[2017] 4 F.C.R. 310
T-1248-15
2017 FC 114
A.T. (Applicant)
v.
Globe24h.com and Sebastian Radulescu (Respondents)
and
The Privacy Commissioner of Canada (Added respondent)
Indexed as: A.T. v. Globe24h.com
Federal Court, Mosley J.—Calgary, November 9, 2016; Ottawa, January 30, 2017.
Privacy — Personal Information Protection and Electronic Documents Act — Application under PIPEDA, s. 14 stemming from Office of the Privacy Commissioner of Canada (OPCC) report determining that applicant’s complaints against respondents well-founded — Respondent Sebastian Radulescu republishing Canadian decisions on Romanian-based website Globe24h.com — Decisions therein indexed, revealing individuals’ names, sensitive information through search engines such as Google — Applicant’s labour relations case republished on Globe24h.com — Respondent requiring fee from applicant to remove his personal information from Globe24h.com — OPCC concluding, inter alia, PIPEDA applying to Globe24h.com; journalistic purpose exception (PIPEDA, s. 4(2)(c)), publicly available information exception (PIPEDA, ss. 7(1)(d), 7(2)(c.1), 7(3)(h.1)) not applying to Globe24h.com’s activities; underlying purpose of Globe24h.com not appropriate under PIPEDA, s. 5(3) — Whether: PIPEDA having extraterritorial application to Globe24h.com; respondent’s purpose “appropriate”; “publicly available” exception applying — PIPEDA applying to respondents’ activities — Issue herein whether real, substantial connection between respondents, Canada — Physical location not determinative — Content at issue, target audience, impact on Canadians connecting factors — Principle of comity not offended where foreign activity having unlawful consequences in Canada — Given involvement of Romanian counterpart to OPCC, Court’s findings complementing any action taken in Romanian court — Respondent “organization” within meaning of PIPEDA, s. 4(1)(a) — Respondent’s claimed purpose not “journalistic” — Exemption under PIPEDA, s. 4(2)(c) only applying where information collected, used or disclosed exclusively for journalistic purposes — Balance having to be struck between open courts principle, increasing online access to court records where privacy, security at issue — Respondent needlessly exposing sensitive personal information of participants in justice system — “Publicly available” exception under PIPEDA, s. 7 not available to respondent — Judicial documents publicly available only under certain conditions — Broadly crafted corrective order granted under PIPEDA, s. 16(a) — Damages awarded — Application allowed.
This was an application under section 14 of the Personal Information Protection and Electronic Documents Act (PIPEDA) stemming from a report of findings prepared by the Office of the Privacy Commissioner of Canada (OPCC) wherein the OPCC determined that the applicant’s complaints against the respondents are well-founded.
The respondent Sebastian Radulescu is the sole owner and operator of Globe24h.com, a Romanian-based website that republishes public documents, including Canadian court and tribunal decisions that are available on Canadian legal websites. Notably, the content of the Canadian legal websites is generally not indexed by search engines such as Google, whereas decisions that are republished on Globe24h.com are so indexed. Thus, a decision containing an individual’s name will generally appear in search results when a name is entered in a search engine. Many individuals complained to the OPCC alleging that decisions posted on Globe24h.com contained sensitive personal information about them or their family members. The complainants particularly objected to the fact that the respondent was seeking payment for the removal of the personal information from the website.
The applicant was a party in labour relations proceedings involving his former employer. A decision by the Alberta Labour Board concerning his case was republished through Globe24h.com. The applicant contacted Globe24h.com and requested that his personal information be removed. The respondent informed the applicant that he would have to pay a fee to remove his information. The Romanian counterpart to the OPCC fined the respondent for contravening Romanian data protection laws. The OPCC concluded, inter alia, that PIPEDA applies to Globe24h.com as a foreign-based organization; that the journalistic purpose exception under paragraph 4(2)(c) of PIPEDA does not apply to the respondent’s activities; that the underlying purpose of Globe24h.com cannot be considered as appropriate from the perspective of a reasonable person under subsection 5(3) of PIPEDA; and that the publicly available information exception (PIPEDA, ss. 7(1)(d), 7(2)(c.1) and 7(3)(h.1)) does not apply to Globe24h.com’s activities.
The main issues were whether PIPEDA has an extraterritorial application to Globe24h.com as a foreign-based organization; whether the respondent’s purpose for collecting, using and disclosing personal information is “appropriate” under paragraph 5(3) of PIPEDA; and whether the “publicly available” exception applies to the personal information republished on Globe24h.com under section 7 of PIPEDA.
Held, the application should be allowed.
As the respondents are foreign-based, the issue herein was whether there is a real and substantial connection between them and Canada to find that PIPEDA applies to their activities. When an organization’s activities take place exclusively through a website, the physical location of the website operator and host server is not determinative because telecommunications occur “both here and there”. The OPCC highlighted three key connecting factors between Globe24h.com and Canada: the content at issue, i.e. Canadian court and tribunal decisions containing personal information; the website’s target audience, i.e. Canadians; and the impact of the website on members of the Canadian public. Efforts by the Romanian authorities to curtail the respondent’s activities and their cooperation with the OPCC investigation are not sufficient reason not to exercise PIPEDA’s jurisdiction in this context. The principle of comity is not offended where an activity takes place abroad but has unlawful consequences here. Legitimate judicial acts should be respected and enforcement not sidetracked or ignored. The legitimate judicial acts of the Court would not be seen as offending the principle of comity. Given the involvement of the Romanian counterpart to the OPCC, the Court’s findings would complement rather than offend any action that may be taken in a Romanian court.
The respondent is an “organization” within the meaning of paragraph 4(1)(a) of PIPEDA and his activities are commercial in nature. The respondent’s claimed purpose “to make law accessible for free on the Internet” on Globe24h.com cannot be considered “journalistic”. The respondent’s primary purpose is to incentivize individuals to pay to have their personal information removed from the website. Even if the respondent’s activities could be considered journalistic in part, the exemption under paragraph 4(2)(c) only applies where the information is collected, used or disclosed exclusively for journalistic purposes. A reasonable person would not consider the respondent to have a bona fide business interest. A balance must be struck between the open courts principle and increasing online access to court records where the privacy and security of participants in judicial proceedings will be at issue. The respondent’s actions result in needless exposure of sensitive personal information of participants in the justice system via search engines.
There is no reasonable basis on which the respondent could rely on the “publicly available” exception under section 7 of PIPEDA. Section 7 must be read in conjunction with paragraph 1(d) of the Regulations Specifying Publicly Available Information, which specify that records or documents of judicial or quasi-judicial bodies are to be considered publicly available provided certain conditions are met. The respondent’s purposes in republishing decisions do not “relate directly” to the purpose for which the personal information appears in the decisions.
Finally, a broadly crafted corrective order requiring the respondent to correct his practices to comply with sections 5 to 10 of PIPEDA was granted under section 16(a) of PIPEDA. The respondent’s breach was egregious because the respondent essentially made a business of exploiting the privacy of individuals for profit. Damages were awarded based largely on the conduct of the respondent.
STATUTES AND REGULATIONS CITED
Canadian Charter of Rights and Freedoms, being Part I of the Constitution Act, 1982, Schedule B, Canada Act, 1982, 1982, c. 11 (U.K.) [R.S.C., 1985, Appendix II, No. 44].
Copyright Act, R.S.C., 1985, c. C-42.
Federal Courts Rules, SOR/98-106, rr. 38, 305.
Personal Information Protection Act, S.A. 2003, c. P-6.5.
Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, ss. 2 “organization”, “personal information”, 3, 4, 5, 6, 7, 8, 9, 10, 12, 14, 16, Sch. I, clause 4.3.
Privacy Act, R.S.C., 1985, c. P-21, s. 53.
Regulations Specifying Publicly Available Information, SOR/2001-7, s. 1(d).
TREATIES AND OTHER INSTRUMENTS CITED
Convention on the Service Abroad of Judicial and Extrajudicial Documents in Civil or Commercial Matters, The Hague, 15 November 1965, [1989] Can. T.S. No. 2.
CASES CITED
APPLIED:
Society of Composers, Authors and Music Publishers of Canada v. Canadian Assn. of Internet Providers, 2004 SCC 45, [2004] 2 S.C.R. 427; Equustek Solutions Inc. v. Google Inc., 2015 BCCA 265, 386 D.L.R. (4th) 224, leave to appeal to S.C.C. granted [2016] 1 S.C.R. xi; Libman v. The Queen, [1985] 2 S.C.R. 178; Chevron Corp. v. Yaiguaje, 2015 SCC 42, [2015] 3 S.C.R. 69.
