A number says a thousand words: Data Privacy Day 2012

Ontario’s Information and Privacy Commissioner, Dr. Ann Cavoukian, recently issued a press release  warning consumers that new technology has the potential to build individually-detailed profiles based on IP addresses, social insurance numbers and even license plates. Her comments highlight a growing trend that the anonymity of personal information is becoming increasingly scarce, especially for online consumers.

The Commissioner’s comments are timely considering that Data Privacy Day  is January 28, 2012, a day when awareness of online privacy and data protection is brought to the forefront. Recognized in Canada, the United States and most of Europe, Data Privacy Day is organized by the National Cyber Security Alliance, who seeks to educate the general public about data privacy and to encourage dialogue about data protection among consumers, businesses and governments.

Banking your secrets just got safer - invasion of privacy tort recognized

On January 18, for the first time, the Ontario Court of Appeal in Jones v. Tsige explicitly recognized the tort of invasion of personal privacy. In July 2009, Sandra Jones discovered that her co-worker, Winnie Tsige, had been surreptitiously viewing her bank records for four years. Although Jones did not know or directly work with Tsige, Tsige and Jones’ ex-husband were in a common-law relationship. As an employee of the Bank of Montreal (where Jones maintained her primary bank account), Tsige had full access to Jones’ banking information. Contrary to the bank’s policy, Tsige accessed Jones’ banking records at least 174 times. Sharpe J.A. allowed the appeal, ruled that Tsige committed the tort of “intrusion upon seclusion” and granted Jones $10,000 in damages.

Continue Reading...

Wikipedia, Google and many others protest proposed U.S. Stop Online Piracy Act

The proposed Stop Online Piracy Act (SOPA) and the PROTECT IP Act (PIPA) discussed in a prior blog post is garnering some very negative reactions from internet and technology companies, culminating in a day of protest by many websites to draw attention to the bills, which are making their way through the U.S. House of Representatives and Senate. Today, Wikipedia has blocked all of its English-language pages and Google has blacked out its U.S. home page logo (see sopastrike.com for a full list of the SOPA protest participants). Late last year, a group of nine technology companies (AOL, Ebay, Facebook, Google, Linkedin, Mozilla, Twitter, Yahoo and Zynga) took out a full-page ad in the New York Times voicing their concern that “the bills as drafted would expose law-abiding U.S. Internet and technology companies to new and uncertain liabilities, private rights of action, and technology mandates that would require monitoring of websites.” Both bills have been the subject of controversy because of the severe measures that can be invoked relatively quickly and easily to block access to, or financially cripple, allegedly infringing websites.

2011 in Review - Top 10 Technology & IP Law Developments

The arrival of 2012 marked the end of a year filled with numerous developments in technology and IP law. Taking a cue from the Canadian Communications Law blog, we’ve decided that this would be an excellent time to reflect on the past year and review some of its more notable developments. To that end, we’ve put together a list of the top 10 technology and IP law developments from the past year.

Without further ado, here are our picks for the top 10:

  1. Court of Appeal recognizes reasonable expectation of privacy in contents of work computer - In R. v. Cole, a teacher discovered with nude images of a student on his work laptop was found by the Ontario Court of Appeal to have a reasonable expectation of privacy with respect to his personal files on that laptop.
     
  2. No liability for defamation for basic hyperlinks, says Supreme Court - In a decision that came as a relief to bloggers, tweeters, webpage owners and other providers and hosts of internet content, the Supreme Court of Canada clarified in Crookes v. Newton that merely providing hyperlinks to defamatory content will not lead to liability for defamation.
Continue Reading...

Panning for gold in the mud: the availability of privacy damages under PIPEDA

More than 10 years after the introduction of federal private sector privacy legislation in Canada, damage awards for breaches of the law have been few and far between -- and where such awards have been made, the dollar amounts awarded have been modest.

In light of the sometimes confusing, and even contradictory judgments to date, there is also considerable uncertainty as to when such damages might be awarded, and what evidentiary test a complainant might have to meet.

