Website that generates revenue by republishing Canadian court decisions and allowing them to be indexed by search engines contravened PIPEDA

PIPEDA Report of Findings #2015-002

June 5, 2015

---

---

Complaints under the Personal Information Protection and Electronic Documents Act (the “Act” or “PIPEDA”)

Summary of Investigation

1. Globe24h.com is a website operated by an individual in Romania. In this report, we will generally refer to this individual as “Globe24h” or the “respondent”. Globe24h copies court judgments and tribunal decisions from other websites, including ones in Canada, and republishes them on its own site. Its stated purpose is to “make law accessible for free on the Internet.” The site is free to use, and contains non-personalized advertising.
2. Globe24h began republishing Canadian court judgments and tribunal decisions in 2013. In its representations to our Office, Globe24h identified a total of 245 judicial and administrative tribunals for which it republishes decisions. These decisions were collected either from: (i) the judicial and administrative tribunals’ websites, (ii) the website of the Canadian Legal Information Institute (“CanLII”), or (iii) the website of the Société Québécoise D'Information Juridique (“SOQUIJ”). According to Globe24h, the collection of decisions was carried out through a mix of automated and manual means.
3. Globe24h states that it intended to collect and republish all decisions available from these sources; however, in some instances, the source put technical measures in place to prevent further collection by Globe24h before the objective could be completed. As a result, Globe24h stated that it has not updated its collection of Canadian case law since the summer of 2013.
4. All court and tribunal decisions republished by Globe24h are indexed by search engines. As such, these decisions appear in the search results returned for searches on the names of individuals identified in these decisions. With limited exceptions, this is not the case for decisions published on court and tribunal websites, which are generally not indexed by search engines.
5. Globe24h does not create any additional personal information about individuals. Instead, it collects, uses and discloses existing information contained in already published court and tribunal decisions. However, Globe24h does significantly increase the exposure of personal information by allowing the decisions and their content to be indexed and located via search engines using individuals’ names.
   
   Removal of Information from Globe24h
6. The respondent claims that individuals are able to have personal information removed from the decisions republished by Globe24h. The details of the removal process have changed at various times during our Office’s investigation, but in general the means of removal fall into three categories.
7. First, at the time of the first complaint filed to our Office, individuals were provided the option of an “express” removal of their personal information within 72 hours (at other points in our investigation, this time frame was 48 or 96 hours) by paying a €19 processing fee, per document. At the time of the first complaint to our Office, the following text appeared on Globe24h:

   We can guarantee a 72 hours express processing time that includes data removal from Google index. This means your data will be deleted from both our servers and Google index in 72 hours. We charge a 19 EUR fee for this service. In this case, you should send the formal request only after the payment. Please understand that our understaffed team couldn't handle all requests if we didn't charge a fee for faster editing. [Original emphasis]

8. Globe24h stated that many individuals requested fast removal without providing information about themselves, placing a heavy burden on the organization. A €19 fee, Globe24h claimed, ensured that these ‘fast’ removals were limited, so that individuals who made proper written requests could have those requests processed for no charge within a set time frame.
9. Globe24h also stated that it experienced individuals making fraudulent removal requests, or improperly seeking to suppress legal information. According to the site’s operator, charging a fee for anonymous, email requests would limit such requests.
10. As of July 3, 2014, following our Office’s intervention, Globe24h took down this paid removal option, stating that it would accept only free removal requests. However, subsequent to this, one complainant stated that Globe24h instructed her by email:

    If you insist that your document must be removed in full from our server and from Google, we charge a 200 EURO fee. This is a nominal administrative fee. After your payment is confirmed the entire document file will be fully erased in 24 hours from our server and from Google. [Emphasis added]

11. This individual paid the €200 fee, and the particular decision in question was removed. However, she contacted our Office after being told that the same fee would apply for the removal of other court findings on the same matter that were republished on Globe24h.
12. When challenged on this, Globe24h indicated that the full removal of documents is not a service that it provides, but a decision that is made in a very limited number of cases. Globe24h stated:

    Despite our refusal [to remove full documents, instead of removing personal information], some of those petitioners repeatedly insist they want the full removal and volunteer to pay. … [Globe24h] may accept some of the offers after examining each petitioner's arguments and circumstances.

