Ontario Privacy in Public Spaces Decision: The Need to Recognize Privacy as a Dignity Baseline, Not an Injury-Based Claim

An Ottawa woman has successfully argued for a privacy right in public spaces.  After video of her jogging along the parkway was included in a commercial, she sued for breach of privacy and appropriation of personality. 

"The filming of Mme. Vanderveen's likeness was a deliberate and significant invasion of her privacy given its use in a commercial video," the judge added. 

While pleased with the outcome, I’m a little uncomfortable with the presentation (and not sure whether that’s about the claimant or the media).  It appears that the privacy arguments here were grounded in “dignity”, and particularly in self-image.  That is, at the time the video was taken, the claimant was (or felt herself to be) overweight and had only recently taken up jogging after the birth of her children.  She testified that she thought the video made her look overweight and it caused her anxiety and discomfort. As her lawyer stated, “[s]he’s an incredibly fit person. And here’s this video — she looks fine in it — except that when she sees it, she doesn’t see herself. That’s the dignity aspect of privacy that’s protected in the law.”

In response, the company appears also to have focussed on self-esteem and injury.  “They made the argument that if they don’t use someone’s image in a way that is embarrassing or if they don’t portray someone in an unflattering light — here it is just her jogging and it’s not inherently objectionable — that they should be allowed to use the footage.  In contrast, the claimant argued that how someone sees themself is more important than how a third person sees them.”

Why does this bother me?  For the same reason that the damage threshold bothers me….because invasion of privacy is an injury in and of itself. 

By focussing on her self-image and dignity, we’re left to wonder whether, if another individual had been filmed without their consent, had tried to cover their face when they saw the camera (as did the claimant here) and yet was included in the video, would a court come to the same result?  Or is there some flavour of “intention infliction of emotional suffering” creeping into this decision?  When the judge states that “I find that a reasonable person, this legally fictitious person who plays an important role in legal determinations, would regard the privacy invasion as highly offensive and the plaintiff testified as to the distress, humiliation or anguish that it caused her” what “injuries” are implicitly being normalized?  The source of the injury seems to be that of being (or believing oneself to look) overweight – is (and should) size be conflated with humiliation?  The judge concludes that while “Mme Vanderveen is concerned about the persona that she presents and about her personal privacy I find that she is not unusually concerned or unduly sensitive about this” but I find myself wondering about the social context.  Would a man claiming the same distress/humiliation/anguish in this situation have been taken as seriously?   

The judge found that "[t]he photographer was not just filming a moving river, he or she was waiting for a runner to jog along the adjacent jogging trail to advertise the possibility of the particular activity in Westboro."  Because of the desire to capture someone running, part of the damages included an estimate of what it would have cost to hire an actor to run along the river.  This is where the privacy breach takes place – the deliberate capture of an individual’s image, and its use without their knowledge or consent for commercial purposes.

The issue isn’t how she felt about herself, nor whether she like(d) the way she looks in the video – it is the act of making and using the video of her in the first place.  When we focus on the injury to her dignity, we risk misdirecting the focus, making it about the individual rather than about the act of privacy invasion. 

Individuals shouldn’t have to display their wounds in order to be considered worthy of the protection of law.  Rather, law should be penalizing those who do not take care to protect and respect privacy.  That’s how we respect dignity – by recognizing it as an inherent right possessed by persons, with a concurrent right not to have that privacy invaded. 

The Right(s) to One’s Own Body

In July, police approached a computer engineering professor in Michigan to assist them with unlocking a murder victim’s phone by 3D-printing the victim’s fingerprints. 

It is a well-established principle of law that ‘there is no property in a corpse.’ This means that the law does not regard a corpse as property protected by rights.  So hey, why not, right? 

There is even an easy argument to be made that this is in the public interest.  Certainly, that seems to be how Professor Anil Jain (to whom the police made the request) feels: “If we can assist law enforcement that’s certainly a good service we can do,” he says.   

Marc Rotenberg, President of the Electronic Privacy Information Centre (EPIC) notes that if the phone belonged to a crime suspect, rather than a victim, police would be subject to a Supreme Court ruling requiring them to get a search warrant prior to unlocking the phone—with a 3D-printed finger or otherwise.

I’ve got issues with this outside the victim/suspect paradigm though. 

For instance, I find myself wondering about the application of this to live body parts. 

I’ve always been amused by the R v Bentham case, from the UK House of Lords in 2005. Bentham broke into a house to commit robbery and in course of this, used his fingers in his pocket to make a gun shape.  He was arrested.  Though he was originally convicted of possessing a firearm or imitation thereof, that conviction was overturned on the basis that it wasn’t possible for him to “possess” part of his own body.  But…if you can’t “possess” your own body, why wait for death before the State makes a 3-D copy of it for its own purposes?

And…we do have legislation about body parts, both live and dead – consider the regulation of organ donation and especially payment for organs.  Consider too the regulation of surrogacy, and of new reproductive technologies. 

Maybe this is a new area to ponder – it doesn’t fit neatly into existing jurisprudence and policy around the physical body.  The increasing use of biometric identifiers to protect personal information inevitably raises new issues that must be examined. 

UPDATE:  It turns out that the 3D printed fingerprint replica wasn’t accurate enough to unlock the phone.  Undeterred, law enforcement finally used a 2D replica on conductive paper, with the details enhanced/filled in manually.  This doesn’t really change the underlying concern, does it? 

When the “Child” in “Child Pornography” is the Child Pornographer

A US decision this month found that a 17-year-old who sent a picture of his own erect penis was guilty of the offence of second degree dealing in depictions of a minor engaged in sexually explicit conduct.