DISTINGUISHED:
Club Resorts Ltd. v. Van Breda, 2012 SCC 17, [2012] 1 S.C.R. 572.
CONSIDERED:
United Food and Commercial Workers, Local 401 v. Alberta (Attorney General), 2012 ABCA 130 (CanLII), 522 A.R. 197, affd 2013 SCC 62, [2013] 3 S.C.R. 733; Barrick Gold Corp. v. Lopehandia, 2004 CanLII 12938, 71 O.R. (3d) 416 (C.A.); Englander v. Telus Communications Inc., 2004 FCA 387, [2005] 2 F.C.R. 572; Donaghy v. Scotia Capital Inc., 2007 FC 224, 320 F.T.R. 9; Jodhan v. Canada (Attorney General), 2012 FCA 161, [2014] 1 F.C.R. 185, affg 2010 FC 1197, [2011] 2 F.C.R. 355; Nammo v. TransUnion of Canada Inc., 2010 FC 1284, [2012] 3 F.C.R. 600; Girao v. Zarek Taylor Grossman, Hanrahan LLP, 2011 FC 1070, 338 D.L.R. (4th) 262.
REFERRED TO:
A.B. v. Canada (Minister of Citizenship and Immigration), 2009 FC 325, [2010] 2 F.C.R. 75; E.F. v. Canada (Citizenship and Immigration), 2015 FC 842, 37 Imm. L.R. (4th) 152; Lawson v. Accusearch Inc., 2007 FC 125, [2007] 4 F.C.R. 314; Davydiuk v. Internet Archive Canada, 2014 FC 944, 127 C.P.R. (4th) 262; Desjean v. Intermix Media, Inc., 2006 FC 1395, [2007] 4 F.C.R. 151, affd 2007 FCA 365, 41 B.L.R. (4th) 78; Turner v. Telus Communications Inc., 2005 FC 1601, 284 F.T.R. 38, affd 2007 FCA 21, [2007] 4 F.C.R. 368; Impulsora Turistica de Occidente, S.A. de C.V. v. Transat Tours Canada Inc., 2007 SCC 20, [2007] 1 S.C.R. 867; APC v. Auchan Telecom, 11/60013, Judgment (28 November 2013) (Tribunal de grande instance de Paris); Mc Keogh v. John Doe 1 & Ors, [2012] IEHC 95; Mosley v. Google, 11/07970, Judgment (6 November 2013) (Tribunal de grande instance de Paris); ECJ Google Spain SL, Google Inc. v. Agencia Espanola de Protección de Datos, Mario Costeja González, C-131/12 [2014], CURIA; Townsend v. Sun Life Financial, 2012 FC 550, 103 C.P.R. (4th) 424; Chitrakar v. Bell TV, 2013 FC 1103, 441 F.T.R. 254.
AUTHORS CITED
Canadian Judicial Council. Model Policy for Access to Court Records in Canada, September 2005.
Office of the Privacy Commissioner of Canada. PIPEDA Report of Findings #2015-002, June 5, 2015.
Organization for Economic Co-operation and Development. Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.
Sharpe, Robert J. Injunctions and Specific Performance, loose-leaf, Toronto: Canada Law Book, November 2002.
APPLICATION under section 14 of the Personal Information Protection and Electronic Documents Act stemming from a report of findings (PIPEDA Report of Findings #2015-002) prepared by the Office of the Privacy Commissioner of Canada determining that the applicant’s complaints against the respondents are well-founded. Application allowed.
APPEARANCES
A.T., on his own behalf.
Regan Morris and Sarah Speevak for added respondent.
SOLICITORS OF RECORD
Office of the Privacy Commissioner of Canada, Gatineau, for added respondent.
The following are the reasons for judgment and judgment rendered in English by
Mosley J.:
I. INTRODUCTION
[1] This de novo application under section 14 of the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA or the Act) raises questions about the open courts principle, international comity, and extraterritoriality in a digital age.
[2] The application stems from a report of findings dated June 5, 2015 [PIPEDA Report of Findings #2015-002], prepared by the Office of the Privacy Commissioner of Canada (OPCC) wherein the OPCC determined that the applicant’s complaints against the Romania-based respondents, Sebastian Radulescu and Globe24h.com, are well-founded.
[3] For the reasons that follow, the application will be granted and judgment rendered in favour of the applicant.
II. BACKGROUND
A. The parties
[4] The applicant, A.T., resides in Calgary, Alberta. He is originally from Romania and continues to have family there. At his request, and having considered the open court principle, the Court has agreed to substitute initials for his name to offer a measure of protection of his identity. His full name appears in Court documents served on the respondents in this matter but will not appear in the public online version of this decision.
[5] The respondent Sebastian Radulescu is the sole owner and operator of Globe24h.com, a Romanian-based website that republishes public documents from a number of countries, particularly Canada. While Globe24h.com has also been named as a respondent in this application, there is no evidence in the record that the website is a separate legal entity or that anyone other than Mr. Radulescu controls the website. I will refer to Mr. Radulescu and Globe24h.com collectively as the respondent.
[6] On October 30, 2015, the respondent was served with the notice of application and supporting materials pursuant to the Convention on the Service Abroad of Judicial and Extrajudicial Documents in Civil or Commercial Matters, The Hague, 15 November 1965, [1989] Can. T.S. No. 2 (The Hague Convention). The respondent has not filed a notice of appearance under rule 305 of the Federal Courts Rules, SOR/98-106 (FCR), and did not participate in this proceeding. Upon being satisfied that the respondent was given notice of the date and place of the hearing, the Court proceeded in the absence of the respondent in accordance with rule 38 of the FCR.
[7] The Privacy Commissioner of Canada (the Commissioner), appointed under section 53 of the Privacy Act, R.S.C., 1985, c. P-21, is assigned responsibilities under PIPEDA including the investigation of complaints under section 12. On March 15, 2016, the Commissioner’s motion to appear as a party to this application was granted by the Case Management Judge, Roger R. Lafrenière. The Commissioner participated as an added respondent, filed documentary evidence and submitted written and oral representations. I will refer to the added respondent as the Commissioner and to his office as the OPCC.
[8] While no responding record was filed by Mr. Radulescu or Globe24h.com, the record submitted by the Commissioner contains communications from Mr. Radulescu in which he sets out several positions regarding the complaint against him and his website. In those communications, Mr. Radulescu displays some familiarity with Canadian law, in particular PIPEDA, and with the OPCC complaint process. He also demonstrates awareness of Canadian media reports about the controversy which his website has generated. There is no indication that the respondent was not aware that he could contest the application should he have chosen to do so.
B. Complaints to the OPCC
[9] The respondent operates Globe24h.com from Constanta, Romania. The server that hosts the website is also located in Romania. The OPCC tendered extensive evidence about the respondent’s activities and complaints from Canadian citizens and residents with respect to information disclosed on the respondent’s website.
[10] In July 2013, Globe24h.com began republishing Canadian court and tribunal decisions that are also available on Canadian legal websites such as CanLII.org. The difference between these other websites and Globe24h.com is that the respondent has permitted the decisions that are republished on his website to be located via third party search engines such as Google. Moreover, because decisions on Globe24h.com are indexed by search engines, a decision containing an individual’s name will generally appear in search results when the individual’s name is searched on such search engines.
[11] Notably, the content of the Canadian legal websites is generally not indexed and a person seeking such information must go directly to each site and conduct a search with the names of the parties, the style of cause and/or the citation for the decision to obtain the content.
[12] In October 2013, the OPCC began receiving complaints from individuals alleging that links to Canadian court and tribunal decisions containing their personal information were appearing prominently in search results when their names were entered in common search engines. Between October 2013 and June 2015, the OPCC received a total of 38 complaints relating to Globe24h.com. From June 2015 to the date of filing of the OPCC’s record, the OPCC had received a further 11 complaints, with the most recent complaint being filed in April 2016. The OPCC investigated complaints from 27 individuals, including the applicant. The website of the Canadian Legal Information Institute (CanLII) had also received over 150 complaints regarding Globe24h.com prior to April 2016.