In Panning for gold in the mud: the availability of privacy damages under PIPEDA, in the December 2011 edition of the Canadian Privacy Law Review, David Elder of our Privacy and Data Protection Group, attempts to knit together the existing case law into a coherent analytic framework for the availability of privacy damages in Canada.

Article reproduced with permission of the publisher from Canadian Privacy Law Review, Vol. 9, No. 1, December 2011.

Leon's to ho ho hold onto customer information: SCC dismisses Privacy Commissioner's appeal

Late last week, the Supreme Court of Canada (SCC) passed on a chance to shed some light on what it considers to be “reasonable” collection of personal information.  It dismissed the Alberta Information and Privacy Commission’s appeal of an Alberta Court of Appeal decision that found “reasonable” collection of personal information to not necessary mean an organization must employ the “best” or the “least intrusive” methods.

As we noted in an earlier post, the Alberta Court of Appeal overturned the Commissioner’s ruling and stated that Leon’s Furniture Limited was justified in collecting driver’s licence and licence plate information from customers picking up furniture. Leon’s argued that the observance of such policy was for fraud prevention and deterrence purposes only and that it assisted police in any ensuing fraud investigations. The Commissioner claimed that Leon’s policy was a violation of Alberta’s Personal Information Protection Act (PIPA or Act), as collection of the disputed information was not “reasonable” under section 11 of the Act and it constituted a “condition of supplying a product or service” under section 7(2) of the Act. Both claims were rejected.

Continue Reading...

Privacy lessons learned: do your homework about home work

David Elder -

A recently publicized privacy breach by a Canada Revenue Agency (CRA) employee underlines the need for all organizations to impose strict controls and safeguards respecting the ability of employees to remove sensitive data from the workplace.

In a widely reported story, it was recently discovered, through a request under the Access to Information Act, that confidential material respecting Canadian taxpayers, contained in hundreds of documents and tens of thousands of email messages sent and received by a CRA employee, were downloaded in unencrypted form to CDs taken home and retained by a CRA auditor, at least some of which were subsequently copied to a third party’s laptop.   While the CDs have been recovered, the laptop – thought to contain the tax files of at least 2,700 Canadians – is still missing. 

Continue Reading...

US considers tough legislation to cripple foreign sites that infringe US IP

Stuart McCormack and Lindsay Gwyer -

Recently, a controversial new bill was introduced in the United States House of Representatives. The new bill, entitled the Stop Online Piracy Act, aims to undercut the business model of websites who sell or distribute pirated American products or works by imposing obligations on third parties who deal with the sites. Its purpose is to indirectly target foreign websites that may be outside the direct reach of American law. 

One of the main components of the Stop Online Piracy Act is section 103, which provides IP owners with a tool to enforce their rights against sites “dedicated to theft of U.S. property.” Under this section, an IP rights-holder can notify a payment network provider (defined as an entity that directly or indirectly provides the proprietary services, infrastructure, and software to effect or facilitate a debit, credit, or other payment transaction) or company that provides internet advertising services of IP infringement by a particular site. Providing that the notification meets the requirements set out in the section, the recipient must respond with “technically feasible and reasonable measures” within 5 days to essentially cutting off the infringing site from its services. For payment network providers this would generally entail preventing the completion of transactions involving American customers and the infringing website, and for advertisers it would mean ceasing to advertise the website or provide advertisements to the website.

Continue Reading...

Lady Gaga and fansite caught in a bad romance

Stuart McCormack and Lindsay Gwyer -

A string of number one hits and worldwide notoriety weren’t enough to bring Lady Gaga success in a domain name dispute over the use of her stage name. Earlier this fall Lady Gaga, whose real name is Stefani Germanotta, failed to convince an arbitration panel that the domain name ladygaga.org was being used illegitimately by one of the singer’s fan sites.

