Wednesday, July 26, 2017

British Columbia Commissioner finds that "Creep Catchers" violated province's privacy law

The Information and Privacy Commissioner of British Columbia has just released a very interesting decision and order against the "Surrey Creep Catchers". The Creep Catchers are a loosely affiliated group of people whose stated purpose is to expose online predators, particularly those who will then arrange to meet with children for nefarious purposes. Their modus operandi is to engage with people online, on dating sites and other sites, suggest they are underage and arrange a meeting. They then post video, chat logs, etc. to "expose" or shame the individuals.

In this case, two individuals who were targeted complained to the Information and Privacy Commissioner, who has found that the Creep Catchers violated the Personal Information Protection Act of BC. Most interestingly, the decision found (a) they are an "organization" for the purposes of the Act, (b) they are not engaged in journalism, so that exclusion doesn't help them, and (c) they cannot take advantage of the consent exceptions that apply for legitimate investigations.

A bit troubling is the uncritical following of the definition of journalism used in the decision of the Federal Court. One will hopefully recall that case was uncontested and the Court simply adopted the restrictive definition put forward by the Office of the Privacy Commissioner of Canada:

[18] In order for s. 3(2)(b) to apply, the Organization must be collecting, using, or disclosing personal information for a journalistic purpose. In A.T. v., the Federal Court of Canada considered what constitutes journalism for the purposes of the analogous section of the Personal Information Protection and Electronic Documents Act (PIPEDA).
The “journalistic” purpose exception is not defined in PIPEDA and it has not received substantive treatment in the jurisprudence. The OPCC submits that the Canadian Association of Journalists has suggested that an activity should qualify as journalism only where its purpose is to (1) inform the community on issues the community values, (2) it involves an element of original production, and (3) it involves a “self-conscious discipline calculated to provide an accurate and fair description of facts, opinion and debate at play within a situation”. Those criteria appear to be a reasonable framework for defining the exception. None of them would
apply to what the respondent has done.

[19] I use the above three criteria to determine whether an organization is carrying out its activities for a journalistic purpose under s. 3(2)(b) of PIPA.

I have cautioned before that one should be cautious in applying Globe24h because the entire court case was unopposed and the Court appears to have simply adopted the OPC's argument without too much critical discussion.

It should also be noted that the BC statute applies to a broader range of "organizations" than PIPEDA, for example. If this case were to arise under the federal statute, I'm not sure the OPC would be able to find jurisdiction.

Here is the summary of the decision prepared by the OIPC:

Two individuals complained that an organization improperly collected, used and disclosed their personal information. The organization had induced each individual to have online communication with a fictitious woman over the age of 18, subsequently conveyed that this decoy was under the age of 16, and arranged a meeting to confront each man for attempting to lure a minor. The organization video-recorded the encounter and disseminated the video on social media. The Acting Commissioner found that the organization collected, used and disclosed the complainants’ personal information contrary to the Personal Information Protection Act because it had not obtained their consent and had no other authority to collect, use or disclose their personal information. He ordered the organization to stop collecting, using and disclosing the complainants’ personal information, to destroy all of their personal information in its custody or under its control, and to ask others who disseminated the information to remove and destroy it as well.​