Date: 20070205
Docket:
T-2228-05
Citation:
2007 FC 125
Ottawa, Ontario, February 5,
2007
PRESENT: The Honourable Mr. Justice Harrington
BETWEEN:
PHILIPPA LAWSON
Applicant
and
ACCUSEARCH INC. DBA ABIKA.COM
Respondent
and
THE PRIVACY COMMISSIONER OF CANADA
Intervener
REASONS FOR ORDER AND ORDER
[1]
Philippa
Lawson, like many Canadians, is concerned with the collection, use and
disclosure of personal information without consent. She is a lawyer and the
executive director of the Canadian Internet Policy and Public Interest Clinic
at the University
of Ottawa’s Faculty of
Law. The Clinic takes a deep interest in these matters.
[2]
Having
formed the view that Accusearch Inc., an American corporation, was routinely
collecting, using and disclosing (usually for a fee) personal information about
Canadians to Canadians and to others, for inappropriate purposes and without
the knowledge and consent of the individuals in question, she filed a complaint
with the Privacy Commissioner of Canada. She submitted that Accusearch Inc.’s
activities were contrary to the Personal Information Protection and
Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA). She called upon
the Commissioner to investigate.
[3]
After
protracted correspondence and discussion, on 18 November 2005 the Office of the
Privacy Commissioner, through Heather Black, Assistant Privacy Commissioner,
refused to investigate. Although the refusal deals with a number of issues, in
essence the Privacy Commissioner was of the view that PIPEDA did not give her
jurisdiction to investigate Ms. Lawson’s complaint. This is a judicial review
of that decision, a decision which raises important questions about the
extraterritorial effect of Canada’s laws and the jurisdiction of Canadian
tribunals absent a real and substantial connection with this country.
THE FACTS
[4]
Ms.
Lawson is a Canadian citizen. She resides and works here. Among other things,
her Clinic assists clients in the preparation of complaints to the Privacy
Commissioner and launches its own privacy complaints.
[5]
In
the winter of 2003-4 Ms. Lawson’s assistant was researching the practices of
Internet online businesses. She came across a website by the name of Abika.com,
which offered a variety of search services on individuals including background
checks, psychological profiles, email traces, unlisted and cell phone numbers, automobile
license plate details and criminal records. Many of these research services
were for sale. These searches were not limited to Americans, but extended to
persons in Canada as well as the United Kingdom, Australia, France, Germany, Russia, Italy, Hong Kong, Singapore, Japan and Taiwan.
[6]
Background
checks were offered on a “confidential basis” - that is to say, without the
consent of the individual who was the subject of the search. Ms. Lawson tested
the service by ordering a Canada background check on herself. She made this
request from Canada using her Canadian work email address and a mail server for
the University of Ottawa, which
server is located in Canada. She paid US$119 for the report, using a
Canadian credit card. An email from Abika.com confirmed the order and payment
and requested further details, which she provided. These were her Canadian
address, telephone number and date of birth.
[7]
The
search results were sent to Ms. Lawson’s work email address as requested. They
purported to contain the results of a criminal record search and “psychological
profile”. The criminal record search was apparently limited to Ontario and
indicated that she had no criminal convictions. She did not file the
“psychological profile” with the Court, but claims it is a useless piece of
fiction.
[8]
Using the Internet, the Clinic researched Abika.com.
Apparently, it is a division of Accusearch Inc., a Wyoming corporation
with its principal place of business in that state. According to the Office of
the Wyoming Secretary of State, the president, secretary and treasurer of
Accusearch Inc. is Jay Puler, address not provided. The registered agent is Jay
Patel, with a Cheyenne,
Wyoming address. Ms.
Lawson also determined that the domain name Abika.com was registered with an
American web hosting company. Its server is in the State of Delaware.
[9]
Ms.
Lawson initially complained to the Privacy Commissioner in June 2004. She
alleged that Abika.com, in the course of private commercial activities,
routinely collected, used and disclosed personal information about Canadians
for inappropriate purposes and without their knowledge or consent. Furthermore,
Abika.com was alleged to have compiled and disclosed inaccurate information
under its “psychological profile” service. She went on at some length to submit
that although based in the United States, Abika.com violated
PIPEDA in a number of respects.
[10]
I
pause to say that the Privacy Commissioner is not arguing the complaint was trivial,
frivolous, vexatious or made in bad faith; circumstances which would have
justified a refusal to prepare a report. It is clear that if Accusearch Inc.
were a Canadian corporation carrying on business in Canada through a website
located in Canada, Ms.
Lawson’s complaint would have been investigated.
