This week, I was pleased to be asked to be on a panel with Daniela Bassan on digital evidence for the Canadian Bar Association - Nova Scotia Annual Conference. I spoke about the mechanics of trying to gather and preserve digital (mainly online) information, and Daniela spoke about the process of getting court orders to preserve and access information from third parties.
In case it's of interest, here's my presentation:
You can download a PDF version of the presentation here.
A press release issued today by my firm and the other firms listed below, who are representing more than 40,000 Canadians affected by a Health Canada privacy breach:
The Office of the Privacy Commissioner of Canada has completed its investigation of Health Canada's privacy breach affecting over 40,000 licensees of the Marihuana Medical Access Program (MMAP), concluding that Health Canada violated federal privacy laws.
In November 2013, Health Canada sent written notices to over 40,000 individuals, outlining changes to the MMAP. The envelopes used for the mail-out clearly included the words "Health Canada - Marihuana Medical Access Program" on the return address, indicating to anyone who saw the envelopes that the recipient was either licensed to possess medical marihuana or to grow it for medical purposes. The envelopes were oversized so more likely to come to people's attention. Previously, Health Canada had been discreet in its communications with program members.
Three hundred and thirty nine affected individuals complained to the Office of the Privacy Commissioner, who initiated an investigation. The complainants cited several concerns relating to the impact of Health Canada's actions on their personal lives including concerns about losing their jobs, reputational damage and personal safety.
In a finding dated March 3, 2015, the Commissioner determined that Health Canada had violated the federal Privacy Act, which is designed to protect the privacy of Canadians when the federal government handles their sensitive information. The Commissioner's Finding was only sent to the 339 individuals who filed complaints with the Privacy Commissioner, but a copy of the document can be found here. Affected individuals who were not among the original complainants do not have to file additional complaints to the Commissioner, as the investigation is concluded.
The finding rejects the justifications put forward by Health Canada, which include blaming the patients for having gone to the media about the breach, which brought attention to the matter. The government also suggested that including the full name of the program instead of an abbreviation that would protect privacy was one of the "reasonable options" available to it under the law.
McInnes Cooper, Branch MacMaster LLP, Charney Lawyers, and Sutts Strosberg LLP are jointly representing affected users in an intended class action lawsuit against Health Canada filed in the Federal Court.
"It was clear to me, as soon as my phone started ringing in November 2013, that there was no justification for the careless error made by Health Canada in this case," said privacy lawyer David Fraser of McInnes Cooper. "It's one thing to acknowledge making a mistake, which Health Canada did, but immediately turning around to blame the victims is repulsive."
"We are pleased that the Privacy Commissioner of Canada agrees that Health Canada violated the law in its mishandling of patients' personal information," said David Robins of Sutts Strosberg LLP.
"Hundreds of people have reached out to us through our secure website for the class action to tell us how the breach has affected them, from lost jobs, effects on family relationships and social stigma. Each person who was a part of the MMAP was promised by Health Canada that their confidentiality would be protected," said Ted Charney of Charney Lawyers, adding that "the Commissioner is not able to award compensation to the victims or penalize Health Canada for its unlawful conduct, so the class action lawsuit is important in pursuing justice."
"We expect that the court hearing to ask that the case be blessed as a certified class action will take place in the early summer. If the judge agrees, we can move forward with the merits of the case," said Ward Branch of Branch MacMaster. "The privacy commissioner's report serves as a helpful roadmap for the case."
Affected class individuals are encouraged to register at www.marijuanaclassaction.com. While class members are not required to "opt in" to participate in the intended class action lawsuit, providing contact information and advising class counsel about how this privacy breach has affected you individually will help class counsel in bringing the case forward. Those who have already registered on the secure website do not need to re-register, but may want to update their information if their circumstances have changed or if they have experienced additional harms as a result of the breach.
About Branch MacMaster LLP
Branch MacMaster LLP is a boutique litigation law firm established in 1998 and located in Vancouver, British Columbia. The firm focuses on class actions, health, insurance, and personal injury. The firm provides responsive, flexible, and cost-effective service to their clientele.
About Charney Lawyers
Charney Lawyers is a Toronto, Ontario firm with an established reputation for excellence in advocacy. The firm is experienced in personal injury, class proceedings, commercial litigation, insurance defence, employment law, medical malpractice, food borne illness, construction law and appeals.
About McInnes Cooper
McInnes Cooper is among the top business and litigation law firms in Canada, with more than 200 lawyers in seven Canadian offices, serving clients across North America and abroad. The firm is a market leader in energy and natural resources, business, litigation, employment, tax, real estate and insurance law. McInnes Cooper is the exclusive member firm in Newfoundland, New Brunswick, Nova Scotia and Prince Edward Island for Lex Mundi – the world's leading network of independent law firms with in-depth experience in 100+ countries worldwide.
About Sutts Strosberg LLP
Sutts, Strosberg LLP is a nationally recognized law firm committed to excellence in litigation, with offices in Windsor and Toronto. The firm has a special interest in class actions, having represented groups or classes of individuals in every province and territory, and in every level of court, and is experienced in complex civil and commercial disputes, corporate, commercial and financial transactions, medical malpractice cases, personal injury cases, family law and criminal law.
In a decision issued yesterday, the Federal Court ordered the the identity of plaintiffs in a putative class action against Health Canada should be protected to allow them to pursue their claim against the Government for the breach of privacy of members of the Medical Marihuana Access Program.
As blogged about last year, my firm filed a proposed class action lawsuit against Health Canada after it sent a mailing to approximately 40,000 people who are authorized to possess or grow marijuana under the program administered by Health Canada. (More info is here.)
Shortly after the breach occurred, lawsuits were filed in the federal courts by my firm, McInnes Cooper of Nova Scotia, and Branch McMaster of British Columbia. Sutts Strosberg of Ontario filed a lawsuit in the Ontario Superior Court. Each of these cases has a separate named plaintiff and all three of them were filed with the intent that they would be certified as class actions on behalf of all similarly affected participants in the MMAP.
The suit commenced by McInnes Cooper was filed on behalf of “John Doe”, a resident of Nova Scotia. The suit commenced by Sutts Strosberg was filed on behalf of “Suzie Jones”, a resident of Ontario. The case commenced by Branch McMaster was filed on behalf of an individual who chose to identify himself. The “John Doe” and “Suzie Jones” cases have been consolidated into one case in the Federal Court of Canada.
“John Doe” and “Suzie Jones” are pseudonyms for the proposed representative plaintiffs, so that the identities of those individuals would not become known. On February 20, 2014, a motion was heard in the Federal Court of Canada for an order of the court protecting the identities of “John Doe” and “Suzie Jones”. In most cases, parties to a legal action are required to name themselves and this information appears on the public record. Because the case against Health Canada is based on the disclosure of program members’ identities in association with the MMAP, requiring participants in these lawsuits to name themselves would further harm their privacy.
On February 25, 2013 we received the decision of the Court. The Court agreed that to deny the plaintiffs anonymity in the court proceeding would disclose the very information they seek to protect and exacerbate the damage and/or risk of harm that has already been caused by Health Canada’s mailing that identified them as a participant in the Program.
Government lawyers, on behalf of Health Canada, argued that this was a matter related solely to marihuana use and that the plaintiffs’ privacy should not be protected. Relying on newspaper articles and internet research, they argued that public opinion about marihuana use has changed to be more accepting. The Court rejected this evidence as irrelevant, explaining:
“What the Plaintiffs’ marijuana use discloses is their medical and health information. The Plaintiffs are patients, no simply “users”. Disclosing their identities discloses that a course of treatment has been prescribed by them by a medical doctor, and that they suffer from serious health conditions and symptoms. Identifying the Plaintiffs by name or information that discloses their personal identity also discloses that they have or are likely to have medical marihuana in their homes – something that Health Canada itself saw as a serious safety and security risk.