13. Second, individuals are provided the option of contacting Globe24h to have decisions about them edited (to have their personal information redacted from the decision), for no charge.
14. At the time of the first complaint to our Office, Globe24h asked that requests for such changes (providing the “exact issue description and a link to the document”) be emailed to them, at which point the individual’s personal information would be edited within 180 days. In particular, the following text appeared on Globe24h’s website:

    Globe24h hosts public information published officially by Canadian state institutions. We are not responsible for any errors or data that may infringe your privacy rights.
    
    If you need us to make corrections to a document, please send us a formal requestto globe@globe24h.com. Your request will be solved for free, but it may take up to 180 days (standard processing time) due to scarce resources. After that, it may take Google more than 1 year to remove data from the search index.
    
    You should provide an exact issue description and a link to the document. We will edit your personal data as you request, but we will not take down the entire document under any circumstance.[Original emphasis]

15. During the course of our investigation, the free removal process has undergone a number of changes. In response to our initial request for information and in subsequent interactions with Globe24h, it stated that it had reduced the free-of-charge editing time from 180 days to within 15 days of receiving a letter including the following:
    1. The full name for which the individual is requesting information be removed (and, if making a request on behalf of another person, legal authority to act on behalf of that person).
    2. The individual’s complete address and phone number, in order to send security codes to the individual.
    3. The individual’s email address.
    4. The individual’s signature.
    5. A notarized copy of a government-issued photo identification document of the individual.
    6. A printed copy of the document in question, with information to be removed highlighted, as well as the URL of the document.
16. To explain the information requested during the removal process, the Globe24h FAQ states:

    We often receive fraudulent removal requests from people impersonating others or improperly seeking to suppress legal information. To prevent this kind of abuse, we need to verify your identity.

17. Globe24h stated to our Office that the information submitted for a removal request is used only for the purposes of authenticating the removal request.
18. As of the time of this Report, Globe24h now makes available a personal data removal request form, which individuals are asked to complete and either mail, or scan and email, to the organization.^{Footnote 1} This form requests the same data points as indicated above at paragraph 10, with the notable exception of phone number. The form does not request a government-issued photo identification document, but does require a document that verifies the requestor’s name (with all other information obscured). The form does not specify what types of documents will be accepted in this regard. Requests are still claimed to be processed within 15 days of receipt.
19. The current request form also states:

    I [the requestor] understand that my full document will not be removed from Globe24h or from Google/Bing/Yahoo search results / cache. Globe24h will remove only my personal data. My document will remain public and will continue to be listed in Google/Bing/Yahoo search results.

20. Globe24h has asserted that this removal process is compliant with Article 14 of Romanian Law 677/2001^{Footnote 2}, Romania’s data protection law. This Article reads:

    Article 14: The Right of Intervention Upon Data

    1. Every data subject has the right to obtain from the data controller, upon request, and free of any charge:
       1. as the case may be, rectification, updating, blocking or deletion of data whose processing does not comply with the provisions of the present law, notably of incomplete or inaccurate data;
       2. as the case may be, transforming into anonymous data the data whose processing does not comply with the provisions of the present law;
          ...
    2. In order to exert the right stated in paragraph (1), the data subject shall fill in a written, dated and signed petition. The petitioner may state his/her wish to be informed at a specific address, which may also be an electronic mail address, or through a mail service that ensures confidential receipt of the information.
    3. The data controller has the obligation to communicate the measures taken, based on the provisions of paragraph (1), as well as, as the case may be, the name of a third party to whom the data concerning the data subject were disclosed, within 15 days from the date of the petition’s receiving, whilst complying with the petitioner’s possible option, according to paragraph (2).

21. In its representations, Globe24h indicated that as of May 31, 2014, it had received approximately 100 free removal requests from Canadians; it had fulfilled approximately 30 of those requests. Of the remaining 70 requests, Globe24h states that in approximately 60 instances insufficient information (about the file or the individual in question) was provided to effect the request, and in the other approximately 10 instances fraud was suspected.
22. Globe24h stated to our Office that it has never failed to honour a free removal request which contained all of the required information.
23. With respect to the third type of removal process, according to Globe24h’s terms of service, if an individual can establish that a decision republished by Globe24h has been removed from its original source, Globe24h claims it will destroy the copy it republishes.
24. Globe24h indicated that few of the complainants to our Office had made a request to have their information removed from the site. Of these, most complainants had asked to have their names removed by way of free removal requests by email, which were denied. Other complainants paid for the removal of their personal information from Globe24h’s website, but contacted our Office when they became aware that Globe24h was also republishing other court judgments related to them.
25. In 23 instances (all but the final four complaints received by our Office), when contacted by our Office, Globe24h removed the names of complainants from the decisions about which we had received complaints. As such, the personal information of these complainants contained in the decisions republished by Globe24h can no longer be located by searching the complainants’ names on a search engine. In the remaining four instances, Globe24h insisted that the complainants use the data removal request form provided by the site.