The person in question was already serving a Special Sex Offender Dispositional Alternative (SSODA) as the result of an earlier adjudication for communicating with a minor for immoral purposes when he began harassing one of his mother’s former employees, a 22-year-old single mother with an infant daughter.

That harassment began with telephone calls making sexual sounds or asking sexual questions. On the afternoon of June 2, 2013, she received two text messages: one with a picture of an erect penis, and the other with the message, "Do u like it babe? It's for you. And for Your daughter babe."

The appeal was focused on a couple of questions:

Was charging him with this offence a violation of his freedom of speech?

Key to the reasoning here is the recognition that minors have no superior right to distribute sexually explicit materials involving minors than adults do.  To interpret the statute differently, in the opinion of the court, would render the statute meaningless. 

The First Amendment does not consider child pornography a form of protected expression. There is no basis for creating a right for minors to express themselves in such a manner, and, therefore, no need to place a limiting construction on a statute that does not impinge on a constitutional right. Accordingly, we conclude that the dealing in depictions of minors statute does not violate the First Amendment when applied to minors producing or distributing sexually explicit photographs of themselves.

Was the offence too vaguely worded?   

The argument here is simple – would a reasonable person really think that sending a photo of his own genitals would constitute the crime of child pornography?  Again, the court deals with this handily, finding the statute wording to be clear.  Whether many teens engage in sexting is immaterial – the test isn’t whether many people aren’t following the law, but rather whether they are unable to understand it.  

Nothing in the text of the statute suggests that there are any exceptions to its anti-dissemination or anti-production language. The statute is aimed at eliminating the creation and distribution of images of children engaged in explicit sexual behavior. It could hardly be any plainer and does not remotely suggest there is an exception for self-produced images.

Finally, the ACLU made arguments on policy reasons.

Was it irrational or counterintuitive that the subject of the photo could also be guilty of its distribution?  The court thinks not – there is no requirement for a specific identified victim, because the focus is on the traffic in images. 

Another policy issue raised was the concern about the application of such a precedent to a case of teens “sexting” each other.  This could potentially have been a stronger policy position had this *been* a case of sexting – but it was not.  This wasn’t communication between equals – it was harassment. 

Is This a Problem?

Clearly, dick pics are ubiquitous these days.  Is this decision an overreaction?  No. It’s not.  Know what else is ubiquitous these days?  Harassment and hate directed at women in online spaces (and offline). 

Reasonable people have raised concerns about the inclusion of registering as a sex offender as part of the sentence. 

To be clear, the sentence was time served, and registration as a sex offender. 

• Registration of an individual who was already in treatment (thus far ineffective) for communicating with a minor for immoral purposes. 
• Who had unrelated pending charges (dismissed by agreement of the parties) for indecent exposure.  
• And for behaviour that was part of a campaign of sexual harassment. 

Frankly, that inclusion of registration as a sex offender is not unusual or uncalled for. 

I Was Just Venting: Liability for Comments on One's Facebook Page

We’ve all used social media to vent about *something* —a bad day, a jerk on the bus, an ex– whatever is enraging us at the moment.   It’s arguable whether we intend those posts to be taken seriously or whether they’re just hyperbole.  The nature of venting is, after all, about release.  It’s cathartic.

But….what if you could be held liable for your venting?

Worse yet, what if you were held liable for what your friends said or did in response?

Sound crazy?  Turns out it’s possible…

Pritchard v Van Nes -- picture it – British Columbia…..<dissolve scene>

Mr. Pritchard and his family moved in next door to Ms. Van Nes and her family in 2008.  The trouble started in 2011, when the Van Nes family installed a two-level, 25-foot long, and 2-waterfall “fish pond” along their rear property line.  The (constant) noise of the water disturbed and distressed the Pritchards, who started out (as one would) by speaking to Ms. Van Nes about their concerns.

Alas, rather than getting better, the situation kept getting worse

• the noise of the fish pond was sometimes drowned out by late-night parties thrown by the Van Nes family;

• when the Pritchard’s complained about the noise, the next party included a loud explosion that Ms. Van Nes claimed was dynamite;

• the lack of fence between the yards meant that the Van Nes children entered the Pritchard yard;

• the lack of fence also allowed the Van Nes’ dog to roam (and soil) the Pritchard yard, as evidenced by more than 20 complaints to the municipality; and

• parking (or allowing their guests to park) so as to block the Pritchard’s access to their own driveway.  When the Pritchards reported these obstructions to police, it only exacerbated tensions between the parties.

On June 9, 2014 tensions came to a head.  Ms. Van Nes published a Facebook post that included photographs of the Pritchard backyard:

Some of you who know me well know I’ve had a neighbour videotaping me and my family in the backyard over the summers.... Under the guise of keeping record of our dog...

Now that we have friends living with us with their 4 kids including young daughters we think it’s borderline obsessive and not normal adult behavior...

Not to mention a red flag because Doug works for the Abbotsford school district on top of it all!!!!

The mirrors are a minor thing... It was the videotaping as well as his request to the city of Abbotsford to force us to move our play centre out of the covenanted forest area and closer to his property line that really, really made me feel as though this man may have a more serious problem.

The post prompted 57 follow-ups – 48 of them from Facebook friends, and 9 by Ms. Van Nes herself. 

The narrative (and its attendant allegations) developed from hints to insinuations to flat out statements that Mr. Pritchard was variously a “pedophile”, “creeper”, “nutter”, “freak”, “scumbag”, “peeper” and/or “douchebag”.