[13] The complainants alleged that the decisions posted on Globe24h.com contained sensitive personal information about them and/or their family members in relation to personal matters such as divorce proceedings, immigration matters, health issues and personal bankruptcies. For example, one of the complaints concerned the judicial review in this Court of an Immigration and Refugee Board decision relating to a HIV-positive individual sponsored for admission to Canada by her husband. There are many other examples among the complaints filed as evidence by the OPCC of highly sensitive personal information discussed in the judgments and rulings posted on Globe24h.com.
[14] According to the OPCC, the complainants generally understood that the decisions would be published somewhere to maintain a record of the proceedings and to assist the courts, legal profession and public in understanding the development and application of the law. However, they did not understand why the decisions would appear as a result of a casual search on a search engine such as Google. Such casual searches could be conducted by members of their families, employers or neighbours who would have no prior knowledge of the sensitive information. Examples provided included the risk of children, students or co-workers coming across information of a highly personal nature.
[15] The complainants particularly objected to the fact that the respondent was seeking payment for the removal of the personal information from the website. The fees solicited for doing so varied widely. Moreover, if payment was made with respect to removal of one version of the decision, additional payments could be demanded for removal of other versions of the same information. This included, for example, the translation of the same decision in a Federal Court proceeding or earlier rulings in the same case.
[16] In reply to such complaints, the respondent offered a “free” removal service. However, this required a request in writing and could take 180 days or more. Further, in order to have their personal information removed from the website for free, individuals were asked to provide further personal information to Globe24h.com in a “Request Form”. And the requestors were threatened with referral to prosecution authorities if the respondent suspected that fraud was involved. In contrast, payment for removal could be easily transferred through an online payment service, without providing any additional information. In other words, removal was expedited if the requestor was willing to pay but delayed and obstructed if no payment was made.
[17] One exhibit tendered in evidence concerned a service styled as “reputation.ca” which claimed to be able to remove embarrassing information from Globe24h.com for a fee of $1 500. While there is no evidence linking the respondent to this site, this exhibit demonstrates the impact of the respondent’s activities.
[18] The evidence leads to the conclusion that the respondent was running a profit-making scheme to exploit the online publication of Canadian court and tribunal decisions containing personal information.
C. The facts pertaining to the applicant
[19] The applicant was a party in labour relations proceedings involving his former employer. In June 2014, he discovered while using the Google search engine that an Alberta Labour Board decision concerning his case had been republished through Globe24h.com.
[20] PIPEDA defines “personal information” very broadly in section 2 as information about an identifiable individual. The applicant was concerned that the personal information in the labour relations proceedings, easily accessible through Google or other online search engine, would affect his future employment prospects. Although he is not certain that this has happened, he believes that it occurred in at least one instance when a prospective employer chose not to make him an offer.
[21] On June 13, 2014, the applicant contacted Globe24h.com and requested that his personal information be removed. He was told by the respondent that he would have to pay a fee to have that done.
[22] On June 14, 2014, the applicant filed a complaint against Globe24h.com under PIPEDA. The Commissioner’s investigation, completed in June 2015, concluded that the applicant’s complaint was well-founded. The Commissioner informed the applicant of his right to pursue this matter in this Court under section 14 of PIPEDA. He did so by notice of application filed on July 27, 2015. An amended notice of application was filed on August 28, 2015.
[23] The applicant understands that the information pertaining to his labour relations dispute continues to be accessible through a Canadian-based website. He informed the Court during the hearing that he believes that he requested a confidentiality order before the Labour Board but was advised that it would require the consent of the employer, which was not provided. The essence of the applicant’s complaint is not with the publication of the decision by the Board but with the ease of accessing the information about his case through online search engines.
[24] The applicant also pursued a complaint through the Romanian National Supervisory Authority for Personal Data Processing (RNSAPDP), the Romanian counterpart to the OPCC. In October 2014, the RNSAPDP fined the respondent for contravening Romanian data protection laws. The respondent has appealed this fine to a Romanian court. As of the date of hearing of this application, the Court was informed, those proceedings are ongoing.
[25] The applicant advised this Court at the hearing that he and his family in Romania have received verbal threats for pursuing the complaint. For that reason, and because of his concern that the publication of this decision would again expose his personal information to public attention, the applicant requested that the Court order that his identity be protected.
[26] As indicated above, I have acceded to his request by substituting his initials for his name in the style of cause. In my view, this strikes an appropriate balance between the open court principle and the need to protect the applicant’s and his family’s personal safety: A.B. v. Canada (Minister of Citizenship and Immigration), 2009 FC 325, [2010] 2 F.C.R. 75, at paragraph 5; E.F. v. Canada (Citizenship and Immigration), 2015 FC 842, 37 Imm. L.R. (4th) 152, at paragraph 8.
[27] The applicant represented himself on this matter.
D. The OPCC’s Investigation of Globe24h.com
[28] In May 2014, the OPCC commenced an investigation of Globe24h.com and Mr. Radulescu under subsection 12(1) of PIPEDA. During the course of its investigation, the OPCC communicated with the respondent and obtained detailed information from Mr. Radulescu.
[29] The respondent acknowledged collecting and republishing decisions from (1) judicial and administrative tribunal websites, (2) the CanLII website, and (3) the website of the Société québécoise d’information juridique (SOQUIJ). The respondent also acknowledged republishing the decisions without the knowledge and consent of concerned individuals or the tribunals and courts and that he was allowing the decisions to be indexed by search engines. However, he stated that consent was not required because the website’s purpose is exclusively journalistic and the content was already publicly available.
[30] In late 2012, CanLII detected bulk downloading of decisions from its website from IP addresses registered with an internet service provider named “RCS & RDS”, based in Romania. CanLII subsequently blocked access to its website from all users of RCS & RDS. In December 2013, CanLII received complaints that decisions posted on its website were searchable through Google using the names of litigants. CanLII’s Chief Editor examined the content patterns published on Globe24h.com and determined that the decisions had been downloaded in bulk from CanLII.
[31] In January 2014, CanLII’s Chief Editor contacted the respondent to inform it of a judicially ordered publication ban with respect to a decision reproduced on his website which required anonymity of the parties. Globe24h.com advised CanLII about the procedure to request content removal and the applicable fee. As of May 2016, the decision remained on the respondent’s website in its original form, and not in conformity with the publication ban.
[32] Throughout the OPCC’s investigation the respondent maintained that the purpose of Globe24h.com was to “disseminate public information, especially government information, to a wider audience internationally”.
[33] The respondent stated that the removal fee had been introduced to limit the volume of anonymous requests received by email and to prevent fraudulent removal requests. The respondent’s process for removing personal information changed a number of times during the OPCC’s investigation in what might be interpreted to be attempts to hamper the process.
[34] Initially, the respondent advertised that individuals could pay a 19 euro fee for “express” 72-hour removal. Individuals could also have their personal information removed for free; however, that process took 180 days and up to one year for the information to be removed from search engine indices. In early 2014, the respondent began to offer a faster 12-hour removal for a 120 euro fee. By May 2014, the time period for a free removal process was shortened to 15 days. However, the request had to be sent by mail to Romania and it had to include information such as the requester’s full name and address, a copy of an identification document, and a copy of the decision that identified the exact information to be removed. In contrast, for the paid removal service, an individual only had to send an email identifying the decision and the redaction would be done within a few days once the payment had been transferred.
[35] In July 2014, the respondent informed the OPCC that there was no longer a fee for removing personal information from the website. However, in October 2014, the OPCC received information from one of the complainants that Mr. Radulescu had offered, instead of anonymizing decisions, to remove full copies of decisions from the website for the price of 200 euros per decision.
[36] Some complainants paid to have their personal information removed but then discovered that there were other decisions, or versions of the same decision, concerning them still on the website. However, the fee that they paid only covered a single decision, according to Globe24h.com and further payments would be demanded for the other decisions or versions of decisions.
[37] The OPCC also found that the respondent’s website displayed advertisements alongside the decisions and sold space on the website to advertisers. Some of these appear to have been links to pornographic websites. On June 12, 2016, the respondent informed the Commissioner that as of June 10, 2016, he has removed all advertising from Globe24h.com. Therefore, he claimed, Globe24h.com’s activities are now entirely not-for-profit and that he derives no revenue from the website.
[38] During the course of the investigation, the respondent indicated that Globe24h.com’s collection of Canadian decisions had not been updated since 2013. However, the Commissioner found that the website contains decisions from 2014 and 2015.
