All About Information

On December 2nd, the New Brunswick Court of Queen’s bench ordered a plaintiff in a disability insurance claim to obtain “a history of her computer account use” from her ISP and “request” that her ISP generate a record accounting for her FaceBook use. These orders are becoming very common, but I will make a few notes:

• The tactic of seeking information through the plaintiff but held by a third-party is unique. The order seems bound to lead to delay and frustration (see here for an example) but at least is backed by the plaintiff’s right of access to personal information in PIPEDA. Perhaps the defendant didn’t like its chances of obtaining an order for forensic inspection of a home computer.
• Ferguson J. does a nice review of the applicable principles, and reminds us that the Supreme Court of Canada has endorsed necessity as a principle for dealing with production disputes over highly sensitive information by including this quote from A.M. v. Ryan: “I accept that a litigant must accept such intrusions upon her privacy as are necessary to enable the judge or jury to get to the truly and render a just verdict. But I do not accept that by claiming such damages as the law allows, a litigant grants her opponent a license to delve into private aspects of her life which need not be probed for the proper disposition of the litigation.”
• Ferguson J. does not, however, apply this filter in the circumstances, because he finds that the type of information subject to the order (mere usage data) is not part of the plaintiff’s “biographical core” of personal information. The biographical core concept, from the Supreme Court of Canada’s R. v. Plant decision, is a concept that restricts certain information from court protection.

Carter v. Connors, 2009 NBQB 317.

On October 16th, the Alberta Court of Queen’s bench partially affirmed an Alberta OIPC order that dealt with access to e-mails. It is notable for its consideration of e-mails that were alleged to be “personal” and therefore not accessible to the public and its consideration of the process for searching and retrieving e-mails.

There have been a number of recent Ontario cases in which public institutions have argued that “personal” e-mails are not subject to public access because they are not under institutional “custody or control.” In this case, the Edmonton Police Service searched and retrieved three e-mails but made redactions on the basis that full disclosure would constitute an “unjustified invasion of privacy.” In support of this position, it argued that the e-mails were communicated by members of the Edmonton Police Association in the course of association business and with a reasonable expectation of privacy. The Court affirmed the Commissioner’s finding that the e-mails were, in fact, not sent in the course of association business. Although this finding was determinative, it also made the following comment about the Service’s computer use policy:

The EPS also submitted that the EPS Policy 5-E-7 – Electronic Communications does not “allow personal use of its email system” as stated by the Commissioner. While this may be true, the Policy does warn users of the network that communications may be monitored and accessed by system administrators, and there was nothing improper in the Commissioner’s reference to the Policy in considering whether the authors of the Emails would have had an expectation of confidentiality.

The Court also affirmed a finding that the Service did not conduct a reasonable search and set aside an order to restore and search backup tapes.

On the search itself, the requester had argued that the Service ought to have conducted an “electronic search” for responsive records instead of the “field filtering” process it actually employed – i.e. one in which custodians were asked to search, retrieve and deliver up records. (See here for an Ontario case in which the same argument was made.) The OPIC held that field filtering is reasonable, but that “the head, or the head’s delegate, should take a supervisory role and be aware of exactly what steps have been taken to locate record, as the head is accountable for the quality of the search under section 10.” The Court agreed with this, and affirmed the OIPC”s finding that the Service did not engage in proper supervision of its field search.

Finally, the Court held the OIPC erred by ordering the Service to restore and search backup tapes without considering the restriction on the obligation to create records that require an institution to use more than its normal “computer hardware and software and technical expertise” or cause “unreasonable interference” with its operation. The Court seemed to assume that restoring compressed e-mails from a backup tape involves “creating” a record. While taking no position on the issue, I note that this is a point that may be disputed.

Hat tip to Linda MacKay-Panos, who summarizes the decision here.

Edmonton Police Service v. Alberta (Information and Privacy Commissioner), 2009 ABQB 593.

On October 22nd, the Ontario Superior Court of Justice dismissed a motion for production of a personal computer and criticized the moving party for proceeding in the face of a sworn statement by the opposing party’s solicitor that indicated the computer was gone.