Accordingly, I am satisfied that in the within case of John Doe and Suzy Jones, without the protection they seek on this motion, the important issues they raise in their Amended Statement of Claim may not be determined in this forum, and that the issues they raise regarding patient rights, privacy and whether Health Canada owes a duty of care and has breached that duty and is liable are issues that are in the public interest to be determined. The Plaintiffs have requested only that their personal identity be protected and with minimum intrusion on the open court process.”
It's particularly gratifying that the Court acknowledged that this isn't just a matter of protecting the privacy of marihuana users, but more centrally concerns sensitive health information that was disclosed.
(Members of the proposed class can register and get more information at http://www.marijuanaclassaction.com).
This afternoon, my firm filed a statement of claim in the Federal Court against Health Canada (John Doe v. Her Majesty) in connection with the massive privacy breach associated with the government’s medical marijuana program. As we understand it, Health Canada irresponsibly deviated from their usual practice of plain brown envelopes, couriers and registered mail by sending a mailing to around 40,000 individuals associated with the program clearly announcing the “Medical Marihuana Program” on the return address.
Between Friday and today, I have had many calls from individuals whose privacy was compromised by this breach, most of them fearing for their jobs and all of them concerned about their own safety. If it gets out in your community that you lawfully possess cannabis, this makes you a target for break and enters. The risk is even more heightened if you are a licensed grower of the plant. While this is a lawful program, the use of medical marijuana is heavily stigmatized.
This is not like most large-scale privacy breaches where the harm is mostly theoretical, since the missing hard-drive or thumb-drive likely didn’t leave the building. In this case, sensitive personal information was exposed to people who had no right to see it. I am told that some people have already lost their jobs because of this. For the rest, it is hard to put a price on legitimate concern about your family’s safety. I lived for a number of years in a community of 400 people, where the Canada Post employees were also neighbours.
Health Canada has dismissed this as a simple administrative error that they’ll endeavour to not repeat. But that’s not good enough from our government. People get to choose the businesses they deal with. If you don’t like how your bank or other service provider handles your personal information, you can change banks or businesses. But that’s not the case with your government. It’s a non-consensual relationship and the government owes a special duty of care to its citizens to protect them and to protect their sensitive personal information. Participants in this program were obtaining a restricted drug for medical purposes and could not do so lawfully except through the government program. Citizens should not have to choose between doing it lawfully or doing it safely. And we are talking about sensitive personal health information, which is generally recognized in Canada as the most sensitive personal information.
If you, or anyone you know, has been affected by this breach, please go to http://www.healthprivacyclassaction.com to provide your contact information so we can keep you apprised of this case as it progresses. Please provide an e-mail address that is confidential only to you. If this breach has had a particular impact on you, there is a portion of the form to provide details about this. Any information you provide will be kept confidential.
Here is the media release:
McInnes Cooper law firm files national class action in medical marijuana privacy breach
HALIFAX, Nov. 25, 2013 /CNW/ - McInnes Cooper law firm today filed a proposed class action in Federal Court against the Government of Canada in response to Health Canada's breach of the privacy rights of 40,000 patients in the Marijuana Medical Access Program. Under the Marijuana Medical Access Program, patients are permitted to grow marijuana in their residence for medicinal purposes.
Earlier this month, Health Canada sent these patients a letter via Canada Post that clearly indicated on the envelope that the named patient participated in the Marijuana Medical Access Program.
Health Canada's disclosure of the patients' private medical information has raised serious employment and security concerns, and caused the patients to suffer considerable stress and anxiety.
"As a result of Health Canada's error, we have already spoken with a number of people whose lives have been affected by this breach," said David Fraser, a national expert on privacy law, and McInnes Cooper's lead lawyer on this case.
"We have heard that some individuals have already lost their jobs as a result, and everyone we've spoken with is concerned about their safety in their homes."
SOURCE: McInnes Cooper
The statement of claim is here:
FEDERAL COURT
PROPOSED CLASS ACTION
BETWEEN:
JOHN DOE
PLAINTIFF
- and -
HER MAJESTY THE QUEEN
DEFENDANT
STATEMENT OF CLAIM
TO THE DEFENDANT:
A LEGAL PROCEEDING HAS BEEN COMMENCED AGAINST YOU by the Plaintiff. The claim made against you is set out in the following pages.
IF YOU WISH TO DEFEND THIS PROCEEDING, you or a solicitor acting for you are required to prepare a statement of defence in Form 171B prescribed by the Federal Courts Rules, serve it on the Plaintiff’s solicitor or, where the Plaintiff does not have a solicitor, serve it on the Plaintiff, and file it, with proof of service, at a local office of this Court, WITHIN 30 DAYS after this Statement of Claim is served on you, if you are served within Canada.
If you are served in the United States of America, the period for serving and filing your Statement of Defence is forty days. If you are served outside Canada and the United States of America, the period for serving and filing your Statement of Defence is sixty days.
Copies of the Federal Courts Rules, information concerning the local offices of the Court and other necessary information may be obtained on request to the Administrator of this Court at Ottawa (telephone: 613-992-4238) or at any local office.
IF YOU FAIL TO DEFEND THIS PROCEEDING, judgment may be given against you in your absence and without further notice to you.
Date: _____________________________________
Issued by: _________________________________
[Registry Officer]
Address of local office: 1801 Hollis Street,
17th Floor, Suite 1720
Halifax, N.S. B3J 1S7
To: The Attorney General of Canada
Attention: Mr. Willian F. Pentney, Deputy Attorney General of Canada
Claim
1. The Plaintiff claims on his own behalf and on behalf of the proposed Class:
a. An Order pursuant to Rules 334.16(1) and 334.17 of the Federal Courts Rules certifying this action as a class proceeding;
b. An Order pursuant to Rules 334.12(3), 334.16(1)(e) and 334.17(b) appointing the Plaintiff as the representative plaintiff for the Class;
c. Damages for the torts of intrusion upon seclusion, publicity given to private life, breach of confidence and negligence;
d. An Order pursuant to Rule 334.28(1) and (2) for the aggregate assessment of monetary relief and its distribution to the Plaintiff and the Class;
e. Prejudgment interest pursuant to section 36 of the Federal Courts Act;
f. Costs, if appropriate; and
g. Such further and other relief as this Honourable Court deems just.
Parties
2. The Plaintiff is an individual who resides in Nova Scotia. He is employed in the health care field.
3. The Plaintiff brings this action on his own behalf and on behalf of the members of the proposed class, which is defined as follows:
All persons who were sent a letter from Health Canada in November 2013 that had the phrase Marihuana Medical Access Program or a similar French phrase visible on the front of the envelope.
4. The Defendant, Her Majesty the Queen, is named as a representative of the Federal Government of Canada and Health Canada. Health Canada administers the Marihuana Medical Access Program under the Marihuana Medical Access Regulations.
Medical Marihuana Access Program
5. Through the Marihuana Medical Access Program, the Defendant grants access to marihuana for medical use to Canadians suffering from grave and debilitating illnesses.
6. Marihuana (cannabis) is categorized as a controlled substance, regulated in Canada under the Controlled Drugs and Substances Act. It is not legal to grow or possess marihuana except with legal permission by the Defendant under the Marihuana Medical Access Program.
7. The Plaintiff applied to participate in the Defendant’s Marihuana Medical Access Program to grow and possess marihuana to alleviate the pain that he suffers due to a medical condition. The Defendant approved the Plaintiff’s application.
Disclosure of the Plaintiff’s Private Information
8. The Defendant typically corresponds to the Plaintiff by courier service with plain unmarked brown envelopes.
9. During the week of November 21, 2013, the Defendant sent the Plaintiff a letter plainly and clearly indicating on the envelope that it was from Health Canada and that it was in regards to the Marihuana Medical Access Program.
10. By publically indicating that the Plaintiff was a participant in the Marihuana Medical Access Program, the Defendant disclosed the personal health information about the Plaintiff. Furthermore, the Defendant’s disclosure creates a security concern by alerting other individuals that the Plaintiff may possess and/or grow marihuana at his residence.