[11]
The
Privacy Commissioner carried out a preliminary investigation designed to
determine whether she had jurisdiction under PIPEDA. She discovered and
informed Ms. Lawson that Accusearch Inc. appeared to operate another website,
Abika.ca, which denoted some connection with Canada. However,
this website was simply a conduit to connect with Abika.com. This led Ms.
Lawson to reformulate her complaint, which she did on 20 December 2004. It
should be mentioned that she also filed a complaint with the Federal Trade
Commission in the United States on the grounds that Abika appeared to be
violating various provisions of the U.S. Telecommunications Act of 1996
and the U.S. Fair
Credit Reporting Act.
THE PRIVACY COMMISSIONER’S
DECISION
[12]
In
declining to investigate the complaint on jurisdictional grounds, the Assistant
Privacy Commissioner raised a number of important legal issues which I believe
must be segregated and analyzed separately.
[13]
As
a matter of fact, the Commissioner contacted Abika.com in Wyoming. However,
she wrote: “Our investigation efforts have been frustrated by the fact that
Abika.com would not respond to our request for the names of its Canadian-based
sources.”
[14]
She
went on to say that in order to investigate Abika.com based in Wyoming, her Office
“…must have the requisite legislative authority to exercise our powers outside Canada.” She took
the point that the basic principles of sovereignty and comity under
international law mitigate against a country legislating outside its borders.
While Parliament may legislate with extraterritorial effect, this is rarely
done and, in her opinion was not done in this case. She added that normally,
“Canadian legislation will only apply to the persons, property, juridical acts
and events that occur within the territorial boundaries of the enacting body’s
jurisdiction.”
[15]
Since
Abika.com had not provided the names of its Canadian-based sources, she added
she would have “…no means of identifying – let alone investigating – those who
would represent a Canadian presence for this organization and further, have no
ability to compel an American organization to respond.”
[16]
She
said that the Abika.ca website denoted a Canadian presence, because the
Canadian Internet Registration Authority (a non-governmental organization)
would not otherwise grant such a registration. The registrant, however, could
be a Canadian citizen, but reside and work elsewhere. She was of the view that
the “.ca” registration was an insufficient connecting factor to indicate a real
and substantial link between Canada and Abika’s operation in the United
States.
[17]
She
shared Ms. Lawson’s concerns about the challenges posed by global electronic
commerce and the indiscriminate non-consensual collection, use and disclosure
of personal information by profiling and data broker organizations. She was
frustrated that PIPEDA did not give her Office jurisdiction with respect to
transborder data flow.
[18]
The
conclusion is most telling:
In conclusion, we
cannot proceed with your complaint as we lack jurisdiction to compel U.S.
organizations to produce the evidence necessary for us to conduct the
investigation. As a result, I am sorry to say that we have no choice but to
close this file. The organization has been so informed. However, you should
know that we have just recently launched an investigation in respect of a
similar organization where we have been able to identify the Canadian sources
of data.
ISSUES
[19]
Although on notice, the respondent, Accusearch Inc., has
ignored this judicial review. However, the Privacy Commissioner has intervened
in order to defend her decision.
[20]
Three
issues arise from this judicial review of her decision:
a.
As
a matter of statutory interpretation, did Parliament vest the Privacy
Commissioner with the authority to investigate complaints levied against
foreign organizations which collect, use and sell the personal information of
Canadians?
b.
If
so, does the Privacy Commissioner have the discretion to refuse to carry out an
investigation on the grounds that there are insufficient real and substantial
connections with Canada?
c.
What
is the standard of judicial review of the Privacy Commissioner’s decision;
correctness as submitted by Ms. Lawson or reasonableness simpliciter as
submitted by the Commissioner?
DISCUSSION
The
Standard of Review
[21]
This case rests to be decided on statutory interpretation;
more particularly, the scope of the Commissioner’s powers under PIPEDA. For the
reasons set out by the Federal Court of Appeal in Blood Tribe Department
of Health v. Canada (Privacy Commissioner), 2006 FCA 334, I am of
the view that the standard of review is correctness. I refer also to Society
of Composers, Authors and Music Publishers of Canada v. Canadian
Assn. of Internet Providers, 2004 SCC 45, [2004] 2 S.C.R. 427 [SOCAN]
at paragraphs 48 and 49.
The Meaning of PIPEDA
[22]
As declared countless times by the Supreme Court (Bell
ExpressVu Limited Partnership v. Rex, [2002] 2 S.C.R. 559, being but one
example), the provisions of a statute are to be interpreted in a contextual and
purposive way. The words used must be considered in context and in their
grammatical and ordinary sense in harmony with the scheme of the statute, its object
and the intention of Parliament.