Not content to keep this speculation on the Facebook page, a friend of Ms. Van Nes actually shared the post on his own Facebook page and encouraged others to do the same, and further suggested that Ms. Van Nes contact the principal of the school where Mr. Pritchard taught and “use his position as a teacher against him.  I would also send it to the newspaper.  Shame is a powerful tool.”

The following day, that same friend emailed the school principal, attaching the images from Ms. Van Nes’ page, some (one-sided) details of the situation and the warning that “I think you have a very small window of opportunity before someone begins to publicly declare that your school has a potential pedophile as a staff member. They are not going to care about his reasons – they care that kids may be in danger.”

That same day, another community member (Ms. Regnier  whose children had been taught by Mr. Pritchard and who believed him to be an excellent teacher and valuable resource for the school and community) became aware of Ms. Van Nes’ accusations and went to the school to inform Mr. Pritchard that accusations that he was a pedophile had surfaced on Facebook.  After talking with Mr. Pritchard, she accompanied him to the office to speak with the Principal (Mr. Horton), who had already received the email warning about Mr. Pritchard.  Mr. Horton contacted his superior, who, Mr. Horton testified, seemed shocked, asking Mr. Horton whether he believed the allegations; Mr. Horton said he did not, although he testified that he was concerned as the allegations reflected poorly on him and the school. He testified that if the allegations were substantiated, Mr. Pritchard would have had his teaching license revoked.

Tracking the allegations back to Ms. Van Nes’ Facebook page, Mr. Pritchard’s wife printed out the posts and Ms. Van Nes’ friends list.  They took this material with them to the police station to file a complaint.  Later that evening a police officer arrived at the Pritchard home to collect more details – when the Pritchards attempted to show him the content on Facebook they found that it was no longer accessible. 

Altogether, the post was visible on Ms. Van Nes’ Facebook page for approximately 27 ½ hours.  Its deletion, however, did not remove copies that had been placed on other Facebook pages or shared with others, nor could it prevent the spread of information. 

The effects have been many:

There was at least one child of one of Ms. Van Nes’ “friends” who commented on the posts, who was removed from his music programs. The next time he organized a band trip out of town and sought parent volunteers to be chaperones, he was overwhelmed with offers; that had never previously been the case. He feels that he has lost the trust of parents and students. He dreads public performances with the school music groups. Mr. Pritchard finds he is now constantly guarded in his interactions with students; for example, whereas before he would adjust a student’s fingers on an instrument, he now avoids any physical contact to shield himself from allegations of impropriety. He has cut back on his participation in extra-curricular activities. He has lost his love of teaching; he no longer finds it fun, and he wishes he had the means to get out of the profession. He considered responding to a private school’s advertisement for a summer employment position but did not because of a concern that the posts were still “out there”. Knowing that at least one prominent member of the community saw the posts and commented on them, he feels awkward, humiliated and stressed when out in public, wondering who might know about the Facebook posts and whether they believe the lies that were told about him.

Mr. Pritchard also testified as to how frightened he was that some of the posts suggested he should be confronted or threatened. Mr. Pritchard and his wife both testified that a short time after the posts, their doorbell was rung late at night, and their car was “keyed” in their driveway, an 80 cm scratch that cost approximately $2,000 to repair. His wife also testified to finding large rocks on their driveway and their front lawn.

They also both testified that their two sons, both of whom attended the school where their father teaches, are aware of the Facebook posts, and have appeared to be upset and worried as to the consequences.

Mr. Pritchard testified that he thinks it is unlikely that he could now get a job in another school district. He acknowledged that in fact he has no idea how far and wide the posts actually spread, but he spoke with conviction as to this belief, and I find the fact that he holds this belief to be an illustration of the terrible psychological impact this incident has had.

Who Is Liable and For What?

It’s a horrible tale, and nobody wins.  But what does the court have to say about it?

The claim for nuisance – that is, interference with Mr. Pritchard’s use and enjoyment of his land – is pretty clear.  Both the noise from the waterfall and the two years of the Van Nes’ dog defecating on their yard were clear interferences.  A permanent injunction that the waterfall not be operated between 10pm and 7am was issued.  The judge also awards $2000 for the waterfall noise, and a further $500 for the dog feces. 

The real issue here is, of course, the claim for defamation. 

Is Ms. Van Nes responsible for her own defamatory remarks?  Yes she is.  The remarks and their innuendo were defamatory, and were published to at least the persons who responded, likely to all 2059 of her friends, and (given Ms. Van Nes’ failure to use any privacy settings) viewable to any and all Facebook users.

Is Ms. Van Nes liable for the republication of her defamatory remarks by others? Republication, in this case, happened both on Facebook and via the letter to the school principal.  Yes she is, because she authorized those republications.  Looking at all the circumstances here, especially her frequent and ongoing engagement with the comment thread, the judge finds that Ms. Van Nes had constructive knowledge of Mr. Parks’ comments, soon after they were made.

Her silence, in the face of Mr. Parks’ statement, “why don’t we let the world know”, therefore effectively served as authorization for any and all republication by him, not limited to republication through Facebook. Any person in the position of Mr. Parks would have reasonably assumed such authorization to have been given. I find that the defendant’s failure to take positive steps to warn Mr. Parks not to take measures on his own, following his admonition to “let the world know”, leads to her being deemed to have been a publisher of Mr. Parks’ email to Mr. Pritchard’s principal, Mr. Horton.

Is Ms. Van Nes liable for defamatory third-party Facebook comments?  Again, the answer is yes.  The judge sets out the test for such liability as:  (1) actual knowledge of the defamatory material posted by the third party; (2) a deliberate act or deliberate inaction; and (3) power and control over the defamatory content.  If these three factors can be established, it can be said that the defendant has adopted the third party defamatory material as their own.