The computer once contained information relevant to a loss of income claim. The plaintiff discarded it because it had broke down sometime after she printed and produced invoices from her personal business and sometime before a mediation attempt, which occurred slightly less than a year later. In the interim, the defendant made and sustained a request for electronic copies of the invoices.

When the defendant moved for production, plaintiff’s counsel wrote and later swore that the computer had been discarded and consented to allow the defendant to plead spoliation. Defence counsel persisted and generated some damning evidence in cross-examining the plaintiff’s witnesses, including a statement by the IT professional who the plaintiff relied upon, who said that he never actually examined the plaintiff’s computer.

Though the defendant was clearly onto something, Master Brott was not impressed that the defendant persisted despite the plaintiff’s agreement to deal with a spoliation claim and, in particular, plaintiff counsel’s statement that the computer was gone:

The circumstances leading up to this motion are in my view, a clear example of a proceeding going astray – of not being able to see the forest through the trees. Lawyers take oaths which require them to act in a professional manner. Defence counsel urged me to ignore the evidence of solicitor Sacks because of the contradictions obtained from the plaintiff’s boyfriend and the IT specialist. I am not prepared to ignore the solicitor’s Affidavit, nor the correspondence and telephone information from plaintiff’s counsel to defence counsel advising that the computer is no longer available. Whether the computer was in fact given to the IT specialist or is corrupted or is still available cannot be established at this stage. But what is critical is that counsel has sworn that the computer is no longer available. That should be the end of it! The rest is for trial.

…

… once [the Defendants] received plaintiff’s counsel’s correspondence outlining the corruption of the computer and the further information that the whereabouts of the computer were unknown and unrecoverable, the over-zealous actions of the defendants all the while knowing that even if successful, any Order could not be effective, was inappropriate. The rules encourage parties to proceed in a fair and inexpensive fashion and to attempt to resolve their disputes.

Cerkownyk v. Ontario Place, 2009 CanLII 62065 (ON S.C.).

On October 29th the IPC/Ontario issued an order in what appears to be a well-litigated dispute about the access request process. It rejected a challenge to the reasonableness of a search and the reasonableness of a fee estimate that was based on the respondent municipality’s manual process of providing access.

The responding municipality’s FOI officer directed officials to conduct searches for responsive records and to print and forward responsive records. The officer then manually de-duplicated and reviewed records prior to providing access. The appellant argued that this process was unreliable and inefficient and that the municipality either should have used its IT department or third-party to process the request using automated means. The IPC deemed the municipality’s chosen process to be reasonable, though it disallowed fees related to 2.5 hours of de-duplication and organization because the municipality did not provide sufficient supporting particulars.

The IPC has, in at least one order, endorsed an “e-access” process in upholding a fee estimate for about $12,500. Though such a process is more in tune with prevailing best practices for records search and retrieval, it will also tend to result in higher costs, all of which can be transferred to an Ontario requester if a third-party service provider is used. Given the requester in this more recent case was asked to pay less than $500 to receive the benefit of the municipality’s (certainly laborious) manual efforts, one may wonder if she really wanted what she asked for.

MO-2472, 2009 CanLII 63119 (ON I.P.C.).

On May 5th, the Alberta Court of Queen’s Bench for affirmed an Anton Piller order that permitted a search of business premises and private residences and seizure of materials and information related to a departing employee claim.

There is a three-part test for the making of an Anton Piller order: (1) there must be an extremely strong prima facie case; (2) the potential or actual damage to the applicant must be very serious; and (3) clear evidence that the defendants have incriminating evidence in their possession and that there is a real possibility they may destroy such material.