[39] While the investigation was ongoing, the OPCC requested Mr. Radulescu to remove the personal information of complainants from the website as an interim measure. Initially, the respondent complied and indicated that he had redacted the complainants’ personal information from the decisions, although the decisions remained on the site. However, in November 2014, the respondent indicated that he would no longer redact decisions at the OPCC’s request and that individuals had to submit a request form along with supporting documentation to Globe24h.com.
E. The OPCC’s Final Report of Findings
[40] In January 2015, the OPCC issued a preliminary report of investigation to the respondent concluding that PIPEDA applied to the respondent’s activities. The OPCC further concluded that the respondent’s activities were not appropriate purposes within the meaning of subsection 5(3) of PIPEDA.
[41] On June 5, 2015, the Commissioner issued its final report of findings with respect to the 27 complaints that he investigated. The OPCC’s final conclusions can be summarized as follows:
• Globe24h.com is an organization that collects, uses and discloses personal information in the course of commercial activities within the meaning of PIPEDA;
• PIPEDA can apply to Globe24h.com as a foreign-based organization because there is an established “real and substantial connection” between the parties and/or the facts giving rise to the complaint in Canada;
• The journalistic purpose exception under paragraph 4(2)(c) of PIPEDA does not apply to the respondent’s activities because the underlying purpose of Globe24h.com is to generate revenue by incentivizing individuals to pay to have their personal information removed;
• The underlying purpose of Globe24h.com—which is to make available Canadian court and tribunal decisions through search engines that allow the sensitive personal information of individuals to be found by happenstance—cannot be considered as appropriate from the perspective of a reasonable person under subsection 5(3) of PIPEDA; and,
• The publicly available information exception does not apply to Globe24h.com’s activities because the website’s purpose in allowing the decisions to be indexed by popular search engines is not “directly related” to the purpose for which the personal information appears in the record or document. Therefore, the exceptions to PIPEDA’s knowledge and consent requirements described under paragraphs 7(1)(d), 7(2)(c.1) and 7(3)(h.1) do not apply in this situation.
III. RELIEF SOUGHT
[42] The applicant seeks the following remedies:
(a) an order for damages, including general, punitive, exemplary, discretionary and, including damages for the humiliation and distress suffered by the applicant;
(b) an order that the respondent correct their practices and comply with sections 5 to 10 of PIPEDA;
(c) an order that the respondent publish a notice of any of the actions taken or proposed to be taken to correct their practices so as to comply with PIPEDA;
(d) an order for an injunction;
(e) a declaration that the respondent contravened privacy legislation;
(f) an order that the respondent delete from his website and servers all court and tribunal decisions that is republished containing personal information, and remove these decisions from search engines caches;
(g) an order that the respondent is a vexatious litigant; and,
(h) an order for costs, including on a solicitor-client and full indemnity basis.
[43] During the course of the hearing, the applicant acknowledged that a number of these proposed remedies would not be appropriate or available to him under the law. This is not a case, for example, for issuing a vexatious litigant order. Nor would costs on a solicitor-client and full indemnity basis be available to the applicant as he represented himself. The question of damages will be discussed further below.
[44] The OPCC proposed the following declaration and orders:
1. The Respondent, Sebastian Radulescu, contravened the Personal Information Protection and Electronics Documents Act, SC 2000, c 5 by collecting, using and disclosing on his website, www.Globe24h.com (“Globe24h.com”), personal information contained in Canadian court and tribunal decisions for inappropriate purposes and without the consent of the individuals concerned;
2. The Respondent, Sebastian Radulescu, shall remove all Canadian court and tribunal decisions containing personal information from Globe24h.com and take the necessary steps to remove these decisions from search engines caches;
3. The Respondent, Sebastian Radulescu, shall refrain from further copying and republishing Canadian court and tribunal decisions containing personal information in a manner that contravenes the Personal Information and Electronic Documents Act, SC 2000, c 5; and
4. The Respondent, Sebastian Radulescu, shall pay the Applicant damages in the amount of XXXX. [No amount proposed.]
IV. RELEVANT LEGISLATION
[45] The relevant legislation is attached to these reasons as an annex (Annex A) to facilitate the reading of this decision.
V. ISSUES
[46] Having considered the issues raised by the applicant and Commissioner, I would frame them as follows:
A. Does PIPEDA have an extraterritorial application to Globe24h.com as a foreign-based organization?
B. Is the respondent’s purpose for collecting, using and disclosing personal information “appropriate” under paragraph 5(3) of PIPEDA?
C. Does the “publicly available” exception apply to the personal information republished on Globe24h.com under section 7 of PIPEDA?
D. What remedies should this Court grant under section 16 of PIPEDA?
VI. ANALYSIS
[47] These reasons will focus on the Commissioner’s submissions. The applicant represented himself in these proceedings with the assistance of the OPCC. His submissions were brief but on point and articulate and he provided a list of relevant jurisprudence for the Court’s assistance. In addition to his personal interests in the matter, he argued that the respondent’s activities have the potential of bringing the administration of justice into disrepute as individuals may now be discouraged from approaching the judicial system out of fear of having their personal information more widely accessible online.
A. Does PIPEDA have an extraterritorial application to Globe24h.com as a foreign based organization?
(1) The “real and substantial connection” test.
[48] The purpose of Part I [sections 1 to 30] of PIPEDA is to:
Purpose
3 … establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
[49] PIPEDA was enacted in response to the 1980 Organization for Economic Co-operation and Development Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. It was designed to be part of an international system to protect the privacy of individuals as reflected in the European Data Protection Directive adopted in October 1995. Among other elements, the European Directive included a provision that prevented the transmission of any personal information outside the European Union unless the recipient country had legislation in place that would offer similar protection. PIPEDA was intended to offer that protection in Canada thus avoiding the extraterritorial effect of the European Directive on Canada. Romania is bound by the European Directive. One question to be addressed is whether PIPEDA can apply to activities abroad that have an impact on persons resident in Canada.
[50] Section 4 of PIPEDA, the application provision for Part I, is silent with respect to the statute’s territorial reach. However, there is no language expressly limiting its application to Canada. In the absence of clear guidance from the statute, the Court can interpret it to apply in all circumstances in which there exists a “real and substantial link” to Canada, following the Supreme Court’s guidance in Society of Composers, Authors and Music Publishers of Canada v. Canadian Assn. of Internet Providers, 2004 SCC 45, [2004] 2 S.C.R. 427 (SOCAN), at paragraphs 54–63 and the other authorities cited therein.
[51] In SOCAN, Justice Binnie reviewed the general principles in respect of the extraterritoriality of Canadian laws and concluded that the Canadian Copyright Act [R.S.C., 1985, c. C-42] may apply to cross-border activities where there is a “real and substantial connection” with Canada (at paragraphs 54–63):
While the Parliament of Canada, unlike the legislatures of the Provinces, has the legislative competence to enact laws having extraterritorial effect, it is presumed not to intend to do so, in the absence of clear words or necessary implication to the contrary. This is because “[i]n our modern world of easy travel and with the emergence of a global economic order, chaotic situations would often result if the principle of territorial jurisdiction were not, at least generally, respected”; see Tolofson v. Jensen, [1994] 3 S.C.R. 1022, at p. 1051, per La Forest J.
While the notion of comity among independent nation States lacks the constitutional status it enjoys among the provinces of the Canadian federation (Morguard Investments Ltd. v. De Savoye, [1990] 3 S.C.R. 1077, at p. 1098), and does not operate as a limitation on Parliament’s legislative competence, the courts nevertheless presume, in the absence of clear words to the contrary, that Parliament did not intend its legislation to receive extraterritorial application.
Copyright law respects the territorial principle, reflecting the implementation of a “web of interlinking international treaties” based on the principle of national treatment (see D. Vaver, Copyright Law (2000), at p. 14).
The applicability of our Copyright Act to communications that have international participants will depend on whether there is a sufficient connection between this country and the communication in question for Canada to apply its law consistent with the “principles of order and fairness … that ensure security of [cross-border] transactions with justice”; see Morguard Investments, supra, at p. 1097; see also Unifund Assurance Co. v. Insurance Corp. of British Columbia, [2003] 2 S.C.R. 63, 2003 SCC 40, at para. 56; Sullivan and Driedger on the Construction of Statutes (4th ed. 2002), at pp. 601-2.