In the circumstances of the present case, the foregoing analysis leads to the conclusion that Ms. Van Nes was responsible for the defamatory comments of her “friends”. When the posts were printed off, on the afternoon of June 10th, her various replies were indicated as having been made 21 hours, 16 hours, 15 hours, 4 hours, and 3 hours previously. As I stated above, it is apparent, given the nine reply posts she made to her “friends”’ comments over that time period, that Ms. Van Nes had her Facebook page under, if not continuous, then at least constant viewing. I did not have evidence on the ability of a Facebook user to delete individual posts made on a user’s page; if the version of Facebook then in use did not provide users with that ability, then Ms. Van Nes had an obligation to delete her initial posts, and the comments, in their entirety, as soon as those “friends” began posting defamatory comments of their own. I find as a matter of fact that Ms. Van Nes acquired knowledge of the defamatory comments of her “friends”, if not as they were being made, then at least very shortly thereafter. She had control of her Facebook page. She failed to act by way of deleting those comments, or deleting the posts as a whole, within a reasonable time – a “reasonable time”, given the gravity of the defamatory remarks and the ease with which deletion could be accomplished, being immediately. She is liable to the plaintiff on that basis.

Having established all three potential forms of liability for defamation, Mr. Pritchard is awarded $50,000 in general damages and an additional $15,000 in punitive damages.

But I Was Just Venting…

A final thought from the judgement – one that takes into account the medium and the dynamic of Facebook. 

I would find that the nature of the medium, and the content of Ms. Van Nes’ initial posts, created a reasonable expectation of further defamatory statements being made. Even if it were the case that all she had meant to do was “vent”, I would find that she had a positive obligation to actively monitor and control posted comments. Her failure to do so allowed what may have only started off as thoughtless “venting” to snowball, and to become perceived as a call to action – offers of participation in confrontations and interventions, and recommendations of active steps being taken to shame the plaintiff publically – with devastating consequences. This fact pattern, in my view, is distinguishable from situations involving purely passive providers. The defendant ought to share in responsibility for the defamatory comments posted by third parties, from the time those comments were made, regardless of whether or when she actually became aware of them.

So go ahead. Vent all you want. But your responsibility may extend further than you think…proceed with caution.

Revenge Porn: In Ontario, You’ll Pay With More Than Karma

Doe 464533 v N.D. is a January 2016 decision from the Ontario Superior Court of Justice that makes a strong statement that those who engage in revenge porn will pay with more than just karma points!

The case involved an 18-year-old girl, away at university but still texting, phoning, emailing and otherwise connecting with her ex-boyfriend. Though the formal relationship had ended in spring, they continued to see each other “romantically” through the summer and into that autumn.  These exchanges included him sending multiple intimate photos and videos of himself, and requesting the same of her. 

After months of pressure, she made an intimate video, but was still uncomfortable sharing it.  She texted making clear her misgivings and he convinced her to relent, reassuring her that no one else would ever see the video. Eventually and despite her misgivings she sent the video to him.

Shortly thereafter, she learned that her ex had, on the same day he received it, posted the video to an online website.  He was also sharing it with some of their high school classmates.  She was devastated and humiliated by the discovery, leading to emotional and physical distress that required ongoing counselling, as well as suffering academically and socially. 

The video was online for approximately three weeks before his mother (hearing of the incident from the victim) forced him to remove it.  As the Judge points out, “[t]here is no way to know how many times it was viewed or downloaded during that time, or if and how many times it may have been copied onto other media storage devices…or recirculated.”

The damage is not, of course, limited to that three-week period – it is persistent and ongoing.  She continues to struggle with depression and anxiety.  She lives with the knowledge that former classmates and community members are aware of the video (and in some cases have viewed it), something that has caused harm to her reputation. In addition, she is concerned about the possibility that the video may someday resurface and have an adverse impact on her employment, her career, or her future relationships.

The police declined to become involved due to the age(s) of those involved, but she did bring a civil action against him. 

She was successful on her claim of breach of confidence.

She was successful on her claim of intentional infliction of mental distress.

But where it gets really interesting is in Justice Stinson’s assessment of the invasion of privacy claim.

Building upon the recognition of a tort of intrusion upon seclusion in Ontario, he returns to that analysis to locate the injury here as one not of intrusion but of public disclosure of embarrassing facts.  

Normally, the three factors necessary to show such a tort would be:

1. The disclosure must be a public one. 
2. The facts disclosed must be private; and
3. The matter made public must be one which would be offensive and objectionable to a reasonable man of ordinary circumstances.

It is incontrovertible that the video was publicly disclosed. The subject matter of the video – apparently her masturbating – is certainly private.  The first two elements are made out. 

Here is where the judge wins my heart – he refuses to layer sexual shame on an already victimized plaintiff.  Instead of focussing on the subject of the video (her masturbating), he modifies the final requirement so that the requirement is that either the matter publicized or the act of publication itself would be highly offensive to a reasonable person.

In this case, it is the behaviour of the ex that is offensive:

…the defendant posted on the Internet a privately-shared and highly personal intimate video recording of the plaintiff. I find that in doing so he made public an aspect of the plaintiff’s private life. I further find that a reasonable person would find such activity, involving unauthorized public disclosure of such a video, to be highly offensive. It is readily apparent that there was no legitimate public concern in him doing so.