Negligence
11. At all material times, the Defendant owed a duty of care to the Plaintiff and the proposed Class.
12. Furthermore, the Defendant had a statutory duty under subsection 8(1) of the Privacy Act to not disclose personal information without that individual’s consent. The Plaintiff’s and the Class’ participation in the Marihuana Medical Access Program constitutes personal information as it is confidential information and relates to their medical history.
13. The Defendant breached its duty of care owed to the Plaintiff and the Class by:
a. Failing to meet its statutory duties and/or policies in the collection, retention and disclosure of personal information;
b. Failing to take reasonable steps to ensure the personal information was not disclosed;
c. Failing to communicate with the Plaintiff and the Class in a manner that did not disclose their personal information; and
d. Other such particulars as counsel may advise.
Publicity Given to Private Life
14. Through its actions stated above, the Defendant gave publicity to the Plaintiff’s private, personal information, particularly his medical condition.
15. The Plaintiff’s private personal information is of no legitimate concern to the public. The Defendant’s disclosure of the Plaintiff’s private personal information is highly offensive to a reasonable person.
Breach of Confidence
16. The Plaintiff states that the Defendant committed the tort of breach of confidence.
17. In applying to participate in the Marihuana Medical Access Program, the Plaintiff conveyed confidential information in confidence to the Defendant.
18. In its actions stated above, the Defendant misused the Plaintiff’s confidential information to the Plaintiff’ detriment.
Intrusion upon Seclusion
19. The Defendant’s above stated actions constitute an intrusion on seclusion in a manner that would be highly offensive to a reasonable person.
Relief Sought
20. The Defendant’s actions have caused the Plaintiff and the Class to suffer the following damages:
a. Costs incurred in taking additional security precautions;
b. Damage to reputation;
c. Damage to employment;
d. Mental distress;
e. General damages; and
f. Inconvenience, frustration and anxiety.
General
21. The Plaintiff proposes that this trial take place in Halifax.
DATED at Halifax, in the Province of Nova Scotia, this 25th day of November 2013.
PLACE OF TRIAL: HALIFAX, NOVA SCOTIA
____________________________________
David T.S. Fraser
Solicitor for the Plaintiff
A growing portion of my practice is working with the litigators in my firm on cases of online torts, including defamation and harassment. This mainly involves working to track down people who do harmful things under a veil of supposed internet anonymity. This includes people who hide behind pseudonyms on chat boards and other internet fora while saying defamatory things in addition to the (apparently) growing problem of creating fake Facebook profiles in order to harass and bully others. We've dealt with similar situations involving online dating sites, where people have set up fake profiles in the names of the victims in order to harass them.
I'm not sure about the psychology behind this, but it certainly appears as though many people feel free to say things about others on the internet that they would never say in "public" or to the person's face. Others, bullies in particular, see the internet as a great place to extend their activities, often with very harmful results.
Some of the cases I've worked on have become well-publicized in this region, and I was asked by the Canadian Bar Association - New Brunswick Branch to present on the topic at their annual Mid-Winter Meeting. In case you're interested, below is a presentation on what sorts of tracks people leave online and how they can be assembled and used to try to identify otherwise unnamed defendants. In almost all cases, they involve applying to the court for Norwich orders, which is a form of order from the court to require a mostly uninvolved third-party to provide information that will lead to the identification of the actual defendant. The court, acting as the gatekeeper, needs to balance the interests of the plaintiff who is looking for a remedy against the interests of both the third party service provider and the unnamed defendant. In short, the court should not allow a fishing expedition, nor should it allow the disclosure if the claim is not reasonably well established. Only if the plaintiff is able to satisfy the following test will the court order disclosure:
(1) the applicant must establish a bona fide claim against the unknown alleged wrongdoer;(2) the third party against whom discovery is sought must be in some way connected to or involved in the misconduct;
(3) the third party must be the only practical source of the information available to the applicant;
(4) the third party must be reasonably compensated for expenses and legal costs arising out of compliance with the discovery order; and
(5) the public interest in favour of disclosure must outweigh the legitimate privacy interests.
Here is the presentation I gave to the Canadian Bar Association New Brunswick's Mid-Winter Meeting:
https://docs.google.com/present/view?id=ddpx56cg_379fgxwmgd4&interval=60
Here are a couple of notable reported cases where we have been successful in obtaining information from third party service providers to identify defendants:
Last month, one of my partners made an application before the New Brunswick Court of Queens bench for an unusual ex parte order for the preservation and production of the contents of plaintiff's Facebook account. The order and reasons are here: Sparks v. Dubé, 2011 NBQB 40 (CanLII).
It's an unusual situation, which is well summarized by Dan Michaluk: Court Grants Ex Parte Order to Preserve Facebook « All About Information.
Today, the Federal Court of Canada released an important decision on the parameters of "commercial activity" under PIPEDA: State Farm v Privacy Commissioner, 2010 FC 736. Because I was one of the counsel on the case, I can't say much so I'll leave it to Dan Michaluk to provide a full, unbiased summary.
In short, the Court concluded that an insurance company, acting on behalf of its insured in defending a personal injury claim, is not engaged in "commercial activity" so PIPEDA does not apply. Though the case it not specifically followed, this conclusion is consistent with Ferenczy v. MCI Medical Clinics (some commentary here).
Here's something interesting ...
An advisory opinion by the Philadelphia Bar Association says it's unethical to ask a third party to friend someone on Facebook to obtain information about them:
Attorney Can’t Ask 3rd Party to ‘Friend’ Witness on Facebook, Opinion Says ABA Journal - Law News NowAttorney Can’t Ask 3rd Party to ‘Friend’ Witness on Facebook, Opinion Says
Posted May 5, 2009, 07:38 pm CDT By Martha Neil
A lawyer who wants to see what a potential witness says to personal contacts on his or her Facebook or MySpace page has one good option, a recent ethics opinion suggests: Ask for access.
Alternative approaches, such as secretly sending a third party to "friend" a Facebook user, are unethical because they are deceptive, says the Philadelphia Bar Association in a March advisory opinion.
Not telling the potential witness of the third party's affiliation with the lawyer "omits a highly material fact, namely, that the third party who asks to be allowed access to the witness’s pages is doing so only because he or she is intent on obtaining information and sharing it with a lawyer for use in a lawsuit to impeach the testimony of the witness," the opinion explains.
"The omission would purposefully conceal that fact from the witness for the purpose of inducing the witness to allow access, when she [might] not do so if she knew the third person was associated with the inquirer and the true purpose of the access was to obtain information for the purpose of impeaching her testimony."
Facebook and MySpace profiles are different from public spaces where one can freely film and record others, the opinion says, because an invitation is required to access them, notes a Social Media Today post on the opinion.
Join the discussion about this issue over at Slaw.ca: Is it OK to use deceit to get Facebook users’ info?.
An Ontario arbitrator for the Financial Services Commission of Ontario has recently had an opportunity to consider whether a breach of PIPEDA in the collection or handling of intended evidence in a hearing will result in it not being admissible in the hearing. Arbitrator Rogers concluded, following Ferenczy v MCI Medical Clinics (see Canadian Privacy Law Blog: Admissibility of video surveillance evidence), that it does not. See Para 35, below.
Since the case isn't on CANLii yet, here's the full text:
Borowski v. Aviva Canada Inc.
Financial Services Commission of Ontario (Arbitration Decision)
J. Rogers Member
Heard: July 29, 2008 Judgment: September 12, 2008 Docket: FSCO A07-002593 J. Rogers Member:
Issues:
1 The Applicant moves for an order excluding the expert reports Aviva Canada Inc. ("Aviva") obtained from Brigham & Associates Inc. from the arbitration hearing and, in the alternative, an order requiring Aviva to fund replies to these reports.
2 The issues are:
1. Are the reports Aviva obtained from Brigham & Associates Inc. admissible at the arbitration hearing regarding Mr. Borowski's entitlement to a catastrophic designation?
