Ottawa, Ontario, February 5, 2007
PRESENT: The Honourable Mr. Justice Harrington
BETWEEN:
and
and
THE PRIVACY COMMISSIONER OF CANADA
Intervener
REASONS FOR ORDER AND ORDER
[1] Philippa Lawson, like many Canadians, is concerned with the collection, use and disclosure of personal information without consent. She is a lawyer and the executive director of the Canadian Internet Policy and Public Interest Clinic at the University of Ottawa’s Faculty of Law. The Clinic takes a deep interest in these matters.
[2] Having formed the view that Accusearch Inc., an American corporation, was routinely collecting, using and disclosing (usually for a fee) personal information about Canadians to Canadians and to others, for inappropriate purposes and without the knowledge and consent of the individuals in question, she filed a complaint with the Privacy Commissioner of Canada. She submitted that Accusearch Inc.’s activities were contrary to the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA). She called upon the Commissioner to investigate.
[3] After protracted correspondence and discussion, on 18 November 2005 the Office of the Privacy Commissioner, through Heather Black, Assistant Privacy Commissioner, refused to investigate. Although the refusal deals with a number of issues, in essence the Privacy Commissioner was of the view that PIPEDA did not give her jurisdiction to investigate Ms. Lawson’s complaint. This is a judicial review of that decision, a decision which raises important questions about the extraterritorial effect of Canada’s laws and the jurisdiction of Canadian tribunals absent a real and substantial connection with this country.
THE FACTS
[4] Ms. Lawson is a Canadian citizen. She resides and works here. Among other things, her Clinic assists clients in the preparation of complaints to the Privacy Commissioner and launches its own privacy complaints.
[5] In the winter of 2003-4 Ms. Lawson’s assistant was researching the practices of Internet online businesses. She came across a website by the name of Abika.com, which offered a variety of search services on individuals including background checks, psychological profiles, email traces, unlisted and cell phone numbers, automobile license plate details and criminal records. Many of these research services were for sale. These searches were not limited to Americans, but extended to persons in Canada as well as the United Kingdom, Australia, France, Germany, Russia, Italy, Hong Kong, Singapore, Japan and Taiwan.
[6] Background checks were offered on a “confidential basis” - that is to say, without the consent of the individual who was the subject of the search. Ms. Lawson tested the service by ordering a Canada background check on herself. She made this request from Canada using her Canadian work email address and a mail server for the University of Ottawa, which server is located in Canada. She paid US$119 for the report, using a Canadian credit card. An email from Abika.com confirmed the order and payment and requested further details, which she provided. These were her Canadian address, telephone number and date of birth.
[7] The search results were sent to Ms. Lawson’s work email address as requested. They purported to contain the results of a criminal record search and “psychological profile”. The criminal record search was apparently limited to Ontario and indicated that she had no criminal convictions. She did not file the “psychological profile” with the Court, but claims it is a useless piece of fiction.
[8] Using the Internet, the Clinic researched Abika.com. Apparently, it is a division of Accusearch Inc., a Wyoming corporation with its principal place of business in that state. According to the Office of the Wyoming Secretary of State, the president, secretary and treasurer of Accusearch Inc. is Jay Puler, address not provided. The registered agent is Jay Patel, with a Cheyenne, Wyoming address. Ms. Lawson also determined that the domain name Abika.com was registered with an American web hosting company. Its server is in the State of Delaware.
[9] Ms. Lawson initially complained to the Privacy Commissioner in June 2004. She alleged that Abika.com, in the course of private commercial activities, routinely collected, used and disclosed personal information about Canadians for inappropriate purposes and without their knowledge or consent. Furthermore, Abika.com was alleged to have compiled and disclosed inaccurate information under its “psychological profile” service. She went on at some length to submit that although based in the United States, Abika.com violated PIPEDA in a number of respects.
[10] I pause to say that the Privacy Commissioner is not arguing the complaint was trivial, frivolous, vexatious or made in bad faith; circumstances which would have justified a refusal to prepare a report. It is clear that if Accusearch Inc. were a Canadian corporation carrying on business in Canada through a website located in Canada, Ms. Lawson’s complaint would have been investigated.
