|
Privacy - PIPEDA (2). Google LLC v. Canada (Privacy Commissioner)
In Google LLC v. Canada (Privacy Commissioner) (Fed CA, 2023) the Federal Court of Appeal considered (and denied) an appeal against a Federal Court reference ruling (initiated by the Privacy Commissioner of Canada) that PIPEDA applied to Google's operation in Canada.
In these quotes the court concludes that PIPEDA (Part 1) does apply to Google's search engine activities as they do not "involves the collection, use, or disclosure of personal information for journalistic, artistic or literary purposes and for no other purpose" (the 'journalistic purpose' exception) [PIPEDA s.4(2)(c)]:[41] In answering this question, the reference judge did not accept Google’s submission, supported by the intervener Canadian Broadcasting Corporation / Société Radio-Canada (CBC), that she should consider only the articles published by recognized news media that prompted the complaint. She pointed out that even if the Court’s analysis was limited to searches on an individual’s name, a search of that kind could return not only news articles but a variety of other types of content, including personal blogs and websites, social media sites, and websites of businesses, governments, and non-governmental organizations. The resulting display of personal information, she stated, could go well beyond media content; it was “wide and varied”.
[42] The reference judge went on to address the contention that Google Search facilitates access to information, such as news media, and should therefore be regarded as publishing that information, an element of journalism. In declining to accept that proposition, the reference judge drew by analogy on Crookes v. Newton, 2011 SCC 47 at paras. 27-30, in which the Supreme Court held in the defamation context that hyperlinks do not amount to publication of the linked information. Like hyperlinks, she reasoned, internet searches give the search engine no control over content, express no opinion, and involve no content creation. An “ordinary understanding of the word journalism,” she stated, “encompasses content creation and content control [...]”.
[43] The reference judge found support for this proposition in the three-part definition of journalism developed by the Ethics Advisory Committee of the Canadian Association of Journalists (CAJ), proposed by the Commissioner and accepted by the Federal Court in AT v. Globe24h.com, 2017 FC 114 at para. 68. According to that definition, as set out by the Court in Globe24h.com,an activity should qualify as journalism only where its purpose is to (1) inform the community on issues the community values, (2) it involves an element of original production, and (3) it involves a “self-conscious discipline calculated to provide an accurate and fair description of facts, opinion and debate at play within a situation”. [44] The reference judge concluded that the operation of the Google search engine did not meet the Globe24h.com test, even if only the search results for the complainant’s name were considered:[F]irst, Google makes information universally accessible, which is much broader than informing a community about issues the community values; second, Google does not create or produce anything—it only displays search results; and third, there is no effort on the part of Google to determine the fairness or the accuracy of the search results. The publishers would be accountable for the accuracy of the content of a search result, not Google. [45] Continuing with her analysis of the second question, the reference judge turned to the “and for no other purpose” element of paragraph 4(2)(c). She agreed with the proposition put forward by Google that this phrase does not exclude commercial organizations because, in order for a paragraph 4(2)(c) issue to arise, the organization must be engaged in commercial activities within the meaning of subsection 4(1).
[46] However, she stated, citing the statutory interpretation principle that the legislature does not speak in vain and the presumption against tautology, this did not mean that the phrase has no meaning. The exemption under paragraph 4(2)(c) applies only where information is collected, used or disclosed exclusively for journalistic purposes, and she saw it as clear that the purposes of Google Search extend beyond journalism. She characterized its primary purpose as to index and present search results. This, she stated, was not primarily a journalistic purpose, because the only defining feature of journalism it entailed was to facilitate access to information.
[47] The reference judge also rejected the CBC’s submission that PIPEDA should be interpreted and applied in a manner that protects the freedom of expression guaranteed by the Charter. Referring to the Supreme Court’s decision in Wilson v. British Columbia (Superintendent of Motor Vehicles), 2015 SCC 47 at para. 25, she stated that it was not necessary to resort to Charter values in interpreting a statute absent a genuine ambiguity in its interpretation. She saw no ambiguity in the case before her: Parliament had limited PIPEDA to protecting journalism specifically and not expression more generally; it had protected the collection, disclosure, and use of personal information only for exclusively journalistic purposes; and the ordinary understanding of journalism, as proffered by journalists themselves, did not extend to Google’s search engine.
[48] She expressed her overall conclusion on the paragraph 4(2)(c) exemption issue as follows: “Google’s purposes for collecting, using and disclosing personal information […] are not journalistic, and they are certainly not exclusively so.” Accordingly, she answered “no” to the second reference question. At paras 67-91 the court considers (and dismisses) Google's appeal arguments on this 'journalistic purpose' exception.
. Google LLC v. Canada (Privacy Commissioner)
In Google LLC v. Canada (Privacy Commissioner) (Fed CA, 2023) the Federal Court of Appeal considered (and denied) an appeal against a Federal Court reference ruling (initiated by the Privacy Commissioner of Canada) that PIPEDA applied to Google's operation in Canada.