2. If the reports are admissible, does Aviva have an obligation to fund replies to these reports under section 24 or 42 of the Schedule?
Result:
3
1. The reports Aviva obtained from Brigham & Associates Inc. are admissible at the arbitration hearing.
2. Aviva does not have an obligation to fund replies to these reports under section 24 or 42 of the Schedule.
Scope of Motion:
4 Mr. Borowski sought a ruling precluding Aviva from submitting that it is premature to decide whether to exclude the subject reports on the grounds that they are of little probative value. Mr. Borowski argued that Aviva was estopped from taking this position because Aviva agreed that admissibility of the reports would be determined in advance of the hearing.
5 Aviva submitted that its objection was properly made because, when it agreed that the issue would be determined by way of a pre-hearing motion, the only position that Mr. Borowski had taken was that the reports should be excluded since they were obtained in breach of section 42 of the Schedule.
6 I ruled that Aviva's agreement was not a concession that every argument that Mr. Borowski chose to raise on admissibility of the reports was properly the subject of this motion. I also informed the parties that the issue was largely moot, because Aviva's concern that a pre-hearing determination of probative value would usurp the role of the hearing Arbitrator was resolved by the fact that I will be presiding at the hearing as well as the motion.
Facts:
7 The facts are not in dispute. Mr. Borowski was injured in a motor vehicle accident on October 24, 2001. He applied for and received statutory accident benefits from Aviva, payable under the Schedule. The parties disagree on his entitlement to certain further benefits and on whether Mr. Borowski sustained a catastrophic impairment as a result of the accident.
8 In January 2007 Mr. Borowski submitted an Application for Determination of Catastrophic Impairment, supported by a report authored by Dr. Ronald Kaplan. Pursuant to section 42 of the Schedule, Aviva gave Mr. Borowski notice in March 2007 that it required him to attend medical examinations regarding this issue. Mr. Borowski attended the examinations deemed necessary by the three-person medical team Aviva chose. The team delivered its reports in August 2007 and, based on these reports, Aviva determined that Mr. Borowski did not sustain a catastrophic impairment as a result of the accident. Mr. Borowski obtained rebuttal reports, authored by a three-person team of his choice, pursuant to section 42.1 of the Schedule.
9 Mr. Borowski applied for mediation and, after mediation failed to resolve the dispute, he applied for arbitration. A pre-hearing was held on April 29, 2008. Aviva served Mr. Borowski with the three reports at issue in this motion on May 4, 2008. They were authored by three doctors from the United States who conduct business under the name of Brigham & Associates. Counsel for Aviva retained Brigham & Associates to conduct a "paper review" of the material in Aviva's possession and give their opinion on whether Mr. Borowski had sustained a catastrophic impairment. Aviva provided Brigham & Associates with copies of Mr. Borowski's medical records it had received and copies of the reports of its doctors and Mr. Borowski's doctors. Aviva did not seek Mr. Borowski's consent. Brigham & Associates concluded that Mr. Borowski did not sustain a catastrophic impairment as a result of the accident.
Parties' Positions:
10 Mr. Borowski's position is that the reports from Brigham & Associates should be excluded because his contract with Aviva and the Schedule provide a complete code of Aviva's rights of access to his medical records and its use of those records. He argues that, since neither his contract nor the Schedule specifically provides that Aviva may disclose his medical records except in the context of an examination under section 42 of the Schedule, Aviva is precluded from disclosing those records, except for the purpose of a section 42 examination. Aviva therefore obtained the reports from Brigham & Associates by breaching his right to privacy.
11 Mr. Borowski further submits that the reports should be excluded because Aviva breached the provisions of the Personal Information Protection and Electronic Documents Act, 2000 (the PIPED Act) and its own Privacy Policy by sending his medical records to Brigham & Associates. He also submits that the reports should be excluded because the authors usurp the function of the Arbitrator by offering their opinion on the interpretation of the relevant legislation, criticizing the judicial approach to the legislation and impugning Mr. Borowski's credibility. Finally, Mr. Borowski submits that the reports should be excluded because they are of little probative value.
12 Aviva submits that, although its contract with Mr. Borowski and the Schedule provide a complete code of the parties' substantive rights, neither addresses the scope of procedural rights in the context of adversarial proceedings. It concedes that the subject reports were not obtained pursuant to section 42 of the Schedule, but argues that it is permitted to obtain them, unless specifically prohibited by statute or legal principle. Its position is that, because Mr. Borowski's medical condition is at issue in the arbitration, there is a diminished expectation of privacy regarding his relevant medical records. It therefore did not breach his right to privacy in providing his records to Brigham & Associates. It argues that, even if it did breach Mr. Borowski's rights in obtaining the reports, the breach was minor and the jurisprudence does not support exclusion of the reports in those circumstances.
13 Aviva denies that it breached the PIPED Act or its Privacy Policy and submits that, although the Brigham & Associates' venture into statutory interpretation might mean that some sections of the reports would be excluded or given no weight, that does not lead to exclusion of the reports in their entirety.
Complete Code of Rights:
14 As noted above, Mr. Borowski's position is that his contract with Aviva and the Schedule circumscribe the information he is required to provide to Aviva, the purposes for which Aviva may use the information and the persons to whom Aviva may disclose it. He argued that he only provided Aviva with his medical records because he was required to do so for the purpose of the examination permitted by section 42 of the Schedule, therefore Aviva was only permitted to use them for that purpose.
15 Section 33(1.1) of the Schedule imposes a general obligation on insured persons to provide insurers with "[A]ny information reasonably required to assist the insurer in determining the person's entitlement to a benefit." In addition, Rule 32 of the Dispute Resolution Practice Code (the "Code") imposes the requirement for "prompt and complete exchange of documents that are reasonably necessary to determine the issues being arbitrated". It is therefore not accurate to say that Mr. Borowski disclosed his medical records only because Aviva had the right to have him examined pursuant to section 42. Mr. Borowski was required to provide that information in any event. Neither the Schedule nor the Code prescribes limits on the insurer's use of the information it receives.
16 Section 42 of the Schedule does not address information to be provided to an insurer. Section 42(10)(a) addresses information to be provided to "the person or persons conducting the examination" where an insured person is required to attend an examination under section 42. Section 42(10)(a) places an obligation on both the insured person and the insurer to "provide to the person or persons conducting the examination all reasonably available information and documents that are relevant or necessary for the review of the insured person's medical condition". That means that the insurer is required to provide to the person conducting the examination any relevant information it has received from the insured person and any other relevant information in its possession. The insured person also has a similar obligation to provide information directly to the person conducting the examination.
17 The thrust of section 42(10)(a) is to ensure that examinations of insured persons are conducted with all relevant knowledge. In providing for the insured person to provide information directly to the person conducting the examination, it safeguards the interest of an insured person in having the examination conducted on the basis of a complete record. It regulates neither the information to which insurers are entitled, nor the uses that insurers may make of the information they acquire.
18 Section 42(10)(a) certainly allows insurers to provide information to persons conducting examinations on their behalf. However, that does not mean that this is the only permitted use. To accept Mr. Borowski's position would mean that Aviva would be precluded from filing his medical records as evidence in the very proceeding in which he was required to disclose them, because there is no provision that specifically permits Aviva to do so.
19 Mr. Borowski relies on the decision of the Court of Appeal in Haldenby v. Dominion of Canada General Insurance Co. in support of his position that the Schedule contains a complete code of the rights of the parties. In that case the Court held that the insured person had no right to reapply for further income replacement benefits, after the insurer had terminated those benefits, because there was no provision in the Insurance Act or the Schedule to allow it. The Court noted that the suggested approach would "extend a claimant's entitlement to benefits for an indeterminate period of time" and that it was contrary to the scheme of the Schedule. The Court did not rule that the Schedule is a complete code of all procedural and substantive rights of the parties. I accept Aviva's submission that this decision reaffirms the trite maxim that the substantive rights of the parties must be found in the Insurance Act or the Schedule.