Helpful guidance on the jurisdictional point is offered by La Forest J. in Libman v. The Queen, [1985] 2 S.C.R. 178. That case involved a fraudulent stock scheme. U.S. purchasers were solicited by telephone from Toronto, and their investment monies (which the Toronto accused caused to be routed through Central America) wound up in Canada. The accused contended that the crime, if any, had occurred in the United States, but La Forest J. took the view that “[t]his kind of thinking has, perhaps not altogether fairly, given rise to the reproach that a lawyer is a person who can look at a thing connected with another as not being so connected. For everyone knows that the transaction in the present case is both here and there” (p. 208 (emphasis added)). Speaking for the Court, he stated the relevant territorial principle as follows (at pp. 212-13):
I might summarize my approach to the limits of territoriality in this way. As I see it, all that is necessary to make an offence subject to the jurisdiction of our courts is that a significant portion of the activities constituting that offence took place in Canada. As it is put by modern academics, it is sufficient that there be a “real and substantial link” between an offence and this country…. [Emphasis added by Binnie J.]
So also, in my view, a telecommunication from a foreign state to Canada, or a telecommunication from Canada to a foreign state, “is both here and there”. Receipt may be no less “significant” a connecting factor than the point of origin (not to mention the physical location of the host server, which may be in a third country). To the same effect, see Canada (Human Rights Commission) v. Canadian Liberty Net, [1998] 1 S.C.R. 626, at para. 52; Kitakufe v. Oloya, [1998] O.J. No. 2537 (QL) (Gen. Div.). In the factual situation at issue in Citron v. Zundel, supra, for example, the fact that the host server was located in California was scarcely conclusive in a situation where both the content provider (Zundel) and a major part of his target audience were located in Canada. The Zundel case was decided on grounds related to the provisions of the Canadian Human Rights Act, but for present purposes the object lesson of those facts is nevertheless instructive.
The “real and substantial connection” test was adopted and developed by this Court in Morguard Investments, supra, at pp. 1108-9; Hunt v. T&N plc, [1993] 4 S.C.R. 289, at pp. 325-26 and 328; and Tolofson, supra, at p. 1049. The test has been reaffirmed and applied more recently in cases such as Holt Cargo Systems Inc. v. ABC Containerline N.V. (Trustees of), [2001] 3 S.C.R. 907, 2001 SCC 90, at para. 71; Spar Aerospace Ltd. v. American Mobile Satellite Corp., [2002] 4 S.C.R. 205, 2002 SCC 78; Unifund, supra, at para. 54; and Beals v. Saldanha, [2003] 3 S.C.R. 416, 2003 SCC 72. From the outset, the real and substantial connection test has been viewed as an appropriate way to “prevent overreaching … and [to restrict] the exercise of jurisdiction over extraterritorial and transnational transactions” (La Forest J. in Tolofson, supra, at p. 1049). The test reflects the underlying reality of “the territorial limits of law under the international legal order” and respect for the legitimate actions of other states inherent in the principle of international comity (Tolofson, at p. 1047). A real and substantial connection to Canada is sufficient to support the application of our Copyright Act to international Internet transmissions in a way that will accord with international comity and be consistent with the objectives of order and fairness.
In terms of the Internet, relevant connecting factors would include the situs of the content provider, the host server, the intermediaries and the end user. The weight to be given to any particular factor will vary with the circumstances and the nature of the dispute.
Canada clearly has a significant interest in the flow of information in and out of the country. Canada regulates the reception of broadcasting signals in Canada wherever originated; see Bell ExpressVu Limited Partnership v. Rex, [2002] 2 S.C.R. 559, 2002 SCC 42. Our courts and tribunals regularly take jurisdiction in matters of civil liability arising out of foreign transmissions which are received and have their impact here; see WIC Premium Television Ltd. v. General Instrument Corp. (2000), 8 C.P.R. (4th) 1 (Alta. C.A.); Re World Stock Exchange (2000), 9 A.S.C.S. 658.
Generally speaking, this Court has recognized, as a sufficient “connection” for taking jurisdiction, situations where Canada is the country of transmission (Libman, supra) or the country of reception (Liberty Net, supra). This jurisdictional posture is consistent with international copyright practice.
[52] As Mr. Radulescu and Globe24h.com are foreign-based, the Court must consider whether there is a real and substantial connection between them and Canada to find that PIPEDA applies to their activities. The operative question underlying the test is “whether there is sufficient connection between this country and the [activity] in question for Canada to apply its law consistent with the ‘principles of order and fairness’” and international comity: SOCAN, above, at paragraphs 57 and 60.
[53] This Court has applied PIPEDA to a foreign-based organization where there was evidence of a sufficient connection between the organization’s activities and Canada: Lawson v. Accusearch Inc., 2007 FC 125, [2007] 4 F.C.R. 314 (Lawson), at paragraphs 38–43. The relevant connecting factors include (1) the location of the target audience of the website, (2) the source of the content on the website, (3) the location of the website operator, and (4) the location of the host server: SOCAN, above, at paragraphs 59 and 61; see also Lawson, above, at paragraph 41; Davydiuk v. Internet Archive Canada, 2014 FC 944, 127 C.P.R. (4th) 262 (Davydiuk), at paragraphs 31 and 32; Desjean v. Intermix Media, Inc., [2006] FC 1395, [2007] 4 F.C.R. 151, at paragraph 42, affd 2007 FCA 365, 41 B.L.R. (4th) 78; Equustek Solutions Inc. v. Google Inc., 2015 BCCA 265, 386 D.L.R. (4th) 224 (Equustek) leave to appeal to the S.C.C. granted [2016] 1 S.C.R. xi.
[54] In this case, the location of the website operator and host server is Romania. However, when an organization’s activities take place exclusively through a website, the physical location of the website operator or host server is not determinative because telecommunications occur “both here and there”: Libman v. The Queen, [1985] 2 S.C.R. 178 (Libman), at page 208.
[55] In its submissions, the OPCC highlights three key connecting factors between the foreign-based website and Canada. First, the content that is at issue is Canadian court and tribunal decisions containing personal information which was copied by the respondent from Canadian legal websites. Second, the website directly targets Canadians by specifically advertising that it provides access to “Canadian Caselaw”/“Jurisprudence de Canada”. The evidence is that the majority of visitors to Globe24h.com are from Canada. Third, the impact of the website is felt by members of the Canadian public. This is evidenced by the complaints received both by the OPCC and media reports of individuals suffering distress, embarrassment and reputational harm because of Globe24h.com republishing their personal information and making it accessible via search engines. The respondent is aware of these complaints.
[56] There is evidence that the Romanian authorities have acted to curtail the respondent’s activities and that they have cooperated with the OPCC investigation. Is that sufficient reason not to exercise the PIPEDA jurisdiction in this context? I think not. I accept the submission of the OPCC that the principle of comity is not offended where an activity takes place abroad but has unlawful consequences here: Libman, above, at page 209.
[57] In Chevron Corp. v. Yaiguaje, 2015 SCC 42, [2015] 3 S.C.R. 69 (Chevron), the Supreme Court was asked to determine whether the Ontario Courts have jurisdiction over a Canadian subsidiary of Chevron, an American corporation and a stranger to the foreign judgment for which recognition and enforcement was being sought in Canada. In that case, the Ontario Court of Appeal had affirmed an Ecuadorian judgment against Chevron.
[58] In upholding the Ontario Court of Appeal’s decision, Justice Gascon noted that “Canadian courts, like many others, have adopted a generous and liberal approach to the recognition and enforcement of foreign judgments”: Chevron, above, at paragraph 27. The only prerequisite for recognizing and enforcing such a judgment is that the foreign court had a real and substantial connection with the litigants or with the subject matter of the dispute, or that the traditional bases of jurisdiction were satisfied: Chevron, above, at paragraph 27.
[59] On the principle of comity, Justice Gascon observes that “the need to acknowledge and show respect for the legal acts of other states has consistently remained one of the principle’s core components”: Chevron, above, at paragraph 53. In this regard, comity militates in favour of recognition and enforcement. The principle of comity further provides that legitimate judicial acts should be respected and enforcement not sidetracked or ignored: Chevron, above, at paragraph 53.