The Court examined the mixed jurisprudence on the “serious harm” element and held that it requires proof of procedural rather than financial harm. That is, an applicant must demonstrate that its proposed order will preserve evidence without which it could not prove its case. The Court reasoned that the purpose of the extraordinary order is to preserve evidence and that irreparable financial harm can be addressed through an ordinary injunction:

As discussed, the adverse financial impact approach considers potential harm that may be visited upon the plaintiff as a result of the use of the proprietary or confidential information that the defendant has or may have in its possession. If this is the type of damage that the plaintiff seeks to enjoin, then an injunction may suffice without the need for the court to exercise the extraordinary power of granting an Anton Piller Order. As noted by Hoffmann J. in 1268 Lock International Plc. v. Beswick and Others, [1989] 1 W.L.R. 1268 at 1281, Anton Piller orders reside at the “absolute extremity of the court’s powers”. For that reason, they should only be granted in circumstances which demand their imposition. Those circumstances would have to include more than the desire to enjoin certain activities which could be accomplished through much less intrusive methods. They must include a need to preserve evidence without which the plaintiff’s claim could not be proven.

The Court held that the applicant met its burden of proving serious harm even though it had copies of the information taken and (presumably) evidence showing it was taken. The Court suggested that the applicant would also need forensic evidence about how its information was stored and maintained on the defendants’ computers to prove misuse of confidential information: “[Making out its case] would include showing where the information was taken and how it was used or altered.”

The Court also engaged in a detailed analysis of the evidence to determine whether the applicant had established a “real possibility” of destruction based on a “compelling inference.” There is a policy lesson in this part of the judgement for employers who are likely to be faced with claims by departing employees who take electronically-stored confidential information and claim they deleted it because they realized that taking it was wrong. In the face of such a defence, the Court drew an inference that destruction of evidence was a possibility based partly on the applicant’s good information management practices. It said:

I am satisfied that on all of the circumstances in relation to this point there is a basis upon which to draw a strong inference of dishonesty. Particularly compelling is the fact that Higham took the documents in the face of his supervisor’s warning and an employment agreement he executed prohibiting him from copying or transmitting “[a]ll notes, records, working papers, files, research material or literature accumulated or developed” while at CCS…

Secure argued that the e-mails Higham deleted and the CD-Rom he destroyed was not “evidence” when it was destroyed because there was no Statement of Claim yet issued or because the litigation had not yet commenced. Belzil J. in Netsmart considered the destruction of documents before litigation had commenced in relation to this arm of the test. In any event, Higham knew he was in possession of documents that he should not have had and he chose to destroy them. Even if the destruction was in good faith as he claims, a point upon which I make no finding, it does not mitigate the risk of his destroying further CCS documents in his possession. In other words, he was given to destroying documents that were improperly in his possession. Regardless of his motives the fact that he did this at least twice indicates that it may well happen again. As stated by Richard A.C.J. in Adobe, at para 89: “It cannot now be argued that the plaintiffs should be denied an Anton Piller type order preserving evidence when that evidence was in fact destroyed.”

While this passage highlights the applicant’s good information management practices, the applicant also suffered for agreeing to give another of its departing employees his work laptop in return for a promise to make a charitable donation and then failing to wipe the laptop when requested by the employee. The Court held that it could not draw any negative inference from the employee’s deletion of over 4,000 e-mails in these circumstances because the this action was consistent with the actions of an honest employee who wanted to rid himself of his employer’s e-mails. As a result, the Court revised the order to exclude the laptop.

The plaintiff brought a cross-motion to deal with the scope and form of production of information from a number of seized hard drives. The award discusses the protcol by which the parties will deal with production but is not very directive as it appears they were in substantial agreement on how to proceed.

CCS Corp. v. Secure Energey Services Inc., 2009 ABQB 275 (CanLII).

I was at the Osgoode PDP Electronic Evidence seminar today. There were great presentations all around, and I’ve included my notes at this Twitter feed. I was very honoured to co-present with John Gregory, whose knowledge of electronic evidence issues is deep. Our presentation is really about the law of e-mail, with a mix of content on access to e-mail on corporate systems, e-mail production and e-mail admissibility and weight. Here are the slides.

We also provided a handout with case citations and a summary sheet on the CGSB Standard on Electronic Records as Documentary Evidence.

I hope this is useful!

Yesterday, the British Columbia Supreme Court ordered a hard drive to be produced to a neutral expert to identify and extract information about the amount of time the plaintiff spends on Facebook between eleven at night and five in the morning. It held that this information met the standard of relevance for production given the plaintiff had claimed that fatigue is preventing him from maintaining employment. It also characterized the scope of the defendant’s request as narrow and suggested the privacy interest of the plaintiff and other users of the (home) computer were resolved by engaging a neutral.