20 If one were required to look to the Schedule for every step in the dispute resolution process, it would grind to a screeching halt. For instance, although Mr. Borowski concedes that Aviva had the right to share his medical information with its counsel, the Schedule does not confer that right. Similarly, the Schedule does not contemplate the standard practice of retaining accountants and providing them with the insured person's financial records, where the quantum of entitlement to income replacement benefits is at issue. The Schedule does not contemplate that insurers would retain experts in accident reconstruction, often providing them with the medical records of the insured person, where there is a dispute about whether an accident occurred. The Schedule does not permit the common practice of applicants who obtain expert opinions by non-treating doctors, for the sole purpose of presenting them as evidence in the arbitration.
21 The admissibility of evidence at an arbitration hearing is addressed in Rule 39.3 of the Code and section 15 of the Statutory Powers Procedure Act. The only limits on the admissibility of relevant evidence found in those provisions are:
- Evidence that would not be admissible in a court by reason of any privilege under the law of evidence;
- Evidence that is not admissible under the Insurance Act; or
- Evidence that is not admissible under any other statute.
22 None of those restrictions applies here.
23 Aviva is by no means the first Insurer to have obtained an opinion based on a paper review. Arbitrators have commented on the practice in several decisions. The practice has never been censured. In Hart and Allstate Insurance Company of Canada, the Arbitrator made the following comment in refusing to find that proposed section 42 examinations were reasonable and necessary:
I have no evidence as to how examinations today will shed greater light on Mrs. Hart's physical or emotional condition four years ago (regarding the partial inability test) or six years ago (regarding causation) than a paper review by experts of Allstate's choice (given the extensive document production over and above the prior DAC assessments), which has been and continues to be an option at the Insurer's disposal.24 In Rushlow and ING Insurance Company of Canada, the Arbitrator made the following comment in similar circumstances:
If ING desires further input of a neurophysical nature, there is nothing to prevent it from obtaining a "paper" opinion based on the documents and reports...25 The theme was revisited in Wilson and Aviva Canada Inc. In that decision, the Arbitrator noted as follows:
While the law and the jurisprudence are clear that section 42 of the Schedule gives the insurers a right to override such normal privacy concerns, provided that the legal pre-conditions for the examination are met in this matter, I have found that those pre-conditions were not met.
While it may well have been reasonable to perform an unintrusive paper review of Ms. Wilson's condition, based on the extensive material potentially available to the Insurer, this is not what was proposed.
26 Although the issue of whether an insurer breaches the Schedule or the privacy interests of the Insured person in conducting a "paper review" was not raised in the above cases, the endorsement of the practice in these decisions suggests that a breach is not gross, plain and obvious, as Mr. Borowski submitted. The decisions recognize that a paper review is a relatively unintrusive means of obtaining evidence for a hearing.
27 The principle that a party to an adversarial proceeding is entitled to a diminished expectation of privacy concerning personal information relevant to the dispute is well established. Because Mr. Borowski was required to disclose his medical records to Aviva, the narrow question is whether it was reasonable to expect that Aviva was precluded from disclosing the information it received to its agents. Mr. Borowski concedes that Aviva had the right to disclose the information to counsel. I see no substantive difference between disclosure to counsel and Aviva's disclosure to medical experts for the purpose of obtaining an opinion on the issue in dispute. Aviva's recruitment of professional expertise is at the heart of both relationships.
28 I find that Aviva did not breach the provisions of the Schedule or violate Mr. Borowski's reasonable expectation of privacy in obtaining the reports from Brigham & Associates. This ruling does not mean that there would be no limits on what Aviva can do with the personal information it receives from Mr. Borowski, as he submitted. Aviva has simply provided information to its agent for a purpose related to an ongoing dispute. It is not necessary to speculate on what the limits might be, for the purpose of this decision.
29 Because the right to obtain the subject reports is not based on section 42 of the Schedule, I find that Aviva was not required to comply with the notice provisions of section 42, as Mr. Borowski submitted. For the same reason, Aviva is not required to fund rebuttal reports pursuant to section 42 of the Schedule.
Violation of the Piped Act or Privacy Policy:
30 The PIPED Act regulates the collection, use and distribution of personal information collected in the course of commercial activity.
31 Mr. Borowski relies on the decision of the Federal Court of Appeal in Rousseau v. Canada (Privacy Commissioner) in support of his position that his medical records were provided to Brigham & Associates, in breach of the provisions of the PIPED Act. The applicant in that case was receiving long-term disability benefits from an insurer. Pursuant to its right under the insurance policy, the insurer required the applicant to attend an independent medical examination (IME). The insurer terminated benefits on the basis of the report. The applicant sought production of the complete file of the doctor who had performed the examination. The doctor refused to disclose his handwritten notes. The issue on appeal was whether the handwritten notes of a doctor performing an IME in Ontario, at the request of an insurer, are personal information under the PIPED Act. The Court had to determine that issue in the applicant's favour in order to grant the only remedy sought under the PIPED Act: the right of the applicant to access to the information.
32 At the appeal, the applicant limited his request to the doctor's notes on the answers he gave to questions asked and the doctor's observations of the applicant's behaviour. The Court ruled that the doctor's notes contained the applicant's personal information to which he has a right of access and remitted that matter to the Privacy Commissioner for a determination of which portions of the notes should be disclosed. The Court noted as follows:
In light of the Privacy Commissioner's recognition that there are in the notes information which is personal to Mr. Rousseau and information which is not, it may be said that in the end, Mr. Rousseau has a right of access to the information he gave to the doctor, and to the final opinion of the doctor in the form of the report to the insurer. In accordance with Principle 4.9.1 of Schedule 1 to the PIPED Act, this enables Mr. Rousseau to correct any mistakes in the information he gave the doctor or which the doctor noted, as well as any mistakes in the doctor's reasoned final opinion about his medical condition. But the process of getting to that final opinion from the initial personal information of Mr. Rousseau belongs to the doctor.33 This excerpt highlights the fact that the issue in Rousseau was quite different from the issue in this motion. Mr. Rousseau was seeking access to his records, not the exclusion of evidence. The PIPED Act provides no such remedy. The Court was not asked to address the question of whether the insurer or the doctor conducting the IME breached the Act in the transfer of the medical records.
34 The Court noted that, before the matter was heard, Mr. Rousseau and the insurer had settled an action he had commenced in the Superior Court. There is no mention of an order excluding the doctor's report from evidence in that action. In Rousseau, the focus of the Court was on determining whether the doctor conducting the IME was engaged in "commercial activity", a requirement for the PIPED Act to apply, and whether the doctor was in possession of the personal information of Mr. Rousseau.
35 In Ferenczy v. MCI Medical Clinics, the Ontario Superior Court directly addressed the question of whether a potential breach of the PIPED Act should result in the exclusion of evidence obtained as a result of the breach. In that case, the plaintiff in an action for damages for the alleged negligence of a doctor sought an order excluding surveillance evidence on the grounds that it was personal information, collected or recorded in violation of the PIPED Act. The Court refused to exclude the evidence, giving the following reasons:
At the outset I wish to point out that the Act does not contain a provision which prohibits the admissibility into evidence of personal information collected or recorded in contravention of the Act. Rather the Act provides that an individual or the Privacy Commissioner may bring a complaint which results in an investigation and report under the Act. Thereafter, certain steps described in the legislation may be taken in the Federal Court. Consequently, if the collection of surveillance evidence in this case is said to be a violation of the Act a complaint may be filed pursuant to the Act to commence that process. However, that has no direct impact on the issue of the admissibility of evidence in this trial.
The evidence at issue here is relevant, in my view, and the probative value of the evidence exceeds its prejudicial effect. By prejudicial effect, I mean the danger that the evidence will be misused. As stated, I have concluded that a proper limiting instruction is adequate in this case to ensure that the evidence is used for the limited purpose for which I propose to admit it.