[23]
PIPEDA is more fully described as being, “An Act to support
and promote electronic commerce by protecting personal information that is
collected, used or disclosed in certain circumstances, [and] by providing for
the use of electronic means to communicate or record information or
transactions...” Section 3 goes on to provide that the purpose of Part I of the
Act is:
…to establish, in an
era in which technology increasingly facilitates the circulation and exchange
of information, rules to govern the collection, use and disclosure of personal
information in a manner that recognizes the right to privacy of individuals
with respect to their personal information and the need of organizations to
collect, use or disclose personal information for purposes that a reasonable
person would consider appropriate in the circumstances.
Part I applies to
organizations which collect, use or disclose personal information in the course
of commercial activities. An organization “…includes an association, a
partnership, a person and trade union.” The issue here is whether PIPEDA
applies to a foreign organization.
[24]
Division II of Part I of the Act, sections 11 through 17,
is titled “Remedies”. An individual may file a written complaint with the
Commissioner that an organization has contravened a provision of the Act or has
not followed a recommendation set out in Schedule I, being the national
standard of Canada entitled “Model Code for the
Protection of Personal Information.” Under section 12 of PIPEDA, the
Commissioner shall conduct an investigation and to that end may issue subpoenas,
administer oaths, enter premises and copy records. The Commissioner may also
initiate her own complaints.
[25]
The Commissioner may attempt to conclude a complaint by
dispute resolution. Section 13 requires her to prepare a report unless she is
of the view that the complainant ought first to exhaust grievance or review
procedures otherwise available, or the complaint could be more appropriately
dealt with by means of a procedure provided for under other federal or
provincial law, or the complaint was stale dated when filed, or was trivial,
frivolous, vexatious or made in bad faith. After receiving the report, a
complainant may apply to this Court, which may, in addition to other remedies,
order an organization to correct its practices, publish a notice of such action
taken and condemn it to damages.
[26]
The events leading to the enactment of PIPEDA and its
purpose and meaning were extensively reviewed by Mr. Justice Décary in the
Federal Court of Appeal’s decision in Englander v. TELUS
Communications Inc., [2005] 2 F.C.R. 572, 247 D.L.R. (4th) 275.
There was no doubt in his mind that PIPEDA established a right to protection of
personal information collected, used or disclosed in the course of commercial
activities in connection with a business, be it interprovincial or
international. Ms. Lawson made the same point by referring to extracts from
Hansard. In Bell ExpressVu, above, and SOCAN, above, the
Supreme Court applied the Copyright Act and other statutes to
communications to and from Canada. As noted by Mr. Justice Binnie at
paragraph 68 of SOCAN, “…national practice confirms that either
the country of transmission or the country of reception may take
jurisdiction over a ‘communication’ link to its territory, although whether it
chooses to do so is a matter of legislative or judicial policy…”
[27]
With
respect, I think the Commissioner did not distinguish her power to investigate
from the effectiveness of her investigation.
[28]
I
agree with her that PIPEDA gives no indication that Parliament intended to
legislate extraterritorially. The Supreme Court reached that same conclusion in
SOCAN, above, but nevertheless held that the Copyright Act
applied to protected works downloaded in Canada from foreign
websites. The Commissioner does not lose her power to investigate because she
can neither subpoena the organization nor enter its premises in Wyoming.
[29]
The
parties have both drawn analogies from the jurisdiction of courts. This is
useful but cannot be carried too far. Although the Commissioner shares some
powers with a court, such as the power of subpoena, her office is not a
judicial tribunal. It is essentially an investigative tribunal. The
Commissioner’s jurisdiction must be considered ratione materiae (over
the subject matter), ratione personae (over the person) and ratione
loci (over the territory).
Jurisdiction
Ratione Materiae
[30]
Common
law courts generally take jurisdiction over all manners of dispute wheresoever arising.
The jurisdictional issue is usually whether the Court should take jurisdiction
over the defendant, or decline to do so because there is insufficient
connection with Canada. A good example is the decision of the Ontario
Court of Appeal in Bangoura v. Washington Post (2005), 258 D.L.R. (4th)
341. The Ontario courts had
jurisdiction over the substance of the lawsuit, which was an alleged
defamation. However, the Court refused to take jurisdiction over the defendant,
an American newspaper, at the instance of a plaintiff who at the time of the
alleged defamation was neither a Canadian citizen nor resident.