Thank you to Erik Magraken of the ICBC Law blog for posting on this decision first.

Bishop v. Minichiello, 2009 BCSC 358.

I attended Osgoode’s Symposium on Technology Crime and Electronic Evidence today. A great program, with dialogue on search and electronic evidence issues from keynote speaker Jennifer Granick of the EFF, Crown counsel Susheel Gupta, computer forensic professional Philip Fodchuck, Crown counsel Michel Fairburn, defence counsel Scott Fenton and defence counsel Alan Gold among others.

I didn’t plan on live blogging but had my computer open and kind of got into it. Here’s the stream, which includes some “nuggets” and cites to case law.

Thanks to the presenters and organizers. Inspiring.

Dan

On February 13th the Prince Edward Island Court of Appeal held that a motions judge erred in striking a statement of defence as a sanction for non-production. The Court suggested that such a strong sanction should not be utilized for discovery abuse in the absence of a finding of bad faith or contempt given the difficulties in assessing relative prejudice before trial. It nonetheless sanctioned the defendant by imposing conditions on the use of records subsequently found, by specifying that the trial judge may presume damages and by awarding costs of the motion and appeal to the plaintiff.

Jay v. DHL, 2009 PEICA 2 (CanLII).

The depths of winter are upon us, and what a winter it has been! I hope you are all coping. I’m doing okay, but did have to book a plane ticket to Halifax for a couple of weekends from now to give me something to look forward to. It doesn’t matter if it’s cold, as long as surf is involved I’ll be revived.

Here are some recent developments in the domain that you may find noteworthy. They are about child pornography reporting, why FOI in Ontario has not yet met e-discovery and why there is no “bright line” test for improper “campus speech.”

Child pornography reporting

Kelly Harris of Canadian Lawyer InHouse recently wrote on Ontario’s new child pornography reporting law. Kelly quoted me, and in prepping for his call I did a bit more thinking about the law than I had at the time I first reported on it. The reporting duty applies to “persons,” and though one might argue a corporation/system owner has a duty to report, the law is clearly geared at individuals. But as I told Kelly, corporations can’t wash their hands of the duty to report material found on their computer systems. It’s good workplace policy for employers to support the members of their IT staff, but employers also need to protect themselves from potential criminal liability.

In my view, one of the things the legislation does is engage “the course of justice” as soon as a person discovers what might reasonably be child pornography. The suspected pornography, which is in the custody of the employer, is now evidence and must be treated carefully given the potential for obstruction charges. This is a significant change, and rules out dealing with the found material as an internal, employment-related matter.

As for policy-buliding, Ontario school boards have great reporting protocols that employers may look at to get started. Search “child in need of protection” and “district school board.”

Why FOI in Ontario has not yet met e-discovery

Decisions about how to conceive of a “record” are so fundamental that they tend to get information and privacy people like me excited. The January 19th Arizona Court of Appeals decision that metadata is not a “public record” under Arizona open government legislation has attracted such a buzz. Here is K&L Gates’ summary of the case, which I have scanned but not read.

Our freedom of information law in Ontario is different, and allows for access to records in electronic form (see the Gombu case for an example). That said, we have not seen an escalation of electronic production demands that even remotely resembles that demonstrated in the American e-discovery experience or even the relatively mild Canadian e-discovery experience. Paper-based production in Ontario FOI procedure still prevails, likely because the system is a user-pay system where escalation does not serve requesters and because the regulation does allow for full recovery of the “invoiced costs” of e-discovery. I’m aware of just one IPC/Ontario order upholding the recovery of such costs, but it’s an important one if escalation is to be avoided.