[11] The Privacy Commissioner carried out a preliminary investigation designed to determine whether she had jurisdiction under PIPEDA. She discovered and informed Ms. Lawson that Accusearch Inc. appeared to operate another website, Abika.ca, which denoted some connection with Canada. However, this website was simply a conduit to connect with Abika.com. This led Ms. Lawson to reformulate her complaint, which she did on 20 December 2004. It should be mentioned that she also filed a complaint with the Federal Trade Commission in the United States on the grounds that Abika appeared to be violating various provisions of the U.S. Telecommunications Act of 1996 and the U.S. Fair Credit Reporting Act.
THE PRIVACY COMMISSIONER’S DECISION
[12] In declining to investigate the complaint on jurisdictional grounds, the Assistant Privacy Commissioner raised a number of important legal issues which I believe must be segregated and analyzed separately.
[13] As a matter of fact, the Commissioner contacted Abika.com in Wyoming. However, she wrote: “Our investigation efforts have been frustrated by the fact that Abika.com would not respond to our request for the names of its Canadian-based sources.”
[14] She went on to say that in order to investigate Abika.com based in Wyoming, her Office “…must have the requisite legislative authority to exercise our powers outside Canada.” She took the point that the basic principles of sovereignty and comity under international law mitigate against a country legislating outside its borders. While Parliament may legislate with extraterritorial effect, this is rarely done and, in her opinion was not done in this case. She added that normally, “Canadian legislation will only apply to the persons, property, juridical acts and events that occur within the territorial boundaries of the enacting body’s jurisdiction.”
[15] Since Abika.com had not provided the names of its Canadian-based sources, she added she would have “…no means of identifying – let alone investigating – those who would represent a Canadian presence for this organization and further, have no ability to compel an American organization to respond.”
[16] She said that the Abika.ca website denoted a Canadian presence, because the Canadian Internet Registration Authority (a non-governmental organization) would not otherwise grant such a registration. The registrant, however, could be a Canadian citizen, but reside and work elsewhere. She was of the view that the “.ca” registration was an insufficient connecting factor to indicate a real and substantial link between Canada and Abika’s operation in the United States.
[17] She shared Ms. Lawson’s concerns about the challenges posed by global electronic commerce and the indiscriminate non-consensual collection, use and disclosure of personal information by profiling and data broker organizations. She was frustrated that PIPEDA did not give her Office jurisdiction with respect to transborder data flow.
[18] The conclusion is most telling:
In conclusion, we cannot proceed with your complaint as we lack jurisdiction to compel U.S. organizations to produce the evidence necessary for us to conduct the investigation. As a result, I am sorry to say that we have no choice but to close this file. The organization has been so informed. However, you should know that we have just recently launched an investigation in respect of a similar organization where we have been able to identify the Canadian sources of data.
ISSUES
[19] Although on notice, the respondent, Accusearch Inc., has ignored this judicial review. However, the Privacy Commissioner has intervened in order to defend her decision.
[20] Three issues arise from this judicial review of her decision:
a. As a matter of statutory interpretation, did Parliament vest the Privacy Commissioner with the authority to investigate complaints levied against foreign organizations which collect, use and sell the personal information of Canadians?
b. If so, does the Privacy Commissioner have the discretion to refuse to carry out an investigation on the grounds that there are insufficient real and substantial connections with Canada?
c. What is the standard of judicial review of the Privacy Commissioner’s decision; correctness as submitted by Ms. Lawson or reasonableness simpliciter as submitted by the Commissioner?
DISCUSSION
The Standard of Review
[21] This case rests to be decided on statutory interpretation; more particularly, the scope of the Commissioner’s powers under PIPEDA. For the reasons set out by the Federal Court of Appeal in Blood Tribe Department of Health v. Canada (Privacy Commissioner), 2006 FCA 334, I am of the view that the standard of review is correctness. I refer also to Society of Composers, Authors and Music Publishers of Canada v. Canadian Assn. of Internet Providers, 2004 SCC 45, [2004] 2 S.C.R. 427 [SOCAN] at paragraphs 48 and 49.
The Meaning of PIPEDA
[22] As declared countless times by the Supreme Court (Bell ExpressVu Limited Partnership v. Rex, [2002] 2 S.C.R. 559, being but one example), the provisions of a statute are to be interpreted in a contextual and purposive way. The words used must be considered in context and in their grammatical and ordinary sense in harmony with the scheme of the statute, its object and the intention of Parliament.
[23] PIPEDA is more fully described as being, “An Act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, [and] by providing for the use of electronic means to communicate or record information or transactions...” Section 3 goes on to provide that the purpose of Part I of the Act is:
…to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right to privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
Part I applies to organizations which collect, use or disclose personal information in the course of commercial activities. An organization “…includes an association, a partnership, a person and trade union.” The issue here is whether PIPEDA applies to a foreign organization.