• Information from complainants

26. In general, the complainants were upset that decisions containing their personal information were being republished by Globe24h and made accessible via search engines. In the complainants’ view, the information was highly sensitive and should not be made broadly available through search engines and on the Globe24h website.
27. In approximately one-third of the complaints, the decision in question related to a family law matter such as a divorce or custody hearing. Others related to bankruptcy proceedings, human rights complaints, labour relations matters, and immigration hearings. That is, the majority of the complaints related to court and tribunal decisions containing highly detailed, highly sensitive personal information that could have negative reputational impacts (including financial information, health information, and information about children) and the fact that these decisions were being prominently featured in search results when searching for the complainants’ names – even where searchers were not seeking this information.
28. For instance, one complaint was made on behalf of the complainant’s daughter who was named and described as a sex worker in a case in which she had acted as a witness. At the time of the complaint, the court decision (and the accompanying description) as republished on Globe24h was the first search result returned when querying on her daughter’s name.
29. In another case, a complainant was concerned that search results for the name of her son included information about an acrimonious custody hearing. Another man filed a complaint because he operated a business under his own name and was concerned that searches for that business also turned up financial and medical information about him that arose during a legal dispute. Yet another individual was concerned that the publication of a court finding would render the pardon he had received completely ineffective.
30. Complainants frequently expressed that it was traumatic, embarrassing or otherwise harmful knowing that deeply intimate information was being made available to friends, acquaintances, current or future employers, and anyone else who may have occasion to perform an online search for the person’s name.
31. Some complainants described feelings of depression, anger or distress that accompanied the discovery of the wide availability of these decisions, and indicated that the availability of the decisions via search engines meant that they would not be able to fully move beyond highly stressful events in their lives, which in certain cases occurred 10 to 15 years prior.
32. It should be noted that a number of complainants explicitly recognized the importance of the open court system, which meant that the decisions in question would be made available through online repositories. However, they did not feel that allowing broad availability of decisions containing their personal information through search engine results was necessary to ensure the transparency of the legal system – particularly given the associated emotional and reputational harms caused.
33. Lastly, complainants were not satisfied with removal options provided by Globe24h. Some complainants expressed to our Office that they felt that the existence of a paid removal option amounted to “extortion” and implied that free removal requests would not be respected. Others stated that they were uncomfortable providing additional personal information to Globe24h to remove existing information, believing that this increased their vulnerability (as the provided information could be used against them). Finally, yet others expressed significant skepticism that even payment of the fee for removal would result in a complete resolution of their issue.

• Information from respondent

34. In its response, Globe24h acknowledged that it does not have the consent of individuals to collect and post their personal information as contained in court and tribunal decisions. However, it states that for at least two reasons, it does not require consent.

• Publicly available information

35. First, Globe24h stated that consent was not required because the data was obtained from “publicly available sources.”
36. In particular, Globe24h cited Article 5(2) of Romania’s Data Protection Law. This provision states, “The data subject’s consent is not required when the processing concerns data which is obtained from publicly accessible documents, according to the law.”

• Journalistic purpose

37. Globe24h also stated, in its response, that its “declared objective for collecting and processing data is solely journalistic,” making it exempt from the Act’s consent requirements.
38. In particular, Globe24h cited Article 11 of Romania’s Data Protection Law, which states that “[The consent provisions] do not apply to the situation in which the data processing is carried out exclusively for journalistic … purposes….”
39. Globe24h also cited s. 4(2)(c) of PIPEDA, which states that the Act does not apply to “any organization in respect of personal information that the organization collects, uses or discloses for journalistic … purposes and does not collect, use or disclose for any other purpose.”
40. Globe24h further stated that the Court of Justice of the European Union (“CJEU”) has found that activities such as Globe24h’s can be classified as journalistic. Globe24h specifically cited a case^{Footnote 3} in which the notion of ‘journalistic activities’ (referred to in Article 9 of EU Directive 95/46/EC) was defined as encompassing “all activities whose object is the disclosure to the public of information, opinions or ideas, irrespective of who is carrying on such activities … the medium which is used to transmit the processed data … and of the nature (profit making or not) of those activities.”