Justice Stinson issues an injunction directing the ex to immediately destroy any and all intimate images or recordings of the plaintiff in whatever form they may exist that he has in his possession, power or control.  A further order permanently prohibits him from publishing, posting, sharing or otherwise disclosing in any fashion any intimate images or recordings of her.  Finally, he is permanently prohibited from communicating with her or members of her immediate family, directly or indirectly.

As for damages, the judge mentions that her claim is limited by procedure to $100,000.    He then considers the following:

• ·         The circumstances of the victim at the time of the events, including factors such as age and vulnerability. The plaintiff was 18 years old at the time of the incident, a young adult who was a university student. Judging by the impact of the defendant’s actions, she was a vulnerable individual;
• ·         The circumstances of the assaults including their number, frequency and how violent, invasive and degrading they were. The wrongful act consisted of uploading to a pornographic website a video recording that displayed intimate images of the plaintiff. The defendant’s actions were thus very invasive and degrading. The recording was available for viewing on the Internet for some three weeks. It is impossible to know how many times it was viewed, copied or downloaded, or how many copies still exist elsewhere, out of the defendant’s (and the plaintiff’s – and the Court’s) control. As well, the defendant showed the video to his friends, who were also acquaintances of the plaintiff. Although therewas no physical violence, in these circumstances, especially in light of the multiple times the video was viewed by others and, more importantly, the potential for the video still to be in circulation, it is appropriate to regard this as tantamount to multiple assaults on the plaintiff’s dignity;
• ·         The circumstances of the defendant, including age and whether he or she was in a position of trust. The defendant was also 18 years of age. He and the plaintiff had been in an intimate – and thus trusting – relationship over a lengthy period. It was on this basis, and on the basis of his assurances that he alone would view it, that he persuaded her to provide the video. His conduct was tantamount to a breach of trust; and
• ·         The consequences for the victim of the wrongful behaviour including ongoing psychological injuries. As described above, the consequences were emotionally and psychologically devastating for the plaintiff and are ongoing

He awards:

General damages:  $50,000

Aggravated damages (where injury was aggravated by the manner in which it was done):  $25,000

Punitive damages:  $25,000         

With pre-judgement interest and her costs for the action, the full award is $141,708.03

Is it enough to make up for the violation?  No, but I can’t imagine any amount would be.  I hope it’s enough to make the next malicious ex think twice before engaging in this type of behaviour.

On top of that, she gets validation.

She gets recognition that NOTHING she did was inappropriate or offensive.

The judge commends her for earning her undergraduate degree despite these events, as well as for her courage and resolve in pursuing the remedies to which she is entitled. Further, he lets her know that through that courage, she has set a precedent that will allow others who are similarly victimized to seek recourse.

Where and When is it Reasonable to Expect Your Messages to be Private (and what protection does it offer anyway)?

When you text message someone, do you have a reasonable expectation of privacy in that message?

R. v. Pelucco was a 2015 BC Court of Appeal decision involving a warrantless search of text messages found in a cell phone.  The question was whether the sender had a reasonable expectation of privacy in those messages.   The majority concluded that when legal and social norms were applied, a sender would ordinarily have a reasonable expectation that the messages would remain private. Justice Groberman writing for the majority, concluded that the lack of control once the message had been sent was a relevant factor in assessing objective reasonableness, but not determinative.

I’ve written about this decision previously here.

What about when you message someone privately using an online platform? 

In R v Craig, released 11 April 2016, police obtained private online messages between Mr. Craig, E.V.  and several of E.V’s friends from Nexopia, a Canada-based social network site targeted at teens. 

Mr. Craig (22) and E.V.(13) originally met via (private) messaging each other on Nexopia.  Messaging continued, as did offline meetings that ultimately resulted in him (illegally) providing her with alcohol and having sexual relations (to which she could not legally consent, being 13) with her.  When two girls from E.V.’s school overheard a conversation with E.V. regarding her sexual encounter with Mr. Craig, they reported it to a school counsellor. The counsellor subsequently called the police, and the police investigation commenced. He was charged and convicted of sexual touching of a person under the age of 16,  sexual assault, and internet luring (communicating with a person under the age of 16 years for the purpose of facilitating the commission of an offence under s. 151 with that person). 

When the police interviewed E.V., she provided Mr. Craig’s name and logged on to her Nexopia account to print out messages between them, including a photo of Mr. Craig.    A friend of E.V. also provided pages from her own account containing messages with Mr. Craig in which he admitted to having sex with E.V. 

Police obtained a search warrant for messages on the Nexopia servers under the usernames of E.V., several of her friends, and Mr. Craig.  A number of the documents seized from Nexopia were not disclosed to the defence pursuant to a Criminal Code presumptively forbidding production of complainant or witness records when the charge is sexual assault or sexual interference.  A “record” is one that contains “personal information for which there is a reasonable expectation of privacy.” 

Craig argued that there was no reasonable expectation of privacy in those messages -- that the messages were sent, received and stored on Nexopia’s servers, and thus had never been private.  Accordingly, the defence should be able to access them. 

The threshold for reasonable expectation was articulated as the expectations of the sender at the time the message was sent.  In this case, the messages were “personal communications between friends and confidantes, and were not intended for wider circulation beyond the small circle of friends.”  Accordingly, there was a reasonable expectation of privacy in the messages and they were protected from having to be disclosed to Mr. Craig.

Mr. Craig then sought to exert his own reasonable expectation of privacy over (some of) the Nexopia messages.  The trial judge disagreed, finding that Mr. Craig had no reasonable expectation of privacy in the messages, even those he had authored and sent himself because he had no control over them after sending. 