This is not a case involving state action and consequently no consideration arises as to the applicability of the Canadian Charter of Rights and Freedoms or the exclusion of evidence pursuant to the provisions of the Charter.
Prima facie relevant evidence is admissible, subject to a discretion to exclude where the probative value is outweighed by its prejudicial effect. This is the test in both criminal and civil cases: R. v. Morris, [1983] 2 S.C.R. 190, 1 D.L.R. (4th) 385, 48 N.R. 341, 7 C.C.C. (3d) 97; and see Sopinka, Lederman and Bryant, The Law of Evidence in Canada, 2nd ed. (Toronto: Butterworths, 1999) at pp. 23-38.
There is also a discretion in a trial judge to exclude evidence that would render a trial unfair. In R. v. Harrer, [1995] 3 S.C.R. 562, 128 D.L.R. (4th) 98, Justice La Forest concluded that this historical concern with trial fairness has now been enshrined in s. 11(d) of the Charter. As I have indicated the Charter is not at issue in this case. However, that does not mean that the common law discretion to exclude evidence, to which Justice La Forest was referring as the underpinning of s. 11(d) of the Charter, does not continue to operate in a non-Charter context.
I conclude that the admission of the evidence here in question will not render the trial unfair. The video will be shown to the plaintiff and the jury. The jury will hear any explanation offered by the plaintiff concerning the contents of the video and will determine to what extent, if at all, the surveillance evidence assists them in assessing the complainant's credibility. The plaintiff has sued Dr. Weinstein and made a claim in her pleadings and in her evidence that her left hand has been disabled. The surveillance was undertaken in a public place and relates directly to the alleged disability. The introduction of such evidence has the potential to operate unfavourably to the plaintiff, but not to render the trial unfair.
36 I adopt the above reasons and approach, the key elements of which are:
- The remedy that the applicant seeks is not provided in the PIPED Act and the provisions of the Act have no direct bearing on the admissibility of evidence;
- Relevant evidence is prima facie admissible, subject to a discretion to exclude where the probative value is outweighed by its prejudicial effect;
- Although the Charter has no direct application, it informs the discretion to exclude evidence on the grounds that it would render the trial unfair.
37 It is not disputed that the reports at issue in this motion are relevant. I have found that Mr. Borowski was not reasonably entitled to privacy regarding the information used to prepare the reports. I find that the admission of the reports will not render the arbitration hearing unfair. Relevant evidence will always have the potential to influence an unfavourable result, but that does not render the hearing unfair. I see no merit in Mr. Borowski's submission that allowing insurers to tender reports based on paper reviews would give them a licence to bludgeon insured persons into submission with numerous reports, because of the disparity in resources. That submission is undercut by the fact that the assessment of expert evidence is not influenced by the number of experts offering the opinion and opinions based on paper reviews are often discounted because the person conducting a paper review did not interview and assess the subject in person. Mr. Borowski's position is also undercut by his own submission that the subject reports are of little probative value.
38 As the Court noted in Ferenczy, the above findings are sufficient to dispose of the issue of admissibility. However, the Court went on to find that there was no breach of the PIPED Act in these circumstances. The Court gave extensive reasons for that conclusion. The following excerpt is relevant to the circumstances of this case:
One way to avoid this result, and I conclude it is the correct interpretation of the Act, is to apply the principles of agency. On this analysis it is the defendant in the civil case who is the person collecting the information for his personal use to defend against the allegations brought by the plaintiff. Those whom he employs, or who are employed on his behalf, are merely his agents. On this analysis s. 4(2)(b) of the Act governs. That section reads as follows:
4(2) This Part does not apply to
. . .
(b) any individual in respect of personal information that the individual collects, uses or discloses for personal or domestic purposes and does not collect, use or disclose for any other purpose.
The defendant through his representatives was employing and paying an investigator, to collect information for him. It is the defendant's purpose and intended use of the information that one should have regard to in determining the applicability of the Act. On the basis of this analysis I conclude that the defendant is not collecting or recording personal information in the course of commercial activity. He, through his agents, was collecting information to defend himself against the lawsuit brought by the plaintiff. This is a personal purpose in the context of the civil action brought against him by the plaintiff. In my view, this conclusion is consistent with the overall purpose of the Act which is aimed primarily at information collected as a part of commerce. Section 3 of the Act reads as follows:
Purpose
3. The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
Closely related to this reasoning is my further conclusion, that in the circumstances here (where the recording was in a public place), the plaintiff has given implied consent to the defendant to collect, record and use her personal information insofar as it is related to defending himself against her lawsuit. A plaintiff must know that by commencing action against a defendant, rights and obligations will be accorded to the parties to both prosecute and defend. The complainant has effectively, by commencing this action and through her pleadings, put the degree of injury to her hand and its effect on her life into issue. One who takes such a step surely cannot be heard to say that they do not consent to the gathering of information as to the nature and extent of their injury or the veracity of their claim by the person they have chosen to sue. Consent is not a defined term under the Act, and there is no indication in the Act that consent cannot be implied.
39 I endorse and adopt the above approach. I find that Aviva retained Brigham & Associates as its agents, for the personal purpose of responding to Mr. Borowski's application, triggering the exemption in section 4(2)(b) of the Act. Neither Aviva nor its agent collected or distributed personal information that Mr. Borowski had not already disclosed. I find that, in commencing an application in which his medical condition was in issue, Mr. Borowski implicitly consented to the acquisition by Aviva of expert medical opinions, based on the personal information he was required to disclose.
40 I appreciate that the Court in Rousseau concluded that the doctor conducting the IME was engaged in "commercial activity", triggering the application of the Act, while the Court in Ferenczy found that the persons conducting the surveillance were not engaged in "commercial activity". I am bound by neither decision and I prefer the Ferenczy approach. As noted above, the issue in Rousseau was gaining access to personal information collected. That was not the issue in Ferenczy and it is not the issue here. Also as noted above, even had I found a breach of the Act, I would not exercise my discretion to exclude the reports.
41 The above reasons also dispose of Mr. Borowski's submission that the reports were obtained in breach of Aviva's Privacy Policy. The Privacy Policy largely adopts the provisions of the PIPED Act. The policy specifically contemplates disclosure of personal information to agents and adjusters. As noted above, based on the principles of agency, disclosure to an agent is not disclosure to a third party. The policy also specifically provides that consent to disclose is assumed for the purpose of evaluating claims. I find that the purpose of obtaining the subject reports was to assist in the evaluation of Mr. Borowski's claim and that Aviva did not agree, through its privacy policy, that it would not use personal information collected from Mr. Borowski for that purpose.
Probative Value vs. Prejudice
42 Mr. Borowski submits that the reports should be excluded because the authors usurp the role of the Arbitrator by offering their opinion on the proper application of the AMA Guides. Mr. Borowski also submits that the reports should be excluded because they are of little probative value since the opinions were formed without examining him and are based on an assessment of his credibility. He relies on the decision in Sharma and Allstate Insurance Company of Canada in which the Arbitrator refused to exercise his discretion to admit reports prepared by Brigham & Associates which Allstate had served late. In arriving at that decision, the Arbitrator commented unfavourably on the admissibility of opinions offered on how the AMA Guides should be applied. The Arbitrator concluded that the reports were "potentially inappropriate".
43 The issue in Sharma was whether extraordinary circumstances existed that would warrant the exercise of discretion to allow the filing of reports that were not properly served. Here, the reports have been served well in advance of the hearing. Although the opinions that Brigham & Associates offer on the interpretation of the AMA Guides are not properly the subject of expert evidence, the fact that those opinions are offered does not render the entire reports inadmissible. The expression of these opinions goes to the weight to be given to the medical opinions expressed, not their admissibility. The extent to which the medical conclusions are based on incorrect interpretation of the applicable law is a factor to be taken into account in assigning weight. An expert opinion would not be excluded merely because the expert expressed and applied a correct interpretation of the relevant legislation in arriving at an opinion within his or her expertise.