• Other representations

41. Lastly, Globe24h expressed concern that it is being made a scapegoat for a larger problem. In particular, it argues that it is but one of multiple sources of Canadian court findings and tribunal decisions online; it does not create new information, but instead increases the distribution of existing information.
42. In particular, Globe24h argued that, in its opinion, creating a new repository of court findings, and allowing those findings to be indexed by search engines, does not have a true impact on the privacy of Canadians.
43. Globe24h expressed its belief that, should privacy in court and tribunal decisions be desired, those records should be anonymized before being published (as opposed to limiting distribution and/or indexing by search engines). It noted that case law published through Romania’s court’s portal, is entirely anonymized. In its representations, Globe24h raised the question, “If courts do not want everyone to see [their decisions], why do they publish them online in the first place?”

• Other information
  
  Model Policy for Access to Court Records

44. In September 2005, the Canadian Judicial Council (the “CJC”)’s Judges Technology Advisory Committee posted its Model Policy for Access to Court Records in Canada^{Footnote 4} (the “Model Policy”). This document was the result of a public consultation concerning electronic access to court records, and its impacts on the open court principle, individual privacy and security rights, or other important interests such as the proper administration of justice.
45. The foundation of the Model Policy is based on the following principles:
    1. the open courts principle is a fundamental constitutional principle and should be enabled through the use of new information technologies;
    2. restrictions on access to court records can only be justified where:
       1. such restrictions are needed to address serious risks to individual privacy and security rights, or other important interests such as the proper administration of justice;
       2. such restrictions are carefully tailored so that the impact on the open courts principle is as minimal as possible; and
       3. the benefits of the restrictions outweigh their negative effects on the open courts principle, taking into account the availability of this information through other means, the desirability of facilitating access for purposes strongly connected to the open courts principle, and the need to avoid facilitating access for purposes that are not connected to the open courts principle.
46. With regard to judgments, section 4.6.1 of the Model Policy states that “Members of the public shall have on-site access and, where available, remote access to all judgments.” The discussion associated with this section emphasizes that courts’ access policies “should provide for broad public access to every judgment rendered by the court, subject to any applicable statutory or court-ordered publication ban.”
47. That said, the discussion associated with section 4.6.1 of the Model Policy goes on to state:

    However, if the judgements are posted on the Internet, it is a good practice to prevent indexing and cache storage from web robots or “spiders.” Such indexation and cache storage of court information makes this information available even when the purpose of the search is not to find court records, as any judgment could be found unintentionally using popular search engines like Google or Yahoo. Moreover, when the judgement is cache stored by the search engine, it is available to Internet users even if the court decides to withdraw the judgment from public access.

48. This recommendation regarding indexing is followed by most courts and administrative tribunals in Canada, as well as CanLII and SOQUIJ. CanLII’s Terms of Use expressly prohibit the external indexing of published documents by search engines, unless prior express consent is obtained from the CanLII editor or such indexing is authorized by the instructions in the robots exclusion file or in the HTML code of a published decision.
49. None of the decisions at issue in the complaints are indexed by search engines on the court websites on which they are originally published. However, because Globe24h republished them and allowed them to be indexed by search engines the complainants’ personal information contained in the decisions could be located through search engines.

• OPC Guidance - Electronic Disclosure of Personal Information in the Decisions of Administrative Tribunals

50. Our Office has issued guidance to administrative tribunals over which we have jurisdiction under the Privacy Act with respect to the publication of decisions online, entitled “Electronic Disclosure of Personal Information in the Decisions of Administrative Tribunals” (“OPC Guidance”).^{Footnote 5} The OPC Guidance notes that administrative tribunal decisions can contain sensitive personal information such as information about medical issues, mental health and financial information, and that publication of decisions online, without proper safeguards, can expose individuals to greater risk of identity theft, data mining and discriminatory practices, among other things, and result in personal information being taken out of context and used for inappropriate purposes. As such, our Office, consistent with the CJC Model Policy, recommends that administrative tribunals use robot exclusion protocols and eliminate the possibility of decisions being located through public search queries for an individual’s name.