Domain names are allocated through accredited registries that use a central registry system overseen by the Internet Corporation for Assigned Names and Numbers (ICANN). Disputes over domain names are resolved in accordance with ICANN’s Uniform Domain Name Dispute Resolution Policy (the Policy). In order for a domain name to be cancelled or ordered to be transferred under the Policy a complainant must show that: the domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights; the respondent has no rights or legitimate interests in respect of the domain name; and the domain name has been registered and is being used in bad faith.

Continue Reading...

SEC releases guidance for the disclosure of cybersecurity incidents

In the wake of a number of high-profile cybersecurity incidents, the SEC’s Division of Corporation Finance recently released disclosure guidance on the topic of cybersecurity. While the guidance creates no new legal obligations, it is intended to provide clarity regarding the forms of disclosure that registrants may have to make. In the release, the Division of Corporation Finance recognized that while no current disclosure requirements explicitly refer to cybersecurity, there are a number of existing disclosure obligations that may require registrants to disclose cybersecurity risks or incidents.

Continue Reading...

No liability for defamation for basic hyperlinks, says Supreme Court

David Elder and Lindsay Gwyer -

Bloggers, tweeters, webpage owners and other providers and hosts of internet content can breathe a little easier today following a decision of the Supreme Court of Canada that ruled that merely providing hyperlinks to defamatory content cannot make them liable for defamation.

That said, while the decision provides clear support from the highest court in the land for both free expression and the preservation of the nature and benefits of the internet as whole, it stops short of giving hyperlinkers a “Get Out of Jail Free” card for all uses and presentations of links to defamatory material. 

Continue Reading...

Fourth time lucky? Government introduces copyright reform bill -- again.

Alexandra Stockwell and Robert Mysicka -

The Canadian Government is giving copyright reform another try, reintroducing what is essentially the same copyright bill that died last spring with the dissolution of Parliament. 

But while the text may be the same, one thing has clearly changed: this time, the ruling Conservatives have a legislative majority, significantly increasing the likelihood that the new bill will actually become law, either in its current form or with amendments introduced at Committee.

Continue Reading...
Tags:

Where does copyright law end and broadcasting regulation begin? Supreme Court to hear appeal on "Value for Signal"

David Elder and Lindsay Gwyer -

The long road for local broadcasters wanting to charge fees to cable and satellite companies for rebroadcasting their signals just got a little longer, as the Supreme Court of Canada has granted leave to hear an appeal a Federal Court of Appeal decision that upheld the ability of the Canadian Radio-television and Telecommunications Commission (CRTC) to establish such a regime.

The “Value for Signal” (VFS) regime was authorized by the CRTC in its 2010 group licensing framework decision, and was intended “to remove unnecessary barriers to the continued viability of private broadcasters and to ensure that broadcasters are able to obtain, through market-based negotiations, fair value of the programming they broadcast.”

Continue Reading...
Tags:

That's a wrap: BC Supreme Court enforces website terms of use and validates "browse wrap" agreements in Century 21 v Zoocasa

Amy Hu and Michael D. Smith -

In Century 21 Canada Limited Partnership v Rogers Communications Inc., the BC Supreme Court upheld the validity of the so-called “browse wrap” agreements and awarded damages against Zoocasa and its parent Rogers for Zoocasa’s breach of the Century 21 website terms of use when it pulled listings from the Century 21 website for use on its own real estate listing search engine. The BC court confirmed that industry standard browse wrap agreements (i.e. a website’s posted terms of service) can form valid contracts without being brought to the attention of users or requiring any review/acknowledgement by the user before accessing the website.

Continue Reading...

Nothing up in the air about privacy: foreign airline must comply with Canadian law

David Elder -

When in Rome, do as the Romans do.  Similarly, when doing business in Canada, do as Canadian privacy law requires.

That is the lesson learned by a foreign-based airline following a finding by the Office of the Privacy Commissioner (OPC) of Canada that the carrier had violated Canadian privacy law, even though the company operates in compliance with European privacy requirements.  The decision further confirms the fact that foreign businesses that operate or provide services in Canada will be subject to all requirements of Canadian privacy law, regardless of the scope of the privacy regimes in their home countries.

Continue Reading...