News

Leave Not Granted in Application against Trustee in Bankruptcy on Allegation of Breach of Privacy

The value of evidence arising from blog posts and YouTube videos was considered in Re Netlink Computer Inc. Netlink had been a company selling computers and related equipment until it went bankrupt in 2017. The Trustee in Bankruptcy had, in the course of the bankruptcy proceedings, sold Netlink’s assets, but this had given rise to some online controversy. In particular, a blog post had appeared on a site called “privacyflyby.com”, written by Travis Doering. The blog post alleged data breaches in the sale, by the Trustee, of equipment owned by Netlink. That led to a former customer of Netlink’s, Kipling Warner, to seek leave to sue the Trustee, and indeed to commence a class action. Warner alleged that the Trustee was negligent in selling Netlink’s assets, breached its service contract with Warner, breached the Personal Information Privacy Act, SBC 2003, c 63 [PIPA], the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 [PIPEDA], and the Privacy Act, RSBC 1996, c 373, and that the negligence of the trustee is in respect of a duty of care was owed to a class, for which Warner sought certification.

Warner claimed, on behalf of the class:

1. Damage to credit reputation;
2. Mental distress;
3. Costs incurred in preventing identity theft;
4. Costs incurred in paying for credit monitoring services;
5. Out of pocket expenses;
6. Wasted time, inconvenience, frustration, and anxiety associated with taking precautionary steps to reduce the likelihood of identity theft or improper use of credit information, and to address the credit flags placed on their credit files; and
7. Time lost engaging in precautionary communications with third parties such as credit card companies, credit agencies, banks, and other parties to inform them of the potential that the Class member’s Private Information may be misappropriated and to resolve delays caused by flags placed on Class members’ credit files.

The issue before the Master was whether Warner had established a prima facie case against the Trustee. It did not, because of the frailties in the evidence presented.

In Warner’s own affidavit, he relied on a number of other sources, including a blog post and a YouTube video posted by two different people who said they had attended the sale. The Master pointed out that there was no explanation as to why those two people had not been asked to provide their own affidavits, and that the “double hearsay” of Warner’s report about what they had posted online was not admissible.

Further, although Warner swore in his own affidavit that he believed Doering’s statements in his privacyflyby blog to be a faithful and accurate account, he possessed no personal knowledge of any of the facts, and integrated elements of his own belief (that were not included in the Doering blog post) that amounted only to conjecture.

In addition the Master found unpersuasive the affidavit provided by Doering himself:

[49] Mr. Doering has a commercial interest in what he alleges to be the exposure of the Netlink data breach. In addition, Mr. Doering has limited direct knowledge of the facts forming the basis of the proposed action. The Doering Affidavit was not drafted for the purpose of being tendered as evidence in a court proceeding. Rather, it is a blog post with a jurat attached to it.

Ultimately the Master concluded that the low evidentiary threshold had not been met and denied leave.

But judge crossed the line in assuming only one way to fabricate text message exchange

In R v Lambert, Justice Molloy of the Ontario Superior Court of Justice heard an appeal of a conviction in which a substantial part of the case was determined by judicial notice of how text messaging works.

The accused, Lambert was convicted of uttering threats, criminal harassment and breach of probation for sending text messages to his ex-girlfriend over a 21 day period and going to her place of work. The actual text messages or the phone (or any detailed analysis of either) were not available at the trial. The only evidence the testimony of the ex-girlfriend, NB, and photographs the police had made of her phone showing the text messages in question.

The trial turned on the credibility of the complainant and the identity of the sender of the text messages. If the accused had actually sent the messages, they would be evidence and provide substantial corroboration of the threats and harassment. However, there was nothing independent linking the messages to the accused. By the time NB had called the police, she had deleted three threatening voicemails, and by the time of the trial she no longer had the phone. The messages not been extracted from the phone and the police never examined it beyond taking photos of the screen.

From the appeal decision:

[6] The text messages were exhibits at trial. The messages sent by “Barrii” contained repeated and persistent demands for money allegedly given to N.B. and numerous threats against her. The threats escalated in violence and frequency from May 1 through to May 12, 2016, and included threats to attend at the workplace of N.B.’s daughter, threats to harm N.B., and threats to kill N.B. One such message could reasonably be construed as a threatened murder/suicide. On May 12, in addition to threatening to kill N.B., the sender of these messages said he had a gun. N.B. testified that she decided to go to the police when she received that message.

The defence suggested to NB that she had created the messages herself:

[10] It was suggested to N.B. on cross-examination that she had fabricated the text messages sent to her. Specifically, it was suggested that she: (1) obtained a second phone, which had the number 647-550-7359; (2) put that number in the contacts in her usual phone as “Barrii;” and, (3) fabricated the exchange of messages by sending messages to herself, purportedly from “Barrii,” and then sending replies from her regular phone. N.B. denied that suggestion, maintaining that all of the messages from “Barrii” were, in fact, sent by Mr. Lambert.

The trial judge determined that NB had not created the messages: they appeared natural, they included normal references to other people and events and did not paint the complainant in a good light. If she were to go to the effort to manufacture the text messages, “she would have painted herself in a better light and portrayed herself as being frightened, rather than defiant as she appeared in many of her responses.”