[24] Division II of Part I of the Act, sections 11 through 17, is titled “Remedies”. An individual may file a written complaint with the Commissioner that an organization has contravened a provision of the Act or has not followed a recommendation set out in Schedule I, being the national standard of Canada entitled “Model Code for the Protection of Personal Information.” Under section 12 of PIPEDA, the Commissioner shall conduct an investigation and to that end may issue subpoenas, administer oaths, enter premises and copy records. The Commissioner may also initiate her own complaints.
[25] The Commissioner may attempt to conclude a complaint by dispute resolution. Section 13 requires her to prepare a report unless she is of the view that the complainant ought first to exhaust grievance or review procedures otherwise available, or the complaint could be more appropriately dealt with by means of a procedure provided for under other federal or provincial law, or the complaint was stale dated when filed, or was trivial, frivolous, vexatious or made in bad faith. After receiving the report, a complainant may apply to this Court, which may, in addition to other remedies, order an organization to correct its practices, publish a notice of such action taken and condemn it to damages.
[26] The events leading to the enactment of PIPEDA and its purpose and meaning were extensively reviewed by Mr. Justice Décary in the Federal Court of Appeal’s decision in Englander v. TELUS Communications Inc., [2005] 2 F.C.R. 572, 247 D.L.R. (4th) 275. There was no doubt in his mind that PIPEDA established a right to protection of personal information collected, used or disclosed in the course of commercial activities in connection with a business, be it interprovincial or international. Ms. Lawson made the same point by referring to extracts from Hansard. In Bell ExpressVu, above, and SOCAN, above, the Supreme Court applied the Copyright Act and other statutes to communications to and from Canada. As noted by Mr. Justice Binnie at paragraph 68 of SOCAN, “…national practice confirms that either the country of transmission or the country of reception may take jurisdiction over a ‘communication’ link to its territory, although whether it chooses to do so is a matter of legislative or judicial policy…”
[27] With respect, I think the Commissioner did not distinguish her power to investigate from the effectiveness of her investigation.
[28] I agree with her that PIPEDA gives no indication that Parliament intended to legislate extraterritorially. The Supreme Court reached that same conclusion in SOCAN, above, but nevertheless held that the Copyright Act applied to protected works downloaded in Canada from foreign websites. The Commissioner does not lose her power to investigate because she can neither subpoena the organization nor enter its premises in Wyoming.
[29] The parties have both drawn analogies from the jurisdiction of courts. This is useful but cannot be carried too far. Although the Commissioner shares some powers with a court, such as the power of subpoena, her office is not a judicial tribunal. It is essentially an investigative tribunal. The Commissioner’s jurisdiction must be considered ratione materiae (over the subject matter), ratione personae (over the person) and ratione loci (over the territory).
Jurisdiction Ratione Materiae
[30] Common law courts generally take jurisdiction over all manners of dispute wheresoever arising. The jurisdictional issue is usually whether the Court should take jurisdiction over the defendant, or decline to do so because there is insufficient connection with Canada. A good example is the decision of the Ontario Court of Appeal in Bangoura v. Washington Post (2005), 258 D.L.R. (4th) 341. The Ontario courts had jurisdiction over the substance of the lawsuit, which was an alleged defamation. However, the Court refused to take jurisdiction over the defendant, an American newspaper, at the instance of a plaintiff who at the time of the alleged defamation was neither a Canadian citizen nor resident.
Jurisdiction Ratione Personae
[31] The important distinction between jurisdiction ratione materiae and jurisdiction ratione personae is not always apparent in decisions from superior courts of record organized by the provinces because they have unlimited jurisdiction over all manners of dispute, unless deprived thereof by legislation. However, this distinction is often at the forefront of decisions of this Court. The Federal Court only has jurisdiction ratione materiae if Parliament has properly confided that jurisdiction to it (ITO – International Terminal Operators Ltd. v. Miida Electronics Inc., [1986] 1 S.C.R. 752).