[60] In the case at bar, since Romanian authorities have cooperated with the OPCC investigation and taken action to curtail the respondent’s activities, the legitimate judicial acts of this Court will not be seen as offending the principle of comity. The respondent was fined for contravening Romanian data protection laws by, among other things, charging a fee for the removal of personal information from Globe24h.com. The respondent has appealed this fine to a Romanian court. Given the involvement of the Romanian counterpart to the OPCC, this Court’s findings would complement rather than offend any action that may be taken in a Romanian court.
[61] During the OPCC’s investigation, the respondent relied on the Supreme Court’s decision in Club Resorts Ltd. v. Van Breda, 2012 SCC 17, [2012] 1 S.C.R. 572 (Van Breda) to argue that the PIPEDA did not apply to his activities in Romania. Van Breda concerned two individuals that were injured while on vacation outside of Canada. Actions were brought in Ontario against a number of parties, including Club Resorts Ltd., a company incorporated in the Cayman Islands.
[62] Club Resorts Ltd., the appellant in Van Breda, argued that the Ontario courts lacked jurisdiction. To determine the issue of jurisdiction, the Supreme Court applied the “real and substantial connection” test. The Court had to consider whether carrying on business in the jurisdiction may also be considered an appropriate connecting factor. Ultimately, the Court found that the notion of carrying on business requires some form of actual, not only virtual, presence in the jurisdiction, such as maintaining an office there or regularly visiting the territory of the particular jurisdiction: Van Breda, above, at paragraph 87.
[63] However, I note that the Supreme Court was careful to distinguish between traditional categories of business and “e-trade”. Justice LeBel noted that the Court was not asked to decide whether e-trade in the jurisdiction would amount to a presence in the jurisdiction. Had there been a discussion about jurisdiction in the context of e-trade, I would have considered the connecting factors discussed in Van Breda as helpful to the analysis in the case at bar.
[64] Van Breda was limited to the specific context of tort claims. The Supreme Court was clear that it was not, in that case, providing an “inventory of connecting factors covering the conditions for the assumption of jurisdiction over all claims known to the law”: Van Breda, above, at paragraph 85. The Court was concerned about creating what would amount to forms of universal jurisdiction in respect of tort claims arising out of certain categories of business or commercial activity. As such, Justice LeBel confined the application of Van Breda to limited areas of private international law and international tort: Van Breda, above, at paragraph 87; see also Chevron, above, at paragraphs 38 and 39; Davydiuk, above, at paragraphs 28 and 29.
B. The respondent is collecting, using and disclosing personal information in the course of “commercial activities”
[65] The Court is satisfied that the respondent is an “organization” within the meaning of paragraph 4(1)(a) of PIPEDA. First, Mr. Radulescu is a “person” and thus falls within the scope of an “organization” as defined under subsection 2(1) of PIPEDA. There is no evidence that Globe24h.com is anything other than a website created to carry out Mr. Radulescu’s activities. Second, the respondent is collecting, using and disclosing Canadian court and tribunal decisions containing personal information of litigants and other individuals named in the decisions. Third, the respondent’s activities are commercial in nature as he generated revenue from advertisements on his website and he charges a transaction fee before agreeing to remove the personal information of concerned individuals.
[66] The respondent’s most recent claim that he does not charge for data removal and no longer generates revenue from Globe24h.com is not credible. The OPCC record establishes that the respondent has made similar claims in the past but when contacted by individuals to remove decisions from his website demanded a fee of 200 euros. In any event, he cannot escape the application of PIPEDA by claiming that his future activities will not be commercial in nature.
C. The respondent’s purposes are not exclusively “journalistic” in nature
[67] The respondent has claimed in communications with the OPCC that his purposes in operating Globe24h.com should be considered exclusively journalistic. Should the Court accept that claim, Part 1 of PIPEDA does not apply to his activities because the personal information collected, used or disclosed falls under the exception provided by paragraph 4(2)(c) of PIPEDA.
[68] The “journalistic” purpose exception is not defined in PIPEDA and it has not received substantive treatment in the jurisprudence. The OPCC submits that the Canadian Association of Journalists has suggested that an activity should qualify as journalism only where its purpose is to (1) inform the community on issues the community values, (2) it involves an element of original production, and (3) it involves a “self-conscious discipline calculated to provide an accurate and fair description of facts, opinion and debate at play within a situation”. Those criteria appear to be a reasonable framework for defining the exception. None of them would apply to what the respondent has done.
[69] The Alberta Court of Appeal interpreted similar statutory language in Alberta’s Personal Information Protection Act, S.A. 2003, c. P-6.5: United Food and Commercial Workers, Local 401 v. Alberta (Attorney General), 2012 ABCA 130 (CanLII), 522 A.R. 197, affd 2013 SCC 62, [2013] 3 S.C.R. 733 (United Food). Specifically, in considering the adjective “journalistic”, the [Alberta] Court of Appeal noted that “it is unreasonable to think that the Legislature intended it to be so wide as to encompass everything within the phrase ‘freedom of opinion and expression’”: United Food, above, at paragraph 56. Further, the Court noted that “[n]ot every piece of information posted on the Internet qualifies [as journalism]”: United Food, above, at paragraph 59.
[70] In my view, the respondent’s claimed purpose “to make law accessible for free on the Internet” on Globe24h.com cannot be considered “journalistic”. In this instance, there is no need to republish the decisions to make them accessible as they are already available on Canadian websites for free. The respondent adds no value to the publication by way of commentary, additional information or analysis. He exploits the content by demanding payment for its removal.
[71] The evidence indicates that the respondent’s primary purpose is to incentivize individuals to pay to have their personal information removed from the website. A secondary purpose, until very recently, was to generate advertising revenue by driving traffic to his website through the increased exposure of personal information in search engines. There is no evidence that the respondent’s intention is to inform the public on matters of public interest.
[72] Even if the respondent’s activities could be considered journalistic in part, the exemption under paragraph 4(2)(c) only applies where the information is collected, used or disclosed exclusively for journalistic purposes. It is clear from the record that Globe24h.com’s purposes extend beyond journalism.
D. Is the respondent’s purpose for collecting, using and disclosing personal information “appropriate” under subsection 5(3) of PIPEDA?
[73] Subsection 5(3) creates an overarching requirement that an organization “collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.” This must also be read in light of the underlying purpose of Part 1 of PIPEDA provided by section 3.
[74] In considering whether an organization complies with subsection 5(3) of PIPEDA, this Court has in the past considered whether (1) the collection, use or disclosure of personal information is directed to a bona fide business interest, and (2) whether the loss of privacy is proportional to any benefit gained: Turner v. Telus Communications Inc., 2005 FC 1601, 284 F.T.R. 38, at paragraph 48, affd 2007 FCA 21, [2007] 4 F.C.R. 368.
[75] I agree with the OPCC that a reasonable person would not consider the respondent to have a bona fide business interest. In making this argument, the Commissioner relies on the Canadian Judicial Council’s (CJC) Model Policy for Access to Court Records in Canada (Model Policy) and the OPCC’s own guidance document to federal administrative tribunals. The CJC Model Policy discourages decisions that are published online to be indexed by search engines as this would prevent information from being available when the purpose of the search is not to find court records. The policy recognizes that a balance must be struck between the open courts principle and increasing online access to court records where the privacy and security of participants in judicial proceedings will be at issue.
[76] The CJC has struck a balance by advising courts to prevent judgments from being discovered unintentionally through search engines. To this end, the CJC has recommended that judgments published online should not be indexed by search engines. The OPCC notes that CanLII and other court and tribunal websites generally follow the CJC’s Model Policy and prevent their decisions from being indexed by search engines through web robot exclusion protocols and other means. Indeed, the Federal Court has taken such measures to prevent our decisions from being indexed. That does not bar anyone from visiting the Federal Court website and conducting a name search. But it does prevent the cases from being listed in a casual web search. The respondent’s actions result in needless exposure of sensitive personal information of participants in the justice system via search engines.
E. Does the “publicly available” exception apply to the personal information republished on Globe24h.com under section 7 of PIPEDA?
[77] The OPCC submits that section 7 must be read in conjunction with paragraph 1(d) of the Regulations Specifying Publicly Available Information, SOR/2001-7, which specify that records or documents of judicial or quasi-judicial bodies are to be considered publicly available provided certain conditions are met:
1 The following information and classes of information are specified for the purposes of paragraphs 7(1)(d), (2)(c.1) and (3)(h.1) of [PIPEDA]:
…
(d) personal information that appears in a record or document of a judicial or quasi-judicial body, that is available to be public, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the record or document….