Jurisdiction
Ratione Personae
[31]
The
important distinction between jurisdiction ratione materiae and
jurisdiction ratione personae is not always apparent in decisions from
superior courts of record organized by the provinces because they have
unlimited jurisdiction over all manners of dispute, unless deprived thereof by
legislation. However, this distinction is often at the forefront of decisions
of this Court. The Federal Court only has jurisdiction ratione materiae if
Parliament has properly confided that jurisdiction to it (ITO –
International Terminal Operators Ltd. v. Miida Electronics Inc., [1986] 1
S.C.R. 752).
[32]
Consider
the decision of the Supreme Court in Holt Cargo Systems Inc. v. ABC
Containerline N.V. (Trustees of), [2001] 3 S.C.R. 907. In that case an
American stevedoring firm brought action in the Federal Court against a Belgian
ship for services rendered in the United States. It even invoked U.S. law which
gave it a maritime lien while Canadian domestic law did not. The only
connection with Canada was the presence of the ship here. There was no
question but that Parliament had given the Federal Court jurisdiction over the
subject matter of the dispute notwithstanding that none of the parties resided
and none of the events leading up to the arrest of the ship occurred here.
Section 22 of the Federal Courts Act gave the Court jurisdiction over
“any claim in respect of goods, materials or services wheresoever supplied to a
ship…including... claims in respect of stevedoring…”
[33]
The
issue was whether the Federal Court should exercise its jurisdiction ratione
personae particularly since there was a competing jurisdiction, Belgium. The Belgian
shipowner had filed in bankruptcy there. Basing himself on unique credit
arrangements which have developed in admiralty law over the millennia and the
fact that the ship was subject to a maritime lien under the proper law of the
dispute (U.S. law), Mr. Justice Binnie held that the Federal Court was right
not to stay or dismiss the Canadian proceedings (see also the decision of the
Federal Court of Appeal in United Nations v. Atlantic Seaways Corp.,
[1979] 2 F.C. 541).
[34]
A
Canadian court with jurisdiction ratione materiae will not take
jurisdiction over a foreign defendant, not served here, when the matter has
nothing to do with Canada. Even in cases where a foreign defendant is
served here, the court may dismiss or stay the action on the principle of forum
non conveniens, that there is a more appropriate court. The “real and
substantial connection” test is also relevant in determining whether the courts
in one province should enforce the judgment of another provincial court, and
whether a foreign judgment should be enforceable in Canada (see Morguard
Investments Ltd. v. De Savoye, [1990] 3 S.C.R. 1077; Muscutt v. Courcelles
(2002), 60 O.R. (3d) 20; Beals v. Saldanha, 2003 SCC 72, [2003] 3
S.C.R. 416).
[35]
It is important to keep in mind that when a Canadian court
takes jurisdiction over a dispute having connections with other countries, it may
under its own domestic conflict of law rules apply the appropriate foreign law
if proved as a matter of fact to differ from the law of the forum.
[36]
As noted by Chief Justice Laskin in Tropwood A.G. v.
Sivaco Wire & Nail Co., [1979] 2 S.C.R. 157 at pages 166-167:
What is raised by the appellant,
shortly put, is whether it is open to the Federal Court, in exercising its
jurisdiction in the matter brought before it, to determine, pursuant to
conflict of law rules of the forum, a choice of law rule to govern the
determination of the suit. In the present case, the Federal Court has
jurisdiction over the appellant and over the cause of action and there is a
body of law which it can apply. It is my opinion that this body of law embraces
conflict rules and entitles the Federal Court to find that some foreign law
should be applied to the claim that has been put forward. Conflicts rules are,
to put the matter generally, those of the forum. It seems quite clear to me
that s. 22(3) of the Federal Court Act, which I have already referred
to, envisages that the Federal Court, in dealing with a foreign ship or with
claims arising on the high seas may find it necessary to consider the
application of foreign law in respect of the cause of action before it.
[37]
PIPEDA,
however, does not, I would think, embrace conflict of law rules. This brings
into issue a third aspect of jurisdiction, ratione loci.
Jurisdiction
Ratione Loci
[38]
Parliament cannot have intended that PIPEDA govern the
collection and use of personal information worldwide. For instance, if Ms.
Lawson were an American working in the United
States, PIPEDA would have no application. Regulatory and
investigative functions (as opposed to judicial) must have some connection with
the state which enacts the underlying legislation. However, I believe the Privacy
Commissioner erred in law by taking the position that Ms. Lawson’s complaint
could only be investigated if Parliament had intended and had given
extraterritorial effect to PIPEDA.
[39]
The
fact that an investigation might be ineffective is not the point. While it is
true, as the Commissioner says, that her Office has no extraterritorial subpoena
power over a non-resident, neither does a court of law.