[32] Consider the decision of the Supreme Court in Holt Cargo Systems Inc. v. ABC Containerline N.V. (Trustees of), [2001] 3 S.C.R. 907. In that case an American stevedoring firm brought action in the Federal Court against a Belgian ship for services rendered in the United States. It even invoked U.S. law which gave it a maritime lien while Canadian domestic law did not. The only connection with Canada was the presence of the ship here. There was no question but that Parliament had given the Federal Court jurisdiction over the subject matter of the dispute notwithstanding that none of the parties resided and none of the events leading up to the arrest of the ship occurred here. Section 22 of the Federal Courts Act gave the Court jurisdiction over “any claim in respect of goods, materials or services wheresoever supplied to a ship…including... claims in respect of stevedoring…”
[33] The issue was whether the Federal Court should exercise its jurisdiction ratione personae particularly since there was a competing jurisdiction, Belgium. The Belgian shipowner had filed in bankruptcy there. Basing himself on unique credit arrangements which have developed in admiralty law over the millennia and the fact that the ship was subject to a maritime lien under the proper law of the dispute (U.S. law), Mr. Justice Binnie held that the Federal Court was right not to stay or dismiss the Canadian proceedings (see also the decision of the Federal Court of Appeal in United Nations v. Atlantic Seaways Corp., [1979] 2 F.C. 541).
[34] A Canadian court with jurisdiction ratione materiae will not take jurisdiction over a foreign defendant, not served here, when the matter has nothing to do with Canada. Even in cases where a foreign defendant is served here, the court may dismiss or stay the action on the principle of forum non conveniens, that there is a more appropriate court. The “real and substantial connection” test is also relevant in determining whether the courts in one province should enforce the judgment of another provincial court, and whether a foreign judgment should be enforceable in Canada (see Morguard Investments Ltd. v. De Savoye, [1990] 3 S.C.R. 1077; Muscutt v. Courcelles (2002), 60 O.R. (3d) 20; Beals v. Saldanha, 2003 SCC 72, [2003] 3 S.C.R. 416).
[35] It is important to keep in mind that when a Canadian court takes jurisdiction over a dispute having connections with other countries, it may under its own domestic conflict of law rules apply the appropriate foreign law if proved as a matter of fact to differ from the law of the forum.
[36] As noted by Chief Justice Laskin in Tropwood A.G. v. Sivaco Wire & Nail Co., [1979] 2 S.C.R. 157 at pages 166-167:
What is raised by the appellant, shortly put, is whether it is open to the Federal Court, in exercising its jurisdiction in the matter brought before it, to determine, pursuant to conflict of law rules of the forum, a choice of law rule to govern the determination of the suit. In the present case, the Federal Court has jurisdiction over the appellant and over the cause of action and there is a body of law which it can apply. It is my opinion that this body of law embraces conflict rules and entitles the Federal Court to find that some foreign law should be applied to the claim that has been put forward. Conflicts rules are, to put the matter generally, those of the forum. It seems quite clear to me that s. 22(3) of the Federal Court Act, which I have already referred to, envisages that the Federal Court, in dealing with a foreign ship or with claims arising on the high seas may find it necessary to consider the application of foreign law in respect of the cause of action before it.
[37] PIPEDA, however, does not, I would think, embrace conflict of law rules. This brings into issue a third aspect of jurisdiction, ratione loci.
Jurisdiction Ratione Loci
[38] Parliament cannot have intended that PIPEDA govern the collection and use of personal information worldwide. For instance, if Ms. Lawson were an American working in the United States, PIPEDA would have no application. Regulatory and investigative functions (as opposed to judicial) must have some connection with the state which enacts the underlying legislation. However, I believe the Privacy Commissioner erred in law by taking the position that Ms. Lawson’s complaint could only be investigated if Parliament had intended and had given extraterritorial effect to PIPEDA.
[39] The fact that an investigation might be ineffective is not the point. While it is true, as the Commissioner says, that her Office has no extraterritorial subpoena power over a non-resident, neither does a court of law.
[40] Private parties in a lawsuit in Canada cannot compel a foreigner to appear here to testify. Letters rogatory issued by a Canadian court to a foreign court requesting that a subpoena be issued in that jurisdiction requiring the witness to appear before a commissioner there are commonplace. By the same token, section 46 of the Canada Evidence Act contemplates that a foreign court or tribunal may likewise seek the aid of a Canadian court.