[78] The Court agrees with the Commissioner that the respondent’s purposes in republishing decisions do not “relate directly” to the purpose for which the personal information appears in the decisions. The respondent’s purposes are unrelated to the open courts principle. Instead, the respondent’s website serves to undermine the administration of justice by potentially causing harm to participants in the justice system. As the applicant has argued, the publication of such information on an indexed website may well discourage people from accessing the justice system.
[79] In the Court’s view, there is no reasonable basis on which the respondent could rely on the “publicly available” exception under section 7 of PIPEDA.
F. What remedies should this Court grant under section 16 of PIPEDA?
(1) A corrective order
[80] The OPCC supports the applicant’s request for an order requiring the respondent to correct his practices in order to comply with PIPEDA under paragraph 16(a). The respondent not being a resident of Canada does not bar the making of an extraterritorial order where the underlying dispute is within the jurisdiction of the Court: Impulsora Turistica de Occidente, S.A. de C.V. v. Transat Tours Canada Inc., 2007 SCC 20, [2007] 1 S.C.R. 867, at paragraph 6; Barrick Gold Corp. v. Lopehandia, 2004 CanLII 12938, 71 O.R. (3d) 416 (C.A.) (Barrick Gold), at paragraphs 73–77; Equustek, above, at paragraphs 81–99.
[81] However, as noted by the Ontario Court of Appeal in Barrick Gold, above, at paragraph 73, courts have traditionally been reluctant to grant injunctive relief against defendants who are outside the jurisdiction. The reason for this is explained by Robert J. Sharpe in his text, Injunctions and Specific Performance, loose-leaf edition (Toronto: Canada Law Book, November 2002), at pages 1-54 to 1-55:
Claims for injunctions against foreign parties present jurisdictional constraints which are not encountered in the case of claims for money judgments. In the case of a money claim, the courts need not limit assumed jurisdiction to cases where enforceability is ensured. Equity, however, acts in personam and the effectiveness of an equitable decree depends upon the control which may be exercised over the person of the defendant. If the defendant is physically present, it will be possible to require him or her to do, or permit, acts outside the jurisdiction. The courts have, however, conscientiously avoided making orders which cannot be enforced. The result is that the courts are reluctant to grant injunctions against parties not within the jurisdiction and the practical import of rules permitting service ex juris in respect of injunction claims is necessarily limited. Rules of court are typically limited to cases where it is sought to restrain the defendant from doing anything within the jurisdiction. As a practical matter the defendant “who is doing anything within the jurisdiction” will usually be physically present within the jurisdiction to allow service.
[82] The jurisprudence is clear that courts must exercise restraint in granting remedies that have international ramifications. That said, in some circumstances, courts do issue extraterritorial orders where there is a “real and substantial connection” between the organization’s activities and Canada: Equustek, above, at paragraphs 51–56.
[83] The OPCC has presented considerable evidence as to the nature of the respondent’s enterprise based in Romania, and the degree to which it can be said to do business in Canada. As mentioned above, the content of Globe24h.com that is at issue is Canadian court and tribunal decisions. The OPCC’s evidence demonstrates that these decisions containing personal information were deliberately downloaded by the respondent from Canadian legal websites, such as CanLII, and republished on Globe24h.com. Moreover, the respondent has made a profit from Canadians by requiring them to pay a fee to have their personal information removed from the website.
[84] As noted by the British Columbia Court of Appeal in Equustek, above, at paragraph 85, “[o]nce it is accepted that a court has in personam jurisdiction over a person, the fact that its order may affect activities in other jurisdictions is not a bar to it making an order.” Further, in the context of Internet abuses, courts of many other jurisdictions have found orders that have international effects to be necessary: Equustek, above, at paragraph 95, citing APC c. Auchan Telecom, 11/60013, Judgment (28 November 2013) (Tribunal de grande instance de Paris); Mc Keogh v. John Doe 1 & Ors, [2012] IEHC 95 (Irish High Court, case No. 2012 1254 P); Mosley c. Google, 11/07970, Judgment (6 November 2013) (Tribunal de grande instance de Paris); and ECJ Google Spain SL, Google Inc. v. Agencia Espanola de Protección de Datos, Mario Costeja González, C-131/12 [2014], CURIA.
[85] I was concerned about the enforceability of any order against the respondent as he and his server are not physically present in Canada. However, having considered the matter I am satisfied that the issuance of a corrective order in Canada may assist the applicant in pursuing his remedies in Romania. Moreover, as argued by the Commissioner, it may assist in persuading the operators of search engines to de-index the pages carried by the respondent web site.
[86] Paragraph 16(a) of PIPEDA does authorize this Court to grant a corrective order requiring the respondent to correct his practices to comply with sections 5 to 10 of that legislation. Having reviewed the relevant authorities and having found that the underlying dispute is within the jurisdiction of this Court, I do not find that there is either a jurisdictional or a practical bar to granting a corrective order with extraterritorial effects.
(2) Declaratory relief
[87] The OPCC submits that declaratory relief is available to the applicant under section 16 of PIPEDA as the remedies provided are explicitly “in addition to any other remedies [this Court] may give”.
[88] A declaration that the respondent has contravened PIPEDA, combined with a corrective order, would allow the applicant and other complainants to submit a request to Google or other search engines to remove links to decisions on Globe24h.com from their search results. Google is the principal search engine involved and its policy allows users to submit this request where a court has declared the content of the website to be unlawful. Notably, Google’s policy on legal notices states that completing and submitting the Google form online does not guarantee that any action will be taken on the request. Nonetheless, it remains an avenue open to the applicant and others similarly affected. The OPCC contends that this may be the most practical and effective way of mitigating the harm caused to individuals since the respondent is located in Romania with no known assets.
[89] At the hearing on November 9, 2016, I requested that the OPCC provide additional authorities dealing specifically with the authority of the Federal Court to issue systemic remedies (i.e., remedies that go beyond the circumstances of an individual applicant) in appropriate cases.
[90] In their post-hearing submissions, the OPCC noted that the wording of section 16 of PIPEDA empowers the Court to craft remedies which address systemic non-compliance. They argued that such remedies will necessarily go beyond, and be of benefit to, more than just the individual applicant since their aim will be to correct how an organization collects, uses and discloses personal information generally.
[91] In Englander v. Telus Communications Inc., 2004 FCA 387, [2005] 2 F.C.R. 572 (Englander), the Federal Court of Appeal found that the respondent, Telus Communications Inc., had infringed section 5 of PIPEDA. The Court noted that the applicant, Mr. Englander had not been personally affected by the respondent’s breach. However, because an ongoing contravention of PIPEDA had been made out, the Court was prepared to issue a “future-oriented” order requiring the respondent to change its practices so that they complied with PIPEDA: Englander, above, at paragraph 90.
[92] In Donaghy v. Scotia Capital Inc., 2007 FC 224, 320 F.T.R. 9 (Donaghy), Justice Strayer, pursuant to paragraph 16(a) of PIPEDA, ordered a bank to clarify how it used a staff plan, which purported to record hours worked, including overtime, for staff who were not entitled to overtime: Donaghy, above, at paragraphs 15 and 18. Notably, in that case, the applicant was no longer an employee of the bank and would not have benefited from the corrective order granted by the Court.
[93] Moreover, given PIPEDA’s quasi-constitutional status, the OPCC contends that guidance can be found in cases dealing with remedies that can be granted under the Canadian Charter of Rights and Freedoms, being Part I of the Constitution Act, 1982, Schedule B, Canada Act, 1982, 1982, c. 11 (U.K.) [R.S.C., 1985, Appendix II, No. 44] (the Charter).
[94] In Jodhan v. Canada (Attorney General), 2012 FCA 161, [2014] 1 F.C.R. 185 (Jodhan), the issue was the scope of the Charter remedy that could be accorded after it was found that the federal government had failed to make government department and agency websites accessible to individuals with visual impairments. The Federal Court [2010 FC 1197, [2011] 2 F.C.R. 355] had found that there was a “system-wide failure” on behalf of the government to make its websites accessible and therefore declared that it had a constitutional obligation to remedy the defect. On appeal, the Attorney General argued that the remedy should have been confined to the entities named in the notice of application. The Federal Court of Appeal rejected this argument, noting that systemic remedies were entirely appropriate in cases where a systemic violation had been made out: Jodhan, above, at paragraphs 81–83 and 90.