• Canadian Association of Journalists – Definition of Journalism

51. In June 2012, the Ethics Advisory Committee of the Canadian Association of Journalists published a report titled, “What is Journalism?”^{Footnote 6} This report looked to respond to questions around the “increasingly elusive definition of journalism.”
52. The report proposes that journalists, and hence journalism, can be recognized and distinguished “not by what they believe or think, but by their actions.” [Original emphasis] To that end, the report describes three functional criteria by which ‘journalism’ can be recognized:
    1. Purpose: An act of journalism sets out to combine evidence-based research and verification with the creative act of storytelling. Its central purpose is to inform communities about topics or issues that they value.
    2. Creation: All journalistic work – whether words, photography or graphics – contains an element of original production.
    3. Methods: Journalistic work provides clear evidence of a self-conscious discipline calculated to provide an accurate and fair description of facts, opinion and debate at play within a situation.
53. The report further proposes that, for most purposes, the above criteria be considered a “three-way veto” – that is, the failure to meet any of the criteria implies a failure to meet the definition of journalism.

Application

54. In analyzing the facts, we applied ss. 2(1), 4(1)(a), 4(2)(c), 5(3), 7(1)(d), 7(2)(c.1) and 7(3)(h.1) of PIPEDA, and subsection 1(d) of the Regulations Specifying Publicly Available Information associated with PIPEDA.

55. Paragraph 4(1)(a) states that Part I of the Act applies to every organization in respect of personal information that the organization collects, uses or discloses in the course of commercial activities. “Organization” is defined broadly in section 2(1) of the Act and includes “a person”.

56. Paragraph 4(2)(c) states that Part I of the Act does not apply to any organization in respect of personal information that the organization collects, uses or discloses for journalistic, artistic or literary purposes and does not collect, use or disclose for any other purpose.

57. Subsection 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

58. Paragraphs 7(1)(d), 7(2)(c.1) and 7(3)(h.1) state that an organization may collect, use or disclose (respectively) personal information without the knowledge or consent of the individual if the information is publicly available and specified by the regulations.

59. Paragraph 1(d) of the Regulations Specifying Publicly Available Information states that one of the classes of publicly available information is personal information that appears in a record or document of a judicial or quasi-judicial body, that is available to the public, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the record or document.

Findings

• Jurisdiction

60. In our view, Globe24h is an organization that collects, uses and discloses personal information in the course of commercial activities within the meaning of the Act. First, the respondent is a “person” and therefore falls within the definition of “organization” contained in s. 2(1) of the Act. Second, the Canadian court and tribunal decisions that Globe24h collects, uses and discloses via its website contain the personal information of the complainants as well as others. Third, Globe24h’s activities are commercial in nature. Globe24h charged and apparently still charges individuals to have their personal information removed from its website. Moreover, the website contains advertising and actively solicits advertising.^{Footnote 7} In particular, the website states “We are open to advertising buyers from all over the world. If you think that our traffic profile is a good fit for your needs, we can arrange for your custom ads to be published on Globe24h swiftly.” Globe24h charges “a standard 5 EURO fee for one thousand impressions.”

61. Our Office also examined whether PIPEDA applies to Globe24h as a foreign-based organization. PIPEDA can apply to such organizations where there is a “real and substantial connection” between the parties and/or the facts giving rise to the complaint and Canada.^{Footnote 8}

62. In this instance, there are several indicia of a real and substantial link to Canada. We note that Globe24h has intentionally targeted Canadian court and tribunal decisions (and therefore Canadians’ personal information) for collection and republication on Globe24h’s website. Globe24h’s website specifically advertises that it provides access to “Canadian Caselaw.” Furthermore, Globe24h acknowledged that its source for Canadian decisions is exclusively Canadian websites. Finally, Globe24h accepts requests from Canadians to redact their personal information contained in the decisions it republishes, as detailed above, and has accepted payments from Canadians to have decisions removed or redacted. In the circumstances, our Office is of the opinion that these facts constitute sufficient active involvement and participation by Globe24h for the organization to have a real and substantial connection to Canada.
63. Therefore, for the purposes of this investigation, we apply PIPEDA, the source of this Office’s jurisdiction, not the Romanian law cited by Globe24h.