44 Similarly, the fact that Brigham & Associates did not assess Mr. Borowski in person and might have made assumptions about his credibility are questions of weight, not admissibility. The issue of weight cannot be determined in a vacuum. It must be assessed in light of all of the evidence. It is not possible to determine at this stage of the proceedings whether the assessors would have been in a better position to form an opinion, had they assessed Mr. Borowski in person. It is also not possible to determine whether any assumptions on credibility will accord with my conclusions at the end of the hearing.
Conclusion:
45 For all of the above reasons, I find that the reports Aviva obtained from Brigham & Associates are admissible at the Arbitration hearing.
Expenses:
46 I reserve my decision on the expenses of the motion until the Arbitration hearing has been completed. I remain seized of the issue, should the parties resolve all other issues without a hearing, but are unable to resolve the issue of expenses of this motion.
J. Rogers Member
It's a busy week for privacy cases in the English courts. The media has widely reported on the case of Max Mosley, the Grand Prix boss, who has successfully sued the News of the World. The publication placed a hidden camera in a private residence and filmed Mosley in an intimate encounter. The paper suggested that he participated in a sadomasochistic orgy that attempted to recreate a Nazi death camp atmosphere.
In seeking to protect his privacy, the whole event has been thrown into the public arena. And consistent with other privacy cases, the quantum of damages is surprisingly low given the impact that this has had on Mosley.
The decision can be found here.
From the New York Times:
British Judge Rules Tabloid Report Tying Grand Prix Boss to ‘Orgy’ Violated Privacy - NYTimes.comLONDON — In a ruling with potentially wide implications for press freedom in Britain, a judge ruled Thursday that a tabloid newspaper breached the privacy of Max Mosley, the overseer of grand prix motor racing, when it published an article in March claiming that he had participated in a sadomasochistic “orgy” with a Nazi theme.
The judge, Sir David Eady, awarded Mr. Mosley, 68, damages equivalent to about $120,000 and legal costs estimated to be at least $850,000 in his lawsuit against The News of the World.
The ruling upheld the central arguments by Mr. Mosley and his lawyers: that there had been no Nazi theme to the five-hour sex session in an apartment in the Chelsea district of London that was secretly filmed by the newspaper, and no issue of public interest in its decision to splash the article on its front page and post video on its Web site.
“I found that there was no evidence that the gathering of March 28, 2008, was intended to be an enactment of Nazi behavior or adoption of any of its attitudes,” the judge wrote.
He added that Mr. Mosley had a “reasonable expectation” of privacy for sexual activities that took place on private premises and that did not involve violations of the criminal law.
“There was no public interest or other justification for the clandestine recording, for the publication of the resulting information and still photographs, or for the placing of the video extracts on The News of the World Web site — all of this on a massive scale,” the judge said.
But he denied Mr. Mosley the “punitive damages” he had sought, which could have amounted to millions of dollars. The damage done to Mr. Mosley’s reputation by “the embarrassing personal information” disclosed by the newspaper “cannot be mitigated by simply adding a few noughts to the number first thought of,” the judge said.
Outside the court, Mr. Mosley said he was delighted with the ruling, which he described as “devastating” to The News of the World.
“It demonstrates that their Nazi lie was completely invented and had no justification,” he said. “It also shows that they had no right to go into private premises and take pictures and film of adults engaged in activities which are no one’s business but those of the people concerned.”
The ruling was one of several by Justice Eady and other judges in recent years in privacy cases against British newspapers under a provision of the European Convention on Human Rights. Some legal experts say the rulings have shifted the balance in Britain in favor of celebrity plaintiffs and against newspapers and other media organizations in invasion-of-privacy cases.
Justice Eady, in his finding, said his ruling should not be considered “a landmark case,” but rather “the application to rather unusual facts” in the Mosley case of privacy principles that had been developing in British court judgments in recent years. Still, the ruling caused a stir among lawyers fighting for press freedoms, some of whom said it was a bellwether for a new, more restrictive era of news media coverage of people in the public domain.
Other lawyers cautioned against alarmism, saying British courts would continue to weigh two competing provisions in the European rights convention — Article 8, establishing a right of privacy, and Article 10, protecting press freedoms — and that it was too early to know where the lasting balance would be struck.
“One lesson it teaches is that public figures can have a private life,” said Desmond Browne, a barrister who has represented some of the plaintiffs in headline-making privacy cases.
Editors of some of Britain’s more serious newspapers also were wary about drawing instant conclusions about where press law in Britain was headed.
Roger Alton, editor of The Independent, a newspaper known for the rigor of its investigative journalism, said he was not too troubled by the ruling.
“It’ll affect kiss-and-tell stories,” Mr. Alton told the British Broadcasting Corporation. “But it’s not a landmark. It’s not going to set things up in a completely different way.”
But Colin Myler, editor of The News of the World, said the judgment was based on precedents established by “judges in Strasbourg,” seat of the European Court of Human Rights, and that the issues involved had never been addressed by Britain’s Parliament. “As a result, our media are being strangled by stealth,” he said.
For Mr. Mosley, success in the case represented at least a partial vindication of what amounted to a gamble. Rather than resigning in shame, as have many well-known figures caught in sex scandals, Mr. Mosley chose another route. He admitted to a passion for sadomasochism, which he told the court had continued for 45 years, and discussed, from the witness box, details of what had occurred in the Chelsea apartment.
But the aspect of the article that he, and many of his detractors in the world of motor racing and beyond, considered the most damaging was the claim that the session involved a conscious effort to recreate the atmosphere of a Nazi death camp.
The potential damage to Mr. Mosley was linked, inevitably, to the fact that he is the son of Sir Oswald Mosley, leader of Britain’s National Union of Fascists in the 1930s, whose secret marriage to Mr. Mosley’s mother, Diana, took place at the home of the Nazi propaganda chief Joseph Goebbels in 1936, with Hitler as guest of honor.
In court, lawyers for The News of the World said they based their claim of a Nazi theme, in part, on the use of commands in guttural German or German-accented English by Mr. Mosley and the women involved. But Mr. Mosley and four of the five women involved maintained that what they intended in their role-playing was to recreate a generic prison scene, not a Nazi death camp.
A colleague just brought to my attention a case handed down yesterday by the High Court of Justice (Queen's Bench Division) of England & Wales: Applause Store Productions Ltd. & Anor v Raphael [2008] EWHC 1781 (QB) (24 July 2008).
The case relates to the misuse of private information and defamation. The defendant in this case had set up a false Facebook profile in the name of the plaintiff and established a Facebook group that was, shall we say, not flattering of the plaintiff. The court found in favour of the defendant on both claims.
What's additionally interesting is the detail with which the Court reviews the logging data generated by Facebook and provided to the Court. The case is an interesting read for privacy issues, but also is a good chance to look under the hood of Facebook, forensically speaking.
When the order was made that Google provide Viacom with its raw user logs (a move which significantly compromised user privacy), I wrote that the court could have ordered that the information be anonymised. (Canadian Privacy Law Blog: Commentary on the YouTube / Viacom order)
I don't think I can take any credit for this next move, but I'm sure the loud outcry has had an influence: Google and Viacom have agreed to anonymise the data using a one-way function so that the actual IP addresses cannot be reverse-engineered and Viacom has agreed to not even try. The stipulation filed with the court is here. Extract:
IT IS HEREBY STIPULATED AND AGREED, by and between the undersigned counsel of record:1. Substituted Values: When producing data from the Logging Database pursuant to the Order, Defendants shall substitute values while preserving uniqueness for entries in the following fields: User ID, IP Address and Visitor ID. The parties shall agree as promptly as feasible on a specific protocol to govern this substitution whereby each unique value contained in these fields shall be assigned a correlative unique substituted value, and preexisting interdependencies shall be retained in the version of the data produced. Defendants shall promptly (no later than 7 business days after execution of this Stipulation) provide a proposed protocol for this substitution. Defendants agree to reasonably consult with Plaintiffs’ consultant if necessary to reach agreement on the protocol.