[40]
Private
parties in a lawsuit in Canada cannot compel a foreigner to appear here
to testify. Letters rogatory issued by a Canadian court to a foreign court
requesting that a subpoena be issued in that jurisdiction requiring the witness
to appear before a commissioner there are commonplace. By the same token,
section 46 of the Canada Evidence Act contemplates that a foreign court
or tribunal may likewise seek the aid of a Canadian court.
[41]
Although
the Commissioner faintly argued that there was no evidence of a connection with
Canada, that was
not the basis of her decision. Even if the “psychological profile” on Ms.
Lawson was pure fiction and written in the United States, much of the
data had to have come from Canada. The Commissioner acknowledged this in her
decision when she wrote: “Abika.com has not responded to our request for the
names of its Canadian-based sources.” The inability to identify Canadian
sources may frustrate an investigation, but it cannot be said that PIPEDA
should be interpreted in such a way that Parliament did not give the
Commissioner jurisdiction. The Commissioner’s last sentence is inconsistent
with her position that Parliament did not grant her jurisdiction. She wrote:
“You should know that we have just recently launched an investigation in
respect of a similar organization where we have been able to identify the
Canadian sources of data.”
[42]
It
would be most regrettable indeed if Parliament gave the Commissioner
jurisdiction to investigate foreigners who have Canadian sources of information
only if those organizations voluntarily name names. Furthermore, even if an
order against a non-resident might be ineffective, the Commissioner could
target the Canadian sources of information.
[43]
I
conclude as a matter of statutory interpretation that the Commissioner had
jurisdiction to investigate, and that such an investigation was not contingent
upon Parliament having legislated extraterritorially as permitted by the
Statute of Westminster.
May
the Privacy Commissioner decline to investigate?
[44]
Both
Ms. Lawson and the Commissioner took the position that PIPEDA either gave her
jurisdiction to investigate the complaint, or it did not. Both were of the view
that if Parliament gave the Commissioner jurisdiction, then she must
investigate. Section 12 of PIPEDA provides: “The Commissioner shall
conduct an investigation in respect of a complaint…” [Emphasis added]. Section
13 goes on to provide that she shall prepare a report containing findings and
recommendations, any settlement that was reached and, if not, identifying recourses
which may be available. However, as mentioned earlier, the Commissioner is not
required to prepare a report if satisfied that the
complainant ought first to exhaust grievance or review procedures otherwise
reasonably available; if the complaint could more appropriately be dealt with under
other federal or provincial law or is stale dated, trivial, frivolous, vexatious
or made in bad faith.
[45]
It
is common ground that there are no grievance or review procedures otherwise
reasonably available, the complaint was timely and was not trivial, frivolous, vexatious
or made in bad faith.
[46]
One
issue which could be considered is whether it would be more appropriate that
the complaint be dealt with by means of a procedure provided under federal or
provincial law.
[47]
One
possibility under provincial law is an action in defamation. However the facts
of this case cannot support such an action. Even assuming the information in
the psychological profile to be untrue, so far it was only communicated to Ms.
Lawson herself. An action in defamation requires communication to someone else.
[48]
The
Commissioner herself cannot award damages. However, section 14 of PIPEDA
provides that a complainant may, after receiving the Commissioner’s report,
apply to this Court for a hearing and that this Court may, among other things,
award damages. Ms. Lawson is unable to make such an application because no
report has been issued. A money judgment may be enforced in another
jurisdiction (Pro Swing Inc. v. Elta Golf Inc., 2006 SCC 52).
[49]
We revert to geographical considerations, and the concept
of forum
non conveniens. The collection and communication of private information
was both here (Canada) and there (United States) (Libman v. The
Queen, [1985] 2 S.C.R. 178). The location of the website and the
jurisdiction in which Accusearch Inc. was incorporated are not all controlling.
[50]
It
would not be appropriate to comment further on the discretion, if any, of the
Commissioner to decline to exercise the jurisdiction given her by Parliament. The
decision before me was that Parliament had not given her jurisdiction. However,
I raise this point of discretion because it may be relevant when this matter is
referred back to her for further investigation, or in other complaints. We do
not know the status of the complaint filed in the United States, or the risk
of double jeopardy to the respondent.
[51]
In
conclusion, PIPEDA gives the Privacy Commissioner jurisdiction to investigate
complaints relating to the transborder flow of personal information.
ORDER
THIS COURT
ORDERS that this application for judicial review is granted with costs.
The matter is returned to the Office of the Privacy Commissioner to be
investigated in accordance with the reasons given.
“Sean
Harrington”
Email this Content