• Journalistic purpose

64. The Act does not apply to information collected, used or disclosed by an organization for journalistic purposes, and for no other purpose. Globe24h has stated that its operations should be considered exclusively journalistic in nature.
65. Our Office does not accept this position. As described later in this Report, we are of the view that Globe24h’s true purpose for republishing Canadian court and tribunal decisions on its website – and making the personal information contained therein available via search engines – is to generate revenue from, among other means, requests by individuals to have their personal information removed. This is not a journalistic purpose. While commercial gain is certainly not incompatible with journalism, here the underlying purpose is not journalism, but rather incentivizing individuals to pay to have their information removed.
66. In any event, Globe24h fails to meet at least the first (purpose) and second (creation) criteria by which ‘journalism’ can be recognized, according to the definition of ‘journalism’ developed by the Canadian Association of Journalists. Globe24h is republishing information already available online through Canadian court and tribunal websites in a manner that enables the information to be located by search engines, which would not otherwise be possible, so as to profit from individuals' desire to have this practice stop. In the view of our Office, this cannot be considered a journalistic purpose in the circumstances.
67. As such, our Office finds that Globe24h is not collecting, using and disclosing personal information for exclusively journalistic purposes, and thus s. 4(2)(c) of the Act does not apply.

• Appropriate purpose

68. Globe24h’s stated purpose is “to make law accessible for free on the Internet”. There are, however, a number of factors that point to Globe24h having a different purpose, which we do not find to be appropriate from the perspective of a reasonable person within the meaning of s. 5(3) of the Act.
69. As noted above, the information which Globe24h is republishing is already available for free on the Internet. Court and tribunal websites in Canada as well as CanLII and SOQUIJ already publish court and tribunal decisions and are freely accessible to anyone in the world. What Globe24h does differently is to permit the decisions it republishes to be indexed by search engines.
70. The evidence before us suggests that this was not done to enhance accessibility of the decisions and to Canadian law generally, but rather to incentivize individuals, who do not want to have their personal information contained in court and tribunal decisions available via search engines, to pay Globe24h to have their personal information removed. In other words, our Office’s investigation found that that the primary purpose of Globe24h was to use personal information contained in court and tribunal decisions for the purpose of generating revenue through its paid removal service.
71. At the time of the first complaints to our Office, Globe24h was charging €19 to remove personal information from its decisions on an expedited basis. The language described in paragraphs 14 and 7 of this report – describing, respectively, the ‘corrections’ process, which could take up to 180 days, and the ‘express processing’ service, which would process ‘corrections’ in 72 hours and cost €19 – was featured prominently in the sidebar of the webpage for each hosted court decision.
72. Later, this was replaced with a link in the header of each page, titled “Remove my information”, which led to an explanation of the paid removal process. We also note that removal information is contained in a ‘frequently asked questions’ (“FAQ”) document, which is linkable from the header of each webpage. Currently, this FAQ contains 10 questions, 9 of which relate to the removal of personal information from the site.
73. In the opinion of our Office, the prominence of these options indicates that Globe24h recognizes that many individuals will not want court and tribunal decisions containing their personal information to be republished on its website and made accessible to search engines, and will seek out and avail themselves of measures, including payment, to remove said information.
74. Furthermore, the evidence suggests that Globe24h strategically structured its removal processes, and carefully phrased its messaging related to these processes, so as to actively encourage individuals to use the paid removal service. Initially, Globe24h claimed that the free removal process could take up to 180 days and that “it may take Google more than 1 year to remove data from the search index.” In comparison, the paid process could be accomplished in 72 hours and included deletion from the Google index in the same time frame.
75. Subsequently, Globe24h shortened the time frame for responding to free removal requests from 180 days to 15 days, but required individuals to first send a written, dated and signed petition by mail (email was not permitted) to Romania, along with their personal information, including their current mailing address, email address, and documents verifying their identity. In contrast, the paid removal process could be actioned within a matter of days (the time varied between 48 and 96 hours during our investigation) simply by sending an “anonymous” email and paying the required fee.
76. Globe24h stated that the €19 charge was put in place in order to allow the organization to honour rapid, e-mail-based removal requests without negatively impacting the speed at which it could honour free removal requests received by physical mail, as well as to prevent ‘fraudulent’ removal requests.