2. Non-Circumvention: The parties agree that they shall not engage in any efforts to circumvent the encryption utilized pursuant to Paragraph 1 this Stipulation. This Paragraph does not limit in any way any party’s rights under Paragraph 8 below.
For background, see all posts tagged: Viacom v Google. Also, the Ontario Privacy Commissioner applauds this move: CNW Group | OFFICE OF THE INFORMATION AND PRIVACY COMMISSIONER/ONTARIO | Commissioner Cavoukian Applauds Agreement Protecting YouTube Users' Privacy
More commentary on the Viacom v. Google/YouTube case, this time from MIT's Technology review:
Technology Review: Privacy protections disappear with a judge's orderPrivacy protections disappear with a judge's order
By Associated Press
NEW YORK (AP) _ Credit card companies know what you've bought. Phone companies know whom you've called. Electronic toll services know where you've gone. Internet search companies know what you've sought.
It might be reassuring, then, that companies have largely pledged to safeguard these repositories of data about you.
But a recent federal court ruling ordering the disclosure of YouTube viewership records underscores the reality that even the most benevolent company can only do so much to guard your digital life: All their protections can vanish with one stroke of a judge's pen.
"Companies have a tremendous amount of very sensitive data on their customers, and while a company itself may treat that responsibly ... if the court orders it be turned over, there's not a lot that the company that holds the data can do," said Jennifer Urban, a law professor at the University of Southern California.
In the past, court orders and subpoenas have generally been targeted at records on specific individuals. With YouTube, it's far more sweeping, covering all users regardless of whether they have anything to do with the copyright infringement that Viacom Inc., in a $1 billion lawsuit, accuses Google Inc.'s popular video-sharing site of enabling.
It's a scenario privacy activists have long warned about.
"What we're seeing is (that) the theoretical is becoming real world," said Lauren Weinstein, a veteran computer scientist. "The more data you've got, the more data that's going to be there as an attractive kind of treasure chest (for) outside parties."
U.S. District Judge Louis L. Stanton dismissed privacy arguments as speculative.
Last week, Stanton authorized full access to the YouTube logs -- which few users even realize exist -- after Viacom and other copyright holders argued that they needed the data to prove that their copyright-protected videos for such programs as Comedy Central's "The Daily Show with Jon Stewart" are more heavily watched than amateur clips.
"This decision makes it absolutely clear that everywhere we go online, we leave tracks, and every piece of information we access online leaves some sort of record," Urban said. "As consumers, we should all be aware of the fact that this sensitive information is being collected about us."
Mark Rasch, a former Justice Department official who is now with FTI Consulting Inc., said the ruling could open the floodgates for additional disclosures.
Though lawyers have known to seek such data for years, Rasch said, judges initially hesitant about authorizing their release may look to Stanton's ruling for affirmation, even though U.S. District Court rulings do not officially set precedence.
The YouTube database includes information on when each video gets played. Attached to each entry is each viewer's unique login ID and the Internet Protocol, or IP, address for that viewer's computer -- identifiers that, while seemingly anonymous, can often be traced to specific individuals, or at least their employers or hometowns.
Elsewhere, search engines such as Google and Yahoo Inc. keep more than a year of records on your search requests, from which one can learn of your diseases, fetishes and innermost thoughts. E-mail services are another source of personal records, as are electronic health repositories and Web-based word processing, spreadsheets and calendars.
One can reassemble your whereabouts based on where you've used credit cards, made cell phone calls or paid tolls or subway fares electronically. One can track your spending habits through loyalty cards that many retail chains offer in exchange for discounts.
Though companies do have legitimate reasons for keeping data -- they can help improve services or protect parties in billing disputes, for instance -- there's disagreement on how long a company truly needs the information.
The shorter the retention, the less tempting it is for lawyers to turn to the keepers of data in lawsuits, privacy activists say.
With some exceptions in banking, health care and other regulated industries, requests are routinely granted.
Service providers regularly comply with subpoenas seeking the identities of users who write negatively about specific companies, at most warning them first so they can challenge the disclosure themselves. The music and movie industries also have been aggressive about tracking individual users suspected of illegally downloading their works.
Law enforcement authorities also turn to the records to help solve crimes.
The U.S. Justice Department had previously subpoenaed the major search engines for lists of search requests made by their users as part of a case involving online pornography. Yahoo, Microsoft Corp.'s MSN and Time Warner Inc.'s AOL all complied with parts of the legal demand, but Google fought it and ultimately got the requirement narrowed.
In the YouTube case, Viacom largely got the data it wanted.
Google has said it would work with Viacom on trying to ensure anonymity, and Viacom has pledged not to use the data to identify individual users to sue. The YouTube logs will also likely be subject to a confidentiality order.
But privacy advocates warn that there's no guarantee that future litigants will be as restrained or that data released to lawyers won't inadvertently become public -- through their inclusion as an attachment in a court filing, for instance.
And retailers, government agencies and others are regularly announcing that personal information, stored without adequate safeguards, is being stolen by hackers or lost with laptops or portable storage drives.
"You just never know," said Steve Jones, an Internet expert at the University of Illinois at Chicago. "There are some circumstances under which what seems to be private information is going to be shared with a third party, and the court says it's OK to do that."
Copyright Technology Review 2008.
It is not often that a columnist for a major national newpaper calls a federal court judge a moron, but that's just what Michael Arrington on the Washtington Post website calls Judge Stanton, referring to Viacom v. Google/YouTube. See: Judge Protects YouTube's Source Code, Throws Users To The Wolves - washingtonpost.com.
Hot off the presses: The Information and Privacy Commissioner of Ontario has written to Google calling for Google to appeal the recent Viacom v. Google disclosure order:
CNW Group OFFICE OF THE INFORMATION AND PRIVACY COMMISSIONER/ONTARIO Privacy Commissioner Ann Cavoukian urges Google to appeal YouTube rulingPrivacy Commissioner Ann Cavoukian urges Google to appeal YouTube ruling
TORONTO, July 10 /CNW/ - Ontario Information and Privacy Commissioner Ann Cavoukian is urging Google to appeal the recent ruling of U.S. District Court Judge Louis Stanton, requiring the disclosure of YouTube users' information to Viacom. YouTube, a popular website, is owned by Google.
In a letter to Sergey Brin, Google's President of Technology, the Commissioner emphasized her deep concerns about the privacy implications of the ruling, which she was asked to outline earlier this week on Canada AM.
Commissioner Cavoukian said "I was astounded to learn that Google had been ordered to disclose certain YouTube information, which includes users' login IDs and IP addresses, for use in Viacom's copyright infringement lawsuit against YouTube." The Commissioner felt that Judge Stanton had "failed to consider that user login IDs and video viewing habits can reveal a great deal of sensitive personal information."
In response to suggestions that the data be "anonymized" before its release to Viacom's legal counsel, the Commissioner noted that it is possible to re-identify individuals by linking their data with publicly available personal information, such as that found in telephone directories. "Simply stripping certain data fields from a database is not sufficient to safeguard the privacy of individuals" warned the Commissioner.
Despite the Judge's associated protection order which attempts to limit the authorized uses of YouTube users' information by Viacom, this does not eliminate the Commissioner's concerns. Companies simply cannot guarantee that information, once obtained, will not be subject to unauthorized use or disclosure. "Witness the example of identity theft" she noted. "The majority of instances of identity theft result from insider abuse."
"While I have sympathy for the rights of intellectual property holders, businesses should not rely on the surveillance of consumers to protect their copyright interests. It is not acceptable to allow copyright enforcement to come at the expense of users' privacy."
The full text of the letter to Google may be found on the Commissioner's website at www.ipc.on.ca in the What's New section.
Previously: Commentary on the YouTube / Viacom order, Judge orders that YouTube hand over viewer records.