On appeal, the “control” test was rejected:

While recognizing that electronic surveillance is a particularly serious invasion of privacy, the reasoning is of assistance in this case. Millions, if not billions, of emails and “messages” are sent and received each day all over the world. Email has become the primary method of communication. When an email is sent, one knows it can be forwarded with ease, printed and circulated, or given to the authorities by the recipient. But it does not follow, in my view, that the sender is deprived of all reasonable expectation of privacy. I will discuss this further below. To find that is the case would permit the authorities to seize emails, without prior judicial authorization, from recipients to investigate crime or simply satisfy their curiosity. In my view, the analogy between seizing emails and surreptitious recordings is valid to this extent. [para 63]

Instead, the Court of Appeal found that Mr. Craig DID have an objectively reasonable expectation of privacy in the messages seized by the police, on the basis of both:

• An emerging Canadian norm of recognizing an expectation of privacy in information given to third parties;

• The nature of the information itself, since it exposed intimate details of his lifestyle, personal choices, and identifying information;

 (The appeal continued on to find that not only did Mr. Craig have an expectation of privacy in the messages, but that his s. 8 Charter rights against unreasonable search and seizure had been violated.   HOWEVER, the violation was not egregious or intention, it had no or negligible impact on Mr. Craig’s interests, and accordingly admission of the messages into evidence would not bring the administration of justice into disrepute.  In fact, they noted, the case dealt with serious charges involving offences against a young teenager, and this too weighed in favour of admitting the evidence.  The appeal was dismissed, with the Court of Appeal finding that there had been no substantial wrong or miscarriage of justice at trial). 

So there you have it:

Yes, you may well have a reasonable expectation of privacy in messages you’ve sent to others, either via text or online platforms. 

Remember though, that doesn’t mean they stay private – it only means that they (and by extension you and your informational dignity and autonomy) must be treated in accordance with Charter protections

a dismayed yelp -- shouldn't we have some rights to our own reputation?

A case against Yelp got dismissed this week.  It’s an interesting one too – businesses who claim that Yelp manipulates ratings against businesses who do not purchase advertising on Yelp. 

Yelp bills itself as an “online urban guide” – a crowdsourced local business review site.  Consumers rate their experience(s) with a business, and  the accumulated ratings and experiences are available to anyone (though you’ll need an account to actually submit a review).    The company themselves isn’t particularly local though – with over 130 million unique visitors per day in over 20 languages, Yelp’s Alexa rank for May 2014 was a more than respectable 28.  This is a company that may speak local but has definite range and scope for the exercise of power.

Yelp has long been dogged by allegations that they manipulate the rankings of businesses – either that they will remove negative reviews for businesses who purchase advertising or alternatively that a refusal to buy advertising could result in the disappearance of positive reviews.  Finally, a group of small businesses filed suit against Yelp claiming that it was extorting small businesses into buying advertising. 

Extortion, they say.  When I think of extortion I think of blackmail.  Organized crime.  That sort of thing.  A battle between a crowd-recommendation site and a variety of entrepreneurs seems a little…bloodless.  (maybe my parents *did* let me read inappropriate materials – turns out the woman from the town library who called my mom to report me was right after all!)

Anyone reading the headlines after the case was dismissed might be excused for thinking that Yelp had been vindicated.

Yelp Extortion Case Dismissed by Federal Court

Court Sides With Yelp

Appeals Court Rules for Yelp in Suit Alleging the Online Review Site Manipulated Reviews

Well, the court didn’t exonerate Yelp.   There was no finding here that the manipulation didn’t or couldn’t happen.  Nope, the lawsuit was dismissed because….drum roll please….businesses don’t have a right to positive reviews online. 

The business owners may deem the posting or order of user reviews as a threat of economic harm, but it is not unlawful for Yelp to post and sequence the reviews," Judge Marsha Berzon wrote for the three-judge panel. "As Yelp has the right to charge for legitimate advertising services, the threat of economic harm that Yelp leveraged is, at most, hard bargaining.

Does it matter?  Isn’t this just a battle between businesses?  Well….no.  Not necessarily.  In a world of crowdsourcing and reputation, granting a business carte blanche to manipulate reviews is a scary prospect.  An even scarier one is the idea that you might not have rights over your reviews/reputation.

(fear not RTBF-foes -- i'm not suggesting we should have the right to change, erase or otherwise manipulate such reviews....i'm just suggesting maybe nobody else should be able to do so either, especially with a view to harming me reputationally)

R v Spencer: a new era of privacy jurisprudence for Canada

The newspapers are trumpeting the Supreme Court of Canada decision in R v Spencer, as well they should.  It was a good, thoughtful decision, one that conveys a strong understanding of privacy. 

The case, on appeal from Saskatchewan, dealt with a situation where police requested (and received) subscriber information from an ISP based on an IP address.  The information was revealed by the ISP in response to a request with no warrant.  The SCC was asked to determine whether this was an unreasonable search and seizure in contravention of s.8 of the Charter and they determined that it was.  

Until this decision, (some) Canadian ISP’s were of the opinion that exceptions for information revealed to certain bodies for law enforcement, security or related purposes as set out in s. 7 of PIPEDA authorized the provision of personal information without the necessity of a warrant.  Today’s decision puts an end to that practice. 

In examining the subject matter of the search, the court rejected a limited approach that saw the information as merely the name and address of an ISP subscriber, holding that to do so was to miss the fact that the information at issue was the subscriber information as linked to particular Internet activity as well as the inferences that might be drawn from that profile (para 32, emphasis mine). 