[95] These cases demonstrate that remedies may transcend the particular circumstances of an applicant where it has been established that an organization’s practices are deficient. In such cases, broadly crafted remedies were required in order to ensure that the organization’s practices going forward did not result in further violations of constitutional and quasi-constitutional rights.
[96] The request for a systemic remedy in the present matter is supportable because the evidence demonstrates that the effects of the respondent’s actions are not confined to the single applicant named in this application. The OPCC has received a total of 49 complaints relating to Globe24h.com. Moreover, affidavit evidence filed by the OPCC demonstrates that over 150 complaints have been received by CanLII regarding personal information found on Globe24h.com. As a result, I agree that the circumstances of this case justify a broadly crafted corrective order pursuant to paragraph 16(a) of PIPEDA.
G. Damages
[97] This Court has established that a damages award under PIPEDA serves three main functions: (1) compensation; (2) deterrence; and (3) vindication: Nammo v. TransUnion of Canada Inc., 2010 FC 1284, [2012] 3 F.C.R. 600 (Nammo), at paragraphs 72–76; see also Townsend v. Sun Life Financial, 2012 FC 550, 103 C.P.R. (4th) 424, at paragraph 31; Chitrakar v. Bell TV, 2013 FC 1103, 441 F.T.R. 254, at paragraph 26.
[98] The Commissioner argues that, given PIPEDA’s quasi-constitutional nature, damages may be awarded “even when no actual financial loss has been proven”: Nammo, above, at paragraphs 71 and 74. In addition to compensation, the goals of vindication and deterrence of further breaches are equally significant. The Commissioner took no position on whether damages are also required to compensate the applicant for any harm that he may have personally suffered as a result of the respondent’s actions.
[99] In Nammo, above, at paragraph 76, the Court proposed a non-exhaustive list of factors to determine an application for damages under PIPEDA, namely: (1) whether awarding damages would further the general objects of PIPEDA and uphold the values it embodies; (2) whether damages should be awarded to deter future breaches; and (3) the seriousness of the breach.
[100] I agree with the OPCC that the respondent’s breach is egregious because the respondent has essentially made a business of exploiting the privacy of individuals for profit. In at least one case, the respondent has refused to remove information which is subject to a publication ban in Canada.
[101] The evidence demonstrates that the impugned disclosure has been extensive. The respondent engaged in bulk downloading of Canadian court and tribunal decisions, republished them on Globe24h.com, and made the personal information at issue easily accessible on the Internet by allowing the decisions to be indexed by search engines, including the names of parties and other individuals referred to in the decisions. The respondent’s actions have violated the privacy rights afforded to individuals, including the applicant in this case, without the consent of the individuals concerned.
[102] Section 16 of PIPEDA provides no guidance as to the quantum of damages that may be granted. In Nammo, above, [at paragraph 71] an award of $5 000 was used to compensate for a “serious breach involving financial information of high personal and professional importance”. In Girao v. Zarek Taylor Grossman, Hanrahan LLP, 2011 FC 1070, 338 D.L.R. (4th) 262, I awarded $1 500 in damages taking into account the impact of the breach on the applicant, who claimed mental anguish, the conduct of the respondent both before and after the breach and whether the respondent benefitted from the breach. In that instance, only the impact of the breach was a significant factor as the respondent had not received any material benefit and had acted promptly to rectify the matter.
[103] In this case, I am satisfied that a damages award would be appropriate based largely on the conduct of the respondent. It is clear from the record that the respondent has commercially benefited from the breach through targeted advertising and by requiring a fee for removing the personal information of individuals contained in the decisions. The respondent has also acted in bad faith in failing to take responsibility and rectify the problem. In the circumstances, I consider that an award of $5 000 would be appropriate.
VII. COSTS
[104] The OPCC has not sought costs. As the applicant represented himself, he is only entitled to his out of pocket expenses. Given that he has had some difficulty in assembling all of his receipts, I think that a modest award of $300 would likely cover everything.
JUDGMENT
THIS COURT’S JUDGMENT is that:
1. It is declared that the respondent, Sebastian Radulescu, contravened the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 by collecting, using and disclosing on his website, www.Globe24h.com (Globe24h.com), personal information contained in Canadian court and tribunal decisions for inappropriate purposes and without the consent of the individuals concerned;
2. The respondent, Sebastian Radulescu, shall remove all Canadian court and tribunal decisions containing personal information from Globe24h.com and take the necessary steps to remove these decisions from search engines caches;
3. The respondent, Sebastian Radulescu, shall refrain from further copying and republishing Canadian court and tribunal decisions containing personal information in a manner that contravenes the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5;
(a) The respondent, Sebastian Radulescu, shall pay the applicant damages in the amount of $5 000;
(b) The applicant is awarded costs in the amount of $300; and
(c) The style of cause is amended to substitute the initials “A.T.” for the name of the applicant.
ANNEX A
Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5
Definitions
2 (1) The definitions in this subsection apply in this Part.
…
organization includes an association, a partnership, a person and a trade union. (organisation)
…
Purpose
3 The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
Application
4 (1) This Part applies to every organization in respect of personal information that
(a) the organization collects, uses or discloses in the course of commercial activities; or
…
Limit
(2) This Part does not apply to
…
(c) any organization in respect of personal information that the organization collects, uses or discloses for journalistic, artistic or literary purposes and does not collect, use or disclose for any other purpose.
…
Compliance with obligations
5 (1) Subject to sections 6 to 9, every organization shall comply with the obligations set out in Schedule 1.
…
Appropriate purposes
(3) An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.
…
Collection without knowledge or consent
7 (1) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may collect personal information without the knowledge or consent of the individual only if
…
(d) the information is publicly available and is specified by the regulations; or
…
Use without knowledge or consent
(2) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may, without the knowledge or consent of the individual, use personal information only if
…
(c.1) it is publicly available and is specified by the regulations; or
…
Disclosure without knowledge or consent
(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is
…
(h.1) of information that is publicly available and is specified by the regulations; or
…
Examination of complaint by Commissioner
12 (1) The Commissioner shall conduct an investigation in respect of a complaint, unless the Commissioner is of the opinion that
(a) the complainant ought first to exhaust grievance or review procedures otherwise reasonably available;
(b) the complaint could more appropriately be dealt with, initially or completely, by means of a procedure provided for under the laws of Canada, other than this Part, or the laws of a province; or
(c) the complaint was not filed within a reasonable period after the day on which the subject matter of the complaint arose.
…
Hearing by Court
Application
14 (1) A complainant may, after receiving the Commissioner’s report or being notified under subsection 12.2(3) that the investigation of the complaint has been discontinued, apply to the Court for a hearing in respect of any matter in respect of which the complaint was made, or that is referred to in the Commissioner’s report, and that is referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 or 4.8 of Schedule 1, in clause 4.3, 4.5 or 4.9 of that Schedule as modified or clarified by Division 1 or 1.1, in subsection 5(3) or 8(6) or (7), in section 10 or in Division 1.1.
…
Remedies
16 The Court may, in addition to any other remedies it may give,
(a) order an organization to correct its practices in order to comply with sections 5 to 10;
(b) order an organization to publish a notice of any action taken or proposed to be taken to correct its practices, whether or not ordered to correct them under paragraph (a); and
(c) award damages to the complainant, including damages for any humiliation that the complainant has suffered.
…
SCHEDULE 1
(Section 5)
Principles Set Out in the National Standard of Canada Entitled Model Code for the Protection of Personal Information, CAN/CSA-Q830-96
…
4.3 Principle 3 – Consent
The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
Note: In certain circumstances personal information can be collected, used, or disclosed without the knowledge and consent of the individual. For example, legal, medical, or security reasons may make it impossible or impractical to seek consent. When information is being collected for the detection and prevention of fraud or for law enforcement, seeking the consent of the individual might defeat the purpose of collecting the information. Seeking consent may be impossible or inappropriate when the individual is a minor, seriously ill, or mentally incapacitated. In addition, organizations that do not have a direct relationship with the individual may not always be able to seek consent. For example, seeking consent may be impractical for a charity or a direct-marketing firm that wishes to acquire a mailing list from another organization. In such cases, the organization providing the list would be expected to obtain consent before disclosing personal information.