Online legal database doesn't need consent to use publicly available court decisions, in support of the open court principle

PIPEDA Report of Findings #2015-013

September 21, 2015

Complaint

An individual discovered that a court decision which contained her personal information was contained in a company's online legal database; and thus available to its subscribers.

The individual filed a complaint with our office, alleging that the company had collected, used and disclosed her personal information without her consent by publishing the decision in its database. According to the complainant, it was traumatic, embarrassing and harmful knowing that intimate information about her and her family could be made available to others. In addition, she also alleged that the collection, use and disclosure were for an inappropriate purpose. Specifically, she claimed that there was a publication ban in place with regard to the decision. She also believed that the company had inappropriately allowed the decision to be indexed by external search engines.

The individual had also made an access request to the company for the personal information that it held about her, including how the company obtained the court decision and who had accessed it using the database. The company initially refused her request.

Outcome

Our Office found that the company had collected, used and disclosed the court decision for appropriate purposes pursuant to subsection 5(3) of PIPEDA. In our view, the company's purpose was to support the open courts principle, by making court and tribunal decisions more readily available to Canadian legal professionals and academics. We found that the company's subscription-based research tools and services do not undermine the balance between privacy and the open courts principle that has been struck by Canadian courts, nor are the operation of these tools inconsistent with our Office's guidance concerning the same^{Footnote 1}.

Our investigation revealed no evidence of a publication ban in place for the decision. Similarly, our investigation did not find that the company was allowing search engines to index decisions within its database or otherwise making them available to non-subscribers. We did note, however, that the court decision at issue was hosted on another company's website, which was itself the subject of an investigation from our Office in a well-founded complaint^{Footnote 2}, and which appeared in search results using external search engines.

Our Office found that the individual's consent for the company's collection, use and disclosure of the decision was not necessary in this situation. PIPEDA does not require consent for the collection, use or disclosure of personal information if it is publicly available as specified in the Regulations Specifying Publicly Available Information. The Regulations include "personal information that appears in a record or document of a judicial or quasi-judicial body, that is available to the public, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the record or document." In this case, the individual's personal information was contained in the record of a judicial body (a court decision) that is available to the public (via the court's website, etc.); and the company in this situation was collecting, using and disclosing the information for purposes consistent with, and directly related to, the purposes for which the decision was first published by the courts and tribunals themselves (access to legal information to support the open court principle).

Consequently, this element of the complaint was not well-founded.

We then considered the company's response to the individual's access request, which the company reconsidered after our Office became involved. The individual had requested access to four categories of her personal information:

1. the date on which the company collected the decision;
2. the source from which it collected the decision;
3. the number of times the decision had been accessed through the electronic database service; and
4. the identity of those who had accessed the decision.

We accepted the company's assertion that it does not maintain records of the number of times any individual record is accessed. Thus, no information was available to be provided under item (c). Further, the company ultimately did provide the individual with a sufficient response under items (a) and (b). Concerning item (d), in our Office's view, the company correctly asserted its need to protect the confidentiality of those who had accessed the decision, i.e., its subscribers. Therefore, subsection 9(1), (i.e., protecting the personal information of third parties) and, in certain instances, paragraph 9(3)(a) (i.e., withholding information protected by solicitor-client privilege) are exemptions from PIPEDA that could be relied upon to withhold this type of information from the complainant.

We found that the company had initially denied the individual access to her personal information to which she was entitled (i.e., items (a) and (b)) under PIPEDA but that its subsequent response ultimately did provide her with all the information to which she was entitled. Consequently, this element of her complaint was well-founded and resolved.