In these quotes the court concludes that PIPEDA (Part 1) does apply to Google's search engine activities as they "service, collect, use or disclose personal information in the course of commercial activities within the meaning of paragraph 4(1)(a) of PIPEDA when it indexes web pages and presents search results in response to searches of an individual’s name":[38] On the first sub-question, the reference judge determined that Google engages in collection when its crawlers access and copy the content on publicly accessible webpages, that it uses and discloses personal information of the subjects of a search, and that (as Google acknowledged) it also collects, uses, and discloses personal information of the individuals performing a search.
[39] On the second sub-question, she rejected Google’s contention, based on the traditional meaning of the term, that its search engine is not engaged in commercial activities. She described Google’s approach to this sub-question, which focused in large part on the fact that a search is free to the user, as “microscopic”, and as failing to recognize that personal information has itself become a commodity, which can be mined and used for profit. She referred to, among other things, the fact that Google is a for-profit corporation, and its acknowledgments that the bulk of its revenue comes from advertising, and that its search and other online services generate most of its advertising revenue. She found that “every component of [Google’s] business model is a commercial activity as contemplated by PIPEDA.” Accordingly, she answered the first reference question in the affirmative. . Google LLC v. Canada (Privacy Commissioner)
In Google LLC v. Canada (Privacy Commissioner) (Fed CA, 2023) the Federal Court of Appeal considered (and denied) an appeal against a Federal Court reference ruling (initiated by the Privacy Commissioner of Canada) that PIPEDA applied to Google's operation in Canada.
In these quotes the court sets out the statutory framework of Part 1 ['Protection of Personal Information in the Private Sector'] of PIPEDA:II. Statutory framework
[7] Part 1 of PIPEDA, entitled “Protection of Personal Information in the Private Sector,” is Canada’s federal private sector privacy legislation. (Part 2 of PIPEDA, entitled “Electronic Documents”, is not in issue here.)
[8] The purpose of Part 1, set out in section 3 of the Act as follows, is to establish rules that balance individuals’ right of privacy in personal information with organizations’ need to collect, use, or disclose that information:3 The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
3 La présente partie a pour objet de fixer, dans une ère où la technologie facilite de plus en plus la circulation et l’échange de renseignements, des règles régissant la collecte, l’utilisation et la communication de renseignements personnels d’une manière qui tient compte du droit des individus à la vie privée à l’égard des renseignements personnels qui les concernent et du besoin des organisations de recueillir, d’utiliser ou de communiquer des renseignements personnels à des fins qu’une personne raisonnable estimerait acceptables dans les circonstances. [9] Section 4 of PIPEDA governs the application of Part 1. Where Part 1 applies to an organization, the organization is subject to a series of principles in its collection, use, or disclosure of personal information. Among them is the principle set out in section 4.3 of Schedule I of the Act. It stipulates that “the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate” / “Toute personne doit être informée de toute collecte, utilisation ou communication de renseignements personnels qui la concernent et y consentir, à moins qu’il ne soit pas approprié de le faire.”.
[10] Section 4 reads in relevant part as follows (emphasis added):4 (1) This Part applies to every organization in respect of personal information that
4 (1) La présente partie s’applique à toute organisation à l’égard des renseignements personnels :
(a) the organization collects, uses or discloses in the course of commercial activities; […]
(a) soit qu’elle recueille, utilise ou communique dans le cadre d’activités commerciales; […]
(2) This Part does not apply to: […]
(2) la présente partie ne s’applique pas : […]
(c) any organization in respect of personal information that the organization collects, uses or discloses for journalistic, artistic or literary purposes and does not collect, use or disclose for any other purpose.
(c) à une organisation à l’égard des renseignements personnels qu’elle recueille, utilise ou communique à des fins journalistiques, artistiques ou littéraires et à aucune autre fin.
[11] Certain definitions, set out in section 2 of the Act, bear on the scope of these provisions:
organization includes an association, a partnership, a person and a trade union.
organisation S’entend notamment des associations, sociétés de personnes, personnes et organisations syndicales.
personal information means information about an identifiable individual.
renseignement personnel Tout renseignement concernant un individu identifiable. [12] However, the statute contains no definition of “journalistic purpose” / “fins journalistiques” or of “journalism” / “journalisme”.
[13] The Privacy Commissioner of Canada, an officer of Parliament, is mandated to oversee compliance with PIPEDA. Section 11 of the Act authorizes an individual to file with the Commissioner a written complaint against an organization for contravening, among other things, a provision of Division 1 of Part 1 of the Act, which deals with the protection of personal information. The Commissioner may also initiate a complaint if satisfied that there are reasonable grounds to investigate a matter.
[14] Subject to certain exceptions not applicable here, section 12 of the Act requires the Commissioner to investigate complaints. Section 12.1 of the Act gives the Commissioner or a delegate, in the conduct of an investigation, powers that include compelling oral or written evidence, compelling production of records, and entry of any premises other than a dwelling-house.
