Online Anonymity - Canadian Edition

The Canadian Federal Court of Appeal recently handed down an important decision on online privacy. The case - BMG Canada v. Doe - unsurprisingly involves attempts by the music industry to identify alleged filesharers, using a Norwich Pharmacal analysis.

At first instance, disclosure was refused due to deficiencies in the plaintiffs' evidence, in what was seen as a strongly pro-privacy holding. The Court of Appeal, although it allowed the plaintiffs' appeal in part, accepted that the plaintiffs' evidence was insufficient to order disclosure, and adopted much of the trial judge's reasoning in relation to the privacy issues involved. The key paragraphs of the judgment are:

In cases where plaintiffs show that they have a bona fide claim that unknown persons are infringing their copyright, they have a right to have the identity revealed for the purpose of bringing action. However, caution must be exercised by the courts in ordering such disclosure, to make sure that privacy rights are invaded in the most minimal way.

If there is a lengthy delay between the time the request for the identities is made by the plaintiffs and the time the plaintiffs collect their information, there is a risk that the information as to identity may be inaccurate. Apparently this is because an IP address may not be associated with the same individual for long periods of time. Therefore it is possible that the privacy rights of innocent persons would be infringed and legal proceedings against such persons would be without justification. Thus the greatest care should be taken to avoid delay between the investigation and the request for information. Failure to take such care might well justify a court in refusing to make a disclosure order.

Also, as the intervener, Canadian Internet Policy and Public Interest Clinic, pointed out, plaintiffs should be careful not to extract private information unrelated to copyright infringement, in their investigation. If private information irrelevant to the copyright issues is extracted, and disclosure of the user’s identity is made, the recipient of the information may then be in possession of highly confidential information about the user. If this information is unrelated to copyright infringement, this would be an unjustified intrusion into the rights of the user and might well amount to a breach of PIPEDA by the ISPs, leaving them open to prosecution. Thus in situations where the plaintiffs have failed in their investigation to limit the acquisition of information to the copyright infringement issues, a court might well be justified in declining to grant an order for disclosure of the user’s identity.

In any event, if a disclosure order is granted, specific directions should be given as to the type of information disclosed and the manner in which it can be used. In addition, it must be said that where there exists evidence of copyright infringement, privacy concerns may be met if the court orders that the user only be identified by initials, or makes a confidentiality order.

The court also indicated that disclosure should not be granted if there was some "other improper purpose for seeking the identity of these persons".

Consequently, while the Canadian courts are prepared to grant disclosure on the basis of Norwich Pharmacal, it seems that they will (a) demand a higher standard of evidence before granting a disclosure order; (b) take greater steps to minimise the privacy consequences of a disclosure order; and (c) examine the request to see whether it is pretextual.

Michael Geist has an informative analysis of the decision on his (always interesting) website. He includes a summary, prepared by Alex Cameron (who argued the case), of the test which ISPs must now meet in order to seek disclosure:

Courts shall not order ISPs to disclose the identities of their customers unless the Plaintiff meets its burden of showing each of the following factors. If the Plaintiff fails to show any of the following, then disclosure shall not be made:

1. Plaintiff must show that it has:

(a) targeted the correct IP address by providing clear admissible evidence that it has correctly linked online activities to a specific IP address at a particular time. There should be no risk that innocent people will have their privacy invaded or named as defendants where it is not warranted (para 21); and

(b) "a bona fide claim that unknown persons are infringing their copyright" (para 42), including "i.e., that they really do intend to being an action based on the information they obtain, and that there is no other improper purpose for seeking the identity of these persons". (para.34)

(Note: Even if the plaintiff meets its burden under 1(a), disclosure may be refused where the ISP advises the court that there is a risk of an innocent person having their privacy invaded or named as a defendant where it is not warranted. This might arise if, for example, the ISPs records are incomplete or suggest that the risk is present for another reason)

2. "There should be clear evidence to the effect that the information cannot be obtained from another source such as the operators of the named websites." (para.35)

3. "The public interest in disclosure must outweigh the legitimate privacy concerns of the person sought to be identified if a disclosure order is made" (para.36)

a) the information on which a request for identification is made (eg, IP address) must be timely; no undue delay between investigation and motion for disclosure (para 43)

b) in their investigation, plaintiffs must "limit the acquisition of information to the copyright infringement issue" (para.44)

In cases where the plaintiff has met each of the factors above, "caution must be exercised by the courts in ordering such disclosure, to make sure that privacy rights are invaded in the most minimal way" (para 42). For example, specific directions should be given as to the type of information disclosed and the manner in which it can be used. In addition, the court should consider making a confidentiality order or identifying the defendant by initials only (para.45)