77. We note that Globe24h cited ‘authentication’ and fraud as the reasons why additional, often sensitive personal information was requested for the free removal process. However, if authentication concerns were truly the motive, the question is raised of why the paid removal process did not require such information. To the contrary, it is our view that by making the free process overly burdensome and onerous, and requiring the submission of additional personal information, Globe24h was effectively driving requestors to the paid process by creating significant barriers to “free removal.”
78. Further, Globe24h provided no evidence that supported its assertion that it had received fraudulent requests nor that charging a fee prevented such requests from being received.
79. As for Globe24h’s submissions that the fee allowed it to process free removal requests faster than it otherwise would have been able to, it presented no evidence to support this assertion. In any event, this ignores the fact that there would have been no need to process removal requests – either free or paid - if Globe24h had not first republished the decisions and allowed them to be indexed by search engines. In effect, Globe24h had created the very conditions which incentivized individuals to opt for a faster service in exchange for payment.
80. We note that Globe24h has removed the paid removal option from its website. However, as described in paragraph 12, Globe24h appears to have initiated a practice of offering, on a case by case basis, the removal of an entire decision from its servers for a fee of €200 per document.
81. This new practice only came to light when we were informed by a complainant and after Globe24h affirmed to us that it was no longer charging individuals for the removal of their personal information. In the circumstances, we are not convinced that Globe24h has been candid and forthright with us about its practices or its true intentions during our investigation. In our view, the evidence establishes that Globe24h’s true purpose is not to make Canadian law more accessible but rather to generate revenue by exposing the personal information of Canadians via search engines and creating strong incentives for individuals who wish to limit the emotional and reputational damage stemming from Globe24h’s practice to pay to have their information removed.
82. In our view, a reasonable person would not consider this purpose appropriate in the circumstances within the meaning of subsection 5(3).
83. Alternatively, even if it could be said that Globe24h’s purpose is solely to increase the exposure of Canadian court and tribunal decisions on the Internet by allowing the decisions it republished to be indexed by search engines, we are of the view that this too is an inappropriate purpose in the circumstances.
84. In making our determination, our Office looked to the purposes for which Canadian courts publish information, and publish it online, as described in the Model Policy and the OPC Guidance described in paragraphs 43-50 of this report.
85. It is evident from the Model Policy that the CJC accepts, in spite of the importance of individuals’ electronic access to judgments, that a restriction against web indexing is necessary to address a serious risk to individual privacy, and that the benefits of such a restriction outweigh the negative impacts on the open courts principle. The Model Policy also establishes that the “unintentional” finding of court decisions in the course of a web search unrelated to those decisions would not be in furtherance of the open courts principle, and is thus to be avoided.
86. Furthermore, given the fact that Canadian courts, as well as CanLII and SOQUIJ, broadly respect the CJC’s restriction on web indexing, the reasonable expectation of Canadians is that while court decisions may be available online, personal information contained in those decisions should not be discoverable via popular search engines.
87. By republishing decisions from Canadian court and tribunal websites and sites like CanLII and SOQUIJ, and allowing this content to be indexed by individual names through search engines, Globe24h has effectively undermined the balance between privacy and the open courts principle that has been struck by the CJC in its Model Policy and adopted by the Canadian court and tribunal websites concerned, which is also consistent with OPC Guidance.
88. In our view, there is a significant difference between making court and tribunal decisions available online so that they are accessible to those who wish to consult past precedents and hold decision-makers accountable, and making those decisions – and their contents – indexable by popular search engines and available to anyone simply querying about another individual. As noted by the complainants in this case, indexing of court and tribunal decisions by search engines can provoke significant reputational harm and embarrassment to individuals by needlessly exposing sensitive personal information to inadvertent discovery.
89. As noted above, the Globe24h website contains paid advertisements, and a proportion of the revenue from these ads can be presumed to be generated by webpage visits caused by the increased exposure of individuals’ personal information. In our view, it is not appropriate for Globe24h to attempt to generate revenue by exposing the personal information of individuals contained in judicial and administrative tribunal decisions in a way that circumvents existing privacy protections put in place by court and tribunal websites and which runs counter to the reasonable expectations of Canadians.
90. For these reasons, we do not consider that Globe24h’s purpose of making available Canadian court and tribunal decisions through search engines – which allows the sensitive personal information of individuals to be found by happenstance or by anyone, anytime for any purpose – is one that a reasonable person would consider to be appropriate in the circumstances.