The douchebag case – why there is no “bright line” test for improper “campus” speech

I ignored my friends’ tweets about “the doucebag case” for about two days until, with some time to kill in the back of a cab, I linked through one friend’s tweet and realized all the buzz was about a student speech case – one about a high school student who was sanctioned for referring to her school administrators as “douchebags” in her personal blog. The news that’s got people talking (or tweeting as they may) is a Connecticuit court’s January 15th partial dismissal of the student’s claim. Mary-Rose Papendrea has posted an excellent summary and critique of the judgement on the Citizen Media Law Project’s blog. She says:

…courts should be reluctant to apply Fraser to off-campus Internet speech because that case does not require a showing that the offensive expression disrupted or could reasonably be expected to disrupt school activities. Because Fraser does not require the school to make this showing, schools could restrict any indecent speech by a student, anywhere regardless of where he engages in it, without any additional showing. The idea that schools could regulate offensive speech on the Internet without showing any harm to the school would give school officials virtually limitless authority to police their students’ expression, and this should give courts pause. Although students have somewhat limited free speech rights while they are at school, they are entitled to full free speech protections outside of school.

To suggest that a sanction must be based on reasonably foreseeable harm to a legitimate interest is reasonable, but let’s look at the moral panic that this case has caused.

The article I linked through to on my cab ride was one about a proposal by a Connecticut legislator that was made in response to the case. In the name of clarity, this legislator has proposed a “bright line rule” – one that would “prohibit school authorities from punishing students for the content of electronic correspondence transmitted outside of school facilities or with school equipment, provided that such content is not a threat to students, personnel, or the school.”

To be fair, even the legislator’s proposed rule builds-in a harms-based test. The focus on the locus of the communication, however, is misplaced. I make no comment on the outcome in the douchebag case, but I do agree with the Court’s comment that locus of the communication has become less and less relevant to the balancing of interests that is required in resolving student speech cases. The Court said, “Off-campus speech can become on-campus speech with a click of the mouse.” This is indisputable. So rather than generate some false sense that individuals will not be accountable for harms caused or likely to be caused by communication made from a home computer and on a personal blog, policy should focus on the real issue – what standard of harm or foreseeable harm to the school environment justifies a restraint on speech in what circumstances. To suggest answering this question is as easy as looking at the locus of the communication is misleading.

***
I’ve been wordy today, but I’ve been enjoying using this space for telling personal stories. That’s what online social networking is about right?

We refer to this photo as “the men photo.” There’s a copy on our living room wall at home and I send it around to friends once and a while because it brings back such good memories of our time in Maui.

The guy in the tux is my friend Artur Szpunar, and this was his wedding day. Art went down to Maui with me for a windsurfing trip after finishing first year of an engineering degree at Queen’s University and has never left. When I packed my bags to return home, I left Art with less than $100 and a few days of paid-up rent. Now, 11 years later, he’s got a happy family and an awesome gig as sail designer for Maui Sails.

Art’s wedding was about four years after his arrival on Maui and just a month or two after he survived a crazy and serious battle with necrotizing fasciitis (Streptococcus A or the “flesh eating bacteria”). I owe Art big, because I became infected by the Strep A bacteria shortly after him, and the only thing that convinced the hospital to take my case seriously at first was my pleas about what happened to Art. Given the early attention, I ended up checked into the hospital for only a week. I frequently wheeled myself down to visit Art, who by then was on the mend.

To Art’s right is my good friend Dan Kaseler, also a sail designer, now based out of Washington state and designing windsurf and other sails through his own company. To Art’s left is Johnny Boyle, a Scottish hellman who has now settled down with family in California. The other fellow is John’s brother “Moxie.”

The wedding plan was to have guests congregate with the groom in the parking lot of the Iao Valley State Park before hiking to meet Art’s bride-to-be, Amanda. If it was sunny Amanda would be in one place and if it was rainy she would be in another. Not a bad plan if the Iao Valley wasn’t one of those places in Hawaii where it’s almost always sunny and rainy at the same time. So it took us all a few wrong turns to find Amanda, but all worked out. Art and Amanda got married, Art healed and got back in the water and they now have a beautiful three-year-old daughter.

Telling a Maui story always reminds me that there’s more than one way to go about living life. It also helps warm my heart and put a smile on my face, even in the depths of winter. Thanks for listening!

Dan