The court also employed a new and nuanced tripartite understanding of information privacy, looking at privacy variously as secrecy; as control over information; and as anonymity.  (para 38)

It is this final category of privacy as anonymity where the decision perhaps makes its greatest contribution.  In relation to user online activity, the Court focused extensively on the idea of privacy as anonymity, writing at para 46 that:

Moreover, the Internet has exponentially increased both the quality and quantity of information that is stored about Internet users. Browsing logs, for example, may provide detailed information about users’ interests. Search engines may gather records of users’ search terms. Advertisers may track their users across networks of websites, gathering an overview of their interests and concerns. “Cookies” may be used to track consumer habits and may provide information about the options selected within a website, which web pages were visited before and after the visit to the host website and any other personal information provided...[t]he user cannot fully control or even necessarily be aware of who may observe a pattern of online activity, but by remaining anonymous — by guarding the link between the information and the identity of the person to whom it relates — the user can in large measure be assured that the activity remains private…

Ultimately, the Court concluded that there was (or could be) a reasonable expectation of privacy as to the anonymity of their online activities.  Given this reasonable expectation of privacy, the police obtaining the subscriber information from the ISP without a warrant was a violation of s.8 of the Charter and thus an unconstitutional search.

This finding is an important one and not just for the privacy of individual internet users.  Indeed, in light of current concerns about security and cyberbullying, as currently expressed in C-13 in S-4.  C-13, the newest iteration of the government’s lawful access legislation combined with cyberbullying provisions, contains provisions for voluntary warrantless disclosure.  The Court’s strong recognition of a constitutional reasonable expectation of privacy in such information is in direct opposition to the presumptions underlying such provisions.  S-4, which would update PIPEDA, has been criticized as expanding the expanding scope of voluntary disclosure, an approach which must also be reconsidered in light of today’s decision.

Government has long sought to justify lawful access-type legislation as creating the new powers necessary in order to address new technologies.  In its decision, the Court addresses concerns expressed by law enforcement that requiring a warrant could impede or even facilitate the investigation of online crime, countering at para 49 that:

In light of the grave nature of the criminal wrongs that can be committed online, this concern cannot be taken lightly. However, in my view, recognizing that there may be a privacy interest in anonymity depending on the circumstances falls short of recognizing any “right” to anonymity and does not threaten the effectiveness of law enforcement in relation to offences committed on the Internet. In this case, for example, it seems clear that the police had ample information to obtain a production order requiring Shaw to release the subscriber information corresponding to the IP address they had obtained.

This case dealt with child pornography – that the SCC are clear that a warrant was necessary in this case indicates that the privacy interest is an important one, not to be overridden easily.  This too should be read as a warning to the Government that expansion of intrusive powers into personal privacy must be grounded in demonstrable issues rather than mere unsupported assertions of necessity.

Charter Challenge to PIPEDA

The Canadian Civil Liberties Association, along with Chris Parsons of the Citizen Lab, have filed a challenge to some provisions of PIPEDA, specifically the parts of the Act that allow private corporations to disclose user personal information without a warrant to a government institution, for a number of reasons, including national security and the enforcement of any law of Canada, a province or a foreign jurisdiction. 

The fact that the information is being obtained from the private sector further complicates things.  As CCLA's General Counsel stated:  "Non-state actors are playing an increasingly large role in providing law enforcement and government agencies with information they request.  The current scheme is completely lacking in transparency and is inadequate in terms of accountability mechanisms."     

CCLA's legal challenge asks that provisions of PIPEDA be struck as an unconstitutional violation of the right to life, liberty and security of the person (s.7) and the right to be free from unreasonable search and seizure (s.8) under the Charter. 

Writing the Right Law, Not Just a Law

In the wake of Rehteah Parsons death on 7 April 2013, Nova Scotia became the first Canadian jurisdiction to pass cyberbullying legislation, with the Cyber Safety Act becoming law on 10 May 2013.  At the time of its introduction multiple concerns were raised about the breadth of the Act, and the vagueness of its definitions, as well as the constitutionality of its approach.  This week the first formal complaint under the Act was made, by Nova Scotia legislator and actress Lenore Zann, after a teen posted a nude still from an acting performance to Twitter. 

The quick turnaround of Nova Scotia’s Act was a result of the widespread alarm and concern that erupted when the general public were made aware of the alleged rape, harassment and eventual suicide of Rehteah Parsons.  It is always tempting in the wake of a shocking event to react quickly to prevent future recurrences.  Unfortunately, the notion that the best response is to quickly draft a law to deal with the issue and move on is incorrect.  

To put it bluntly, it’s important to write the right law, not just a law.   

A missed opportunity

For an example of how this approach can go terribly wrong, consider the Video Privacy Protection Act in the United States.  It was drafted and passed by the US Congress in 1988, after a media outlet acquired and published Robert Bork’s videotape rental history during his nomination to the US Supreme Court. The Act protects the privacy of information about rentals of “pre-recorded video cassette tapes or similar audio visual material.” 

The Act is an excellent example of the failure of law to deal effectively with technology.  In the wake of a perceived violation of privacy legislation was drafted and passed to deal with that particular technology and prevent that particular kind of violation from recurring. So although the Electronic Privacy Information Centre describes the Act as “one of the strongest protections of consumer privacy against a specific form of data collection,” because of its specific link to a particular (and increasingly out-dated) medium it also constitutes a lost opportunity to apply similar, meaningful privacy protections against data collection more broadly in the US. 

What is Cyberbullying?

The recent wave of “cyberbullying” legislation poses the same risk—leaving the issue inadequately addressed with an ill-conceived legislative response to a poorly understood issue. These concerns were raised at the time the Bill was introduced, now that a complaint has come forward, it’s a good opportunity to re-examine the issue.