[41] Although the Commissioner faintly argued that there was no evidence of a connection with Canada, that was not the basis of her decision. Even if the “psychological profile” on Ms. Lawson was pure fiction and written in the United States, much of the data had to have come from Canada. The Commissioner acknowledged this in her decision when she wrote: “Abika.com has not responded to our request for the names of its Canadian-based sources.” The inability to identify Canadian sources may frustrate an investigation, but it cannot be said that PIPEDA should be interpreted in such a way that Parliament did not give the Commissioner jurisdiction. The Commissioner’s last sentence is inconsistent with her position that Parliament did not grant her jurisdiction. She wrote: “You should know that we have just recently launched an investigation in respect of a similar organization where we have been able to identify the Canadian sources of data.”
[42] It would be most regrettable indeed if Parliament gave the Commissioner jurisdiction to investigate foreigners who have Canadian sources of information only if those organizations voluntarily name names. Furthermore, even if an order against a non-resident might be ineffective, the Commissioner could target the Canadian sources of information.
[43] I conclude as a matter of statutory interpretation that the Commissioner had jurisdiction to investigate, and that such an investigation was not contingent upon Parliament having legislated extraterritorially as permitted by the Statute of Westminster.
May the Privacy Commissioner decline to investigate?
[44] Both Ms. Lawson and the Commissioner took the position that PIPEDA either gave her jurisdiction to investigate the complaint, or it did not. Both were of the view that if Parliament gave the Commissioner jurisdiction, then she must investigate. Section 12 of PIPEDA provides: “The Commissioner shall conduct an investigation in respect of a complaint…” [Emphasis added]. Section 13 goes on to provide that she shall prepare a report containing findings and recommendations, any settlement that was reached and, if not, identifying recourses which may be available. However, as mentioned earlier, the Commissioner is not required to prepare a report if satisfied that the complainant ought first to exhaust grievance or review procedures otherwise reasonably available; if the complaint could more appropriately be dealt with under other federal or provincial law or is stale dated, trivial, frivolous, vexatious or made in bad faith.
[45] It is common ground that there are no grievance or review procedures otherwise reasonably available, the complaint was timely and was not trivial, frivolous, vexatious or made in bad faith.
[46] One issue which could be considered is whether it would be more appropriate that the complaint be dealt with by means of a procedure provided under federal or provincial law.
[47] One possibility under provincial law is an action in defamation. However the facts of this case cannot support such an action. Even assuming the information in the psychological profile to be untrue, so far it was only communicated to Ms. Lawson herself. An action in defamation requires communication to someone else.
[48] The Commissioner herself cannot award damages. However, section 14 of PIPEDA provides that a complainant may, after receiving the Commissioner’s report, apply to this Court for a hearing and that this Court may, among other things, award damages. Ms. Lawson is unable to make such an application because no report has been issued. A money judgment may be enforced in another jurisdiction (Pro Swing Inc. v. Elta Golf Inc., 2006 SCC 52).
[49] We revert to geographical considerations, and the concept of forum non conveniens. The collection and communication of private information was both here (Canada) and there (United States) (Libman v. The Queen, [1985] 2 S.C.R. 178). The location of the website and the jurisdiction in which Accusearch Inc. was incorporated are not all controlling.
[50] It would not be appropriate to comment further on the discretion, if any, of the Commissioner to decline to exercise the jurisdiction given her by Parliament. The decision before me was that Parliament had not given her jurisdiction. However, I raise this point of discretion because it may be relevant when this matter is referred back to her for further investigation, or in other complaints. We do not know the status of the complaint filed in the United States, or the risk of double jeopardy to the respondent.
[51] In conclusion, PIPEDA gives the Privacy Commissioner jurisdiction to investigate complaints relating to the transborder flow of personal information.
ORDER
THIS COURT ORDERS that this application for judicial review is granted with costs. The matter is returned to the Office of the Privacy Commissioner to be investigated in accordance with the reasons given.
“Sean Harrington”
FEDERAL COURT
SOLICITORS OF RECORD
DOCKET: T-2228-05
STYLE OF CAUSE: Philippa Lawson v. Accusearch Inc. DBA Abika.com
and The Privacy Commissioner of Canada
PLACE OF HEARING: Ottawa, Ontario
DATE OF HEARING: January 22, 2007
REASONS FOR ORDER: HARRINGTON J.
APPEARANCES:
|
David Fewer Philippa Lawson
|
|
|
Steven Welchner Kris Klein
|
FOR THE INTERVENER |
SOLICITORS OF RECORD:
|
Canadian Internet Policy and Public Interest Clinic
|
|
|
Welchner Law Office Ottawa, Ontario |
FOR THE INTERVENER |