• Publicly available information

91. We also do not consider that Globe24h is in compliance with the consent requirement of PIPEDA. The Act permits the collection, use or disclosure of personal information without the knowledge or consent of the individual where that information is publicly available as prescribed by regulation. Accordingly, publicly available information includes information contained in a record or document of a judicial or quasi-judicial body that is available to the public, and where the collection, use or disclosure relate directly to the purpose for which the information appears in the record or document.^{Footnote 9} Globe24h has stated that its purpose is to make law freely available on the Internet.
92. However, the Model Policy described above indicates that the purpose for publishing court findings online does not include the association of such findings with individuals’ names in online search results. Indexing by search engines allows for personal information contained in court and tribunal decisions to be found even when one is not searching for the information. As such, Globe24h’s purpose in allowing the decisions to be indexed by popular search engines is not “directly related” to the purpose for which the personal information appears in the record or document.
93. Furthermore, as noted above, our Office does not accept the position that Globe24h’s true purpose for collecting, using and disclosing Canadian court findings is to promote transparency in the judicial system. Instead, its purposes include the for-profit exploitation of individuals’ desire to maintain some degree of privacy in relation to court and tribunal proceedings. This is clearly not directly related to the purposes for which the decisions were published.
94. As such, our Office finds that the exceptions to the Act’s knowledge and consent requirements described in ss. 7(1)(d), 7(2)(c.1) and 7(3)(h.1) do not apply in this situation.

• Recommended actions

95. In our preliminary report of investigation, we recommended that Globe24h delete from its website and servers all Canadian court and tribunal decisions that it republishes which contain personal information and take the necessary steps to remove these decisions from search engine caches.

• Globe24h’s response to our preliminary report

96. In response to our preliminary report, Globe24h rejected our Office’s recommendations. Globe24h stated that it would implement our recommendations only in accordance with a Romanian court order. Globe24h later amended this position to state that it would be willing to reach a settlement and resolve the matter, but only in accordance with the Romanian legal framework.
97. Globe24h also took issue with a number of conclusions in our preliminary report. First, it argued that, as it has discontinued the paid removal option, it is no longer engaged in commercial activity.
98. With respect to commercial activity, it is our Office’s position that Globe24h continues to be engaged in a commercial activity given: (i) the presence of advertising on its website and the fact that it actively solicits advertising, and (ii) as described in paragraphs 10-12, Globe24h continues to charge for the removal of personal information.
99. Globe24h also submitted that the Romanian National Supervisory Authority for Personal Data Processing (the “Romanian Data Protection Authority”) has asserted authority over the organization, having imposed a fine in an October 2014 decision for contravening Romania’s data protection law. This decision is being challenged by Globe24h in a Romanian court. Globe24h asserted that the Romanian Data Protection Authority and our Office cannot both have jurisdiction over its activities.
100. Our Office considers that the fact that the Romanian Data Protection Authority has asserted jurisdiction over Globe24h does not preclude our Office from doing the same. It is commonplace in today’s global environment that organizations with an online presence may be subject to data protection laws in multiple jurisdictions depending on the nature of their activities.
101. Finally, Globe24h argued that it does not have a real and substantial connection to Canada, citing the criteria established in Club Resorts v. Van Breda^{Footnote 10}, and PIPEDA Report of Findings 2008-389 (Kluge v. Law School Admission Council)^{Footnote 11}. In particular, Globe24h argued, among other factors, that it does not carry on business in Canada, does not contract within Canada, and did not commit any tort in Canada. The entirety of Globe24h’s business, it is argued, takes place within Romania.
102. Both these cases, Van Breda and PIPEDA finding 2008-389, are distinguishable from the present circumstances. Based on the relevant factors we described in para. 68 of the present report, our Office maintains that Globe24h does have a real and substantial connection to Canada, and therefore does fall under PIPEDA jurisdiction in relation to its treatment of Canadians' personal information.

Conclusion

103. Notwithstanding that, following our Office’s intervention, Globe24h did remove personal information from its site for a number of complainants, concerns persist with respect to certain of the complainants and with Globe24h’s overall collection, use and disclosure practices.
104. Accordingly, we conclude that the matter is well-founded.
105. Our Office has a continuing interest in the respondent complying with the Act.
106. Pursuant to our Office’s Memorandum of Understanding with the Romanian Data Protection Authority, we have collaborated, and continue to collaborate, with that office toward securing a resolution to this matter, and assisting, where possible with related matters being pursued by the Romanian Data Protection Authority.
107. The Office of the Privacy Commissioner of Canada will also be considering pursuing this matter in accordance with our authorities under the Act.

Footnotes