Conventionally, bullying is defined as having three components: 

• Aggressive behavior that involves unwanted, negative actions.
• A pattern of behavior repeated over time
• An imbalance of power or strength.

Dan Olweus, psychologist and noted author on the topic says, “A person is bullied when he or she is exposed, repeatedly and over time, to negative actions on the part of one or more other persons, and he or she has difficulty defending himself or herself."

Experts disagree over whether these same characteristics are present in cyberbullying.  Certainly traditional bullying requires a physical contact, or sharing physical space, while cyberbullying does not.  Because there is no requirement for co-location, cyberbullying may arise in multiple online spaces.  This—combined with the persistence of information in online spaces—means that cyberbullying can be seen or participated in by many more people, in many more places.  Online spaces can also facilitate anonymity or pseudonymity among those engaged in the bullying, which further increases the power differential and vulnerability experienced by someone being bullied.

After a Nova Scotia teen tweeted a topless photo (a still shot found online, from an episode of “The L Word” in which Ms. Zann was an actor) with the question “What happened to the old Lenore?”, the legislator contacted his parents, his school principal, and local school board as well as the police and CyberSCAM units, alleging that his actions constituted cyberbullying. 

The new Nova Scotia law defines cyberbullying as follows:

"cyberbullying" means any electronic communication through the use of technology including, without limiting the generality of the foregoing, computers, other electronic devices, social networks, text messaging, instant messaging, websites and electronic mail, typically repeated or with continuing effect, that is intended or ought reasonably be expected to cause fear, intimidation, humiliation, distress or other damage or harm to another person's health, emotional well-being, self-esteem or reputation, and includes assisting or encouraging such communication in any way;

Discussing her complaint, Ms. Zann pointed to a three-hour discussion that took place on Twitter between herself, the youth himself and others, claiming that "It's not necessarily the image itself, but the fact that someone is tweeting that at me and saying, 'Hey Lenore Zann, where's the old Lenore now,' and calling it porn and things like that. I found that really humiliating and harassing."  Interestingly, it is also worth noting that under the Act’s expansive definition, the tone and content of Ms. Zann’s responses during that encounter could arguably open her to similar allegations of cyberbullying.

Meaningful protections

Ms. Zann’s invoking of humiliation classifies this incident as cyberbullying in the broad terms of the Cyber Safety Act, but it raises serious questions as well. Is this the sort of situation cyberbullying legislation was created to address?  Should politicians be able to use cyberbullying legislation to stifle questions and criticisms?  Are they the vulnerable persons such legislation was meant to protect?

These are emerging quandaries of digital life that have yet to be put to the test. As we grapple with new cultural and legal issues presented by interactions in online spaces—striving to balance protection of the vulnerable with freedom of expression, balance privacy with safety—complexities and long-term repercussions must be considered.

It isn’t enough to just do something, it’s important to do the right thing.

the violation IS the harm!

A class action suit filed against Google, Vibrant Media and the Media Innovation Group over tracking cookies and targeted ads was dismissed in a Delaware court in October 2013.  While accepting and agreeing that the companies in question had collected user personal information by circumventing browser settings and then sold that information to ad companies, the Judge felt that the plaintiffs had not shown that they had suffered harm due to these practices, and thus the action could not be sustained.

This is not, by any stretch of the imagination, the first time that the harm requirement has prevented individuals from holding to account those who invade their privacy.  Claims for harm, so-called speculative harm and for emotional distress as a result of the injury have all been attempted and dismissed.

In Canada, there is no requirement that injury be established in order to bring forward a claim.  Nevertheless, the question of harm necessarily arises at the damages stage.  In the germinal case of Jones v Tsige this issue is discussed, with the Judge recognizing the where no pecuniary loss has been suffered, there are still nominal or moral damages available, intended as at least a symbolic recognition that a wrong has been suffered.  After surveying common law and statutory prescriptions for such situations, the court finally arrives [at paras 87 and 88] at the following formula for dealing with intrusions on seclusion:

In my view, damages for intrusion upon seclusion in cases where the plaintiff has suffered no pecuniary loss should be modest but sufficient to mark the wrong that has been done. I would fix the range at up to $20,000. The factors identified in the Manitoba Privacy Act, which, for convenience, I summarize again here, have also emerged from the decided cases and provide a useful guide to assist in determining where in the range the case falls: 

1.   the nature, incidence and occasion of the defendant’s wrongful act;

2.   the effect of the wrong on the plaintiff’s health, welfare, social, business or financial position;

3.   any relationship, whether domestic or otherwise, between the parties;

4.   any distress, annoyance or embarrassment suffered by the plaintiff arising from the wrong; and

5.   the conduct of the parties, both before and after the wrong, including any apology or offer of amends made by the defendant.

I would neither exclude nor encourage awards of aggravated and punitive damages. I would not exclude such awards as there are bound to be exceptional cases calling for exceptional remedies. However, I would not encourage such awards as, in my view, predictability and consistency are paramount values in an area where symbolic or moral damages are awarded and absent truly exceptional circumstances, plaintiffs should be held to the range I have identified.

California has taken a different approach to the issue.  On 26 September 2013, California Secretary of State Debra Bowen moved forward on a ballot initiative that would amend the California Constitution to recognize a right of privacy in personal information and an attendant presumption of harm when that right is breached.  If the proposal garners 807,615 qualifying signatures by Feb. 24, 2014, the proposition will be included on the November 2014 ballot. 

Regardless of HOW the issue is addressed, it is clear that something must be done.  Both personal privacy and a right of remedy to the courts for redress of violations of that privacy are inherently compromised if they are only actionable when demonstrable pecuniary harm has been suffered.