant, ‘intimate details of the lifestyle and personal choices or decisions of the applicant.’”
The cases reveal what has become the Byzantine realm of adjudicating Internet privacy issues in recent years. “They need to be resolved really by the Supreme Court,” says David Young, a partner at Lang Michener LLP in Toronto who heads up the firm’s privacy law and e-commerce practice groups. “There’s a huge overlay of laws that has not been clarified.”
In Wilson, for example, the judge relied in part on triangulating arguments that the police act, PIPEDA, and Bell’s contractual terms authorized releasing the IP information.
The police act, for example, says officers can collect information through their duties to investigate crimes but, Young notes, they often need a warrant to do so. PIPEDA, as well, includes the above-noted exemption for government authorities, but Young argues that provision is confusing and misunderstood.
“The PIPEDA permits [releasing information] as long as there’s another legal rule,” he says, adding that the exemption is therefore not automatic for police and may still require an authority such as a warrant. As a result, he advises clients approached by police to always get that authority in writing before releasing private information to them.
With Bell’s terms of service, the same issue arises. It allows the company to disclose information without a customer’s consent in order to comply with legal orders such as a subpoena, a warrant or other requirements by law, meaning it is still fuzzy on whether judicial authorization is necessary, according to Young.
Young further questions Leitch’s ruling that Internet subscriber information isn’t private. “I don’t necessarily agree with that because that is still personal information,” he says, noting that linking an IP number with someone’s name and address can reveal a lot about their online activities and therefore their lives. “To say that simple name and address is innocuous and shouldn’t be protected I think is wrong.”
In Warman, however, Young says the legal issues were clearer. In that case, the issues came largely down to the question of privacy versus the rules of civil procedure. “[Disclosure] is obliged by the rules of civil procedure. In my view that’s what Warman says governs. They make clear that the rules of civil procedure basically trump everything else.”
In their arguments, the Fourniers said Warman needed to establish a prima facie case justifying disclosure before they should have to do so.
They referred to other court decisions backing up their claims, but as Katz points out, the particular Superior Court case they identified,
Irwin Toy Ltd. v. Doe, involved getting disclosure from e-mails related to third parties rather than from the litigants themselves. “We’re talking about different rules here,” he says.
The Fourniers also referred to the Internet file-sharing case in the Federal Court involving
BMG Canada Inc. v. John Doe. There, the judge ruled against disclosure because there wasn’t enough evidence against the
defendants in the first place, Kershman noted in his judgment.
But in ruling against the Fourniers, Kershman noted the provincial rules of civil procedure are stronger than federal ones on disclosure. As well, he made some reference to the seriousness of the issue at hand in Warman - that of alleged anti-hate speech - versus questions of copyright laws in BMG Canada.
Besides these two cases, the controversy over privacy rights on the Internet continues to rage elsewhere. Litigants in civil cases, for example, have battled over disclosing a party’s Facebook profile so the other side can look for evidence that might be relevant to the case.
Such instances have raised concerns that the party seeking Facebook access is simply going on a fishing expedition for evidence, but as Young points out, Ontario’s rules of civil procedure require that a request for disclosure be relevant and proportional.
They don’t mention privacy issues, but Young argues that such questions could fall under the proportionality requirement. “I could envision privacy certainly being considered by the court under proportionality.”
What is clear in his mind, however, is that privacy claims under the federal PIPEDA legislation don’t justify blocking disclosure in civil cases since that law doesn’t supersede the rules of civil procedure, an area of provincial jurisdiction.
He hopes, though, that the government will at least bring forward planned amendments to PIPEDA soon in order to clarify whether or not authorities, such as police, require a warrant or other legal backup to get companies like Bell to release private information to them.
“Then we would have the whole picture. We don’t know what they’re going to come out with on the PIPEDA amendments. They’ve got them ready to go. We just don’t know what they are.”