[15] However, the Commissioner has no authority to compel a resolution of a complaint or to grant a remedy to the complainant. Rather, PIPEDA vests remedial authority in the Federal Court. As set out in section 13, the most the Commissioner may do in response to a complaint is to issue a report containing findings and recommendations. By section 14, it is then open to the complainant—or to the Commissioner where the Commissioner initiated the complaint and certain other pre-conditions are met—to apply to the Federal Court for a hearing. By section 15, the Commissioner may also, with leave of the Court, appear as a party to any hearing applied for under section 14.
[16] A hearing under section 14 is “a proceeding de novo”. By section 17, it is to be heard in a summary way unless the Court considers that inappropriate. What is in issue in a section 14 hearing “is not the Commissioner’s report, but the conduct of the party against whom the complaint is filed.” “[T]he report of the Commissioner, if put in evidence, may be challenged or contradicted like any other document adduced in evidence”: Englander v. TELUS Communications Inc., 2004 FCA 387 at paras. 47-48; Canada (Privacy Commissioner) v. Facebook, Inc., 2023 FC 533 at para. 49.
[17] Section 16 of PIPEDA confers on the Federal Court broad remedial powers. They include authority to make compliance orders and award damages, including damages for any humiliation the complainant has suffered. . James v. Amazon.com.ca, Inc.
In James v. Amazon.com.ca, Inc. (Fed CA, 2023) the Federal Court of Appeal considered an appeal from a Federal Court application decision "that dismissed her application pursuant to section 14 ['Hearing by Court'] of the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA)". These quotes illustrate some procedures involved in such applications, and involvement of the PIPEDA 'Principles' [Schedule 1: "Principles Set Out in the National Standard of Canada Entitled Model Code for the Protection of Personal Information, CAN/CSA-Q830-96"]:[2] Subsection 14(1) of PIPEDA contemplates an application concerning any matter in respect of which a complaint was made to the Office of the Privacy Commissioner (the Commissioner) pursuant to certain provisions of PIPEDA once the Commissioner has issued a report regarding the complaint or has indicated that the investigation of the complaint has been discontinued.
[3] In this case, Ms. James made a complaint pursuant to PIPEDA against the respondent, Amazon.com.ca, Inc. (Amazon) for denying her access to her personal information in its possession following her unsuccessful attempts to access the information. The Commissioner subsequently indicated that the investigation of the complaint would be discontinued because Amazon’s denial of access to personal information was due to an inability to verify her identity. The Commissioner found Amazon’s response to be fair and reasonable. Ms. James was unable to provide the password that Amazon had associated with the relevant information. Ms. James was also unwilling to take the steps required to reset the password.
[4] The Federal Court agreed with the Commissioner that Amazon had not been shown to violate Ms. James’ rights to access her personal information (pursuant to Principle 9 set out in Schedule 1 of PIPEDA) where it could not verify her identity. To the contrary, the Federal Court found that Amazon could have been faulted for disclosing such information without proper authorization.
[5] The Federal Court rejected Ms. James’ allegation that her inability to gain access to the information in question was because of some inaccuracy in such information, in contravention of Principle 6. The Federal Court noted that this allegation had not been raised in the complaint to the Commissioner, and further that there was no evidence to support the allegation.
[6] The Federal Court also rejected Ms. James’ argument that Amazon had failed to respond in a timely manner to her request for access to personal information. The Federal Court found that the timeframe for a response (as contemplated in subsection 8(3) of PIPEDA) would not begin until Amazon was able to confirm Ms. James’ identity.
[7] Ms. James raises several issues on appeal, which can be summarized as follows:That the Federal Court erred in raising new issues;
That the Federal Court erred in finding no violation of Principle 9 relating to individual access to information; and
That the Federal Court erred in limiting the scope of its jurisdiction under Principle 6 relating to accuracy of information. [8] Because the Federal Court hears an application under section 14 of PIPEDA de novo (without deference to the Commissioner), the normal appellate standard of review described in Housen v. Nikolaisen, 2002 SCC 33, [2002] 2 S.C.R. 235, applies. Questions of law are reviewed on a standard of correctness, and only in cases of palpable and overriding error will this Court intervene on questions of fact or of mixed fact and law from which no issue of law is extricable. Palpable and overriding error means an error that is obvious and goes to the very core of the outcome of the case: Canada v. South Yukon Forest Corporation, 2012 FCA 165, 431 N.R. 286 at para. 46.
....
[13] With regard to the Federal Court’s finding that Amazon did not violate Principle 9, we see no reviewable error. The Federal Court relied on the evidence before it to conclude that there was sufficient doubt as to Ms. James’ identity to justify Amazon seeking further information before providing the requested personal information. The Federal Court was entitled to reach such a conclusion. Although it would have been preferable to do so, its failure to mention explicitly subsection 8(7) of PIPEDA was not an error since it clearly considered the provision.
|