The trial judge also took judicial notice of how text messaging works in order to find that NB likely had not created the messages herself:

[15] The trial judge then rejected the defence argument that the Crown’s case was lacking because no expert was called to explain how text messaging works, stating:

In this day and age, text messaging is ubiquitous and is a method of communication widely used and understood by everyone who uses a cell phone. I can take judicial notice of how text messaging works, and I do not need an expert to tell me that text messages are sent from one cell phone to another, that the date and the time the message is sent is captured on the receiver’s cell phone as is the sender’s phone number, as is shown in Exhibit 2. It is not unlike telling the time. You do not need to tell how a clock works to tell what time it is.

[16] Finally, the trial judge accepted N.B.’s evidence that she was frightened by the messages but did not report the matter to the police because she was trying to defuse the situation. The trial judge also accepted N.B.’s evidence that she believed she had no choice but to go to the police once Mr. Lambert told her he had a gun. Likewise, the trial judge accepted N.B.’s testimony that Mr. Lambert came to her house and to her place of employment and left threatening voice messages. She stated, “I base this conclusion on [N.B.]’s evidence as corroborated by the text messages, which I am satisfied were sent by Mr. Lambert.”

One of the accused’s grounds of appeal was that the trial judge had improperly taken judicial notice of how text messaging works. To address this question, the judge on appeal referred to R v Find from the Supreme Court of Canada:

In this case, the appellant relies heavily on proof by judicial notice. Judicial notice dispenses with the need for proof of facts that are clearly uncontroversial or beyond reasonable dispute. Facts judicially noticed are not proved by evidence under oath. Nor are they tested by cross-examination. Therefore, the threshold for judicial notice is strict: a court may properly take judicial notice of facts that are either: (1) so notorious or generally accepted as not to be the subject of debate among reasonable persons; or (2) capable of immediate and accurate demonstration by resort to readily accessible sources of indisputable accuracy. [citations omitted]

The judge on appeal found that the trial judge stayed within the permissible bounds of judicial notice in most of her analysis, but veered over the line in part by assuming – and concluding -- there was only one way that a fabrication could be carried out:

[29] …. The trial judge held:

In my view, it would take an extraordinary effort on [N.B.]’s part to fabricate these text messages. She would need to obtain a second phone with the number 647-550-7359 assigned to it, create a contact with the name Barrii, and with that phone number in her contact list, and then proceed over 21 days to fabricate close to 2,000 lines of texts between her phone and the other phone. [Emphasis added.][16]

[30] Implicit in this finding is the assumption that the only way to fabricate a text message is by this method. There was no evidence at trial as to how text messages might be fabricated and made to appear to have come from another phone. There was no evidence that it would be impossible to fabricate date and time stamps of messages received and sent on one’s own phone. The trial judge concluded, however, that to have fabricated these messages the complainant would have had to send them at the dates and times reflected on her phone. Based on the normal way cell phones work, I accept that the trial judge could have taken judicial notice of the fact that this was one way to fabricate such messages. However, a determination that there was no other possible way to do so is a finding of fact that goes beyond what is notorious and indisputable. Such a determination could only be based on evidence from somebody with expertise in how this technology works. It cannot be the subject of judicial notice. The trial judge erred in law by making this finding in the absence of any evidence.

However, in the result, the judge concluded that it was an error that did not affect the final result.

Consent of one spouse cannot authorise the seizure of a computer containing private data about the other.

The Supreme Court of Canada has concluded that one spouse has a sufficient reasonable expectation of privacy in a jointly-used home computer that the other spouse cannot consent even to the seizure of that computer, with its decision in . This conclusion overturns the decision of the Ontario Court of Appeal, which had held that the spouse could consent on her own behalf to the taking of the computer, which would have the effect of the police lawfully taking it: see the discussion in the CanTech newsletter of May 24, 2017.

Reeves shared a home with his common law spouse. They were separated in 2011 and Reeves was subject to a no-contact order after being charged with domestic assault against his spouse. For Reeves to visit the home, he needed to obtain his spouse’s prior, written and revocable consent, which she did in fact revoke in 2012. At that time, his spouse called Reeves’ probation officer to withdraw her consent, and also reported that she had earlier found what she believed was child pornography on the shared home computer (used by both spouses) in 2011. After she reported what she had found, a police officer went to the home without a warrant, and he later testified that he did not believe he had grounds at that time to obtain a warrant. The spouse allowed the officer to enter the house and signed a consent form allowing the officer to take the computer from a shared space in the home. At the time that the computer was taken, Reeves was in police custody on unrelated charges. The police detained the computer for four months during which they neither searched the computer nor reported it to a justice as required by s 489.1 of the Code. In February 2013 the police obtained a warrant and searched the computer finding images and videos that constituted child pornography, at which point Reeves was arrested and charged.

The trial judge had found a number of Charter violations: the entry into the home, the seizure of the computer, the eventual search of it under the warrant (which was found to have been improperly issued) and the failure to file a report with a justice about the seizure of the computer. Because of this collection of violations, the trial judge had excluded the evidence. The Ontario Court of Appeal agreed that there were some Charter violations in the case, but disagreed that either the entry or the seizure violated the accused’s Charter rights, and as a result did not exclude the evidence. Those two issues went to the Supreme Court, which rendered a majority decision only on the second: eight of the nine members concluded that the seizure of the computer was, in fact, a violation of the accused’s section 8 right to be free from unreasonable search and seizure, and that that was sufficient to conclude that the evidence should be excluded and therefore to restore the decision at trial. (Seven of eight judges left the question of whether one person could consent to the entry by the police into areas commonly-held with other people to be discussed in a case which turned on that issue. Justice Moldaver, writing only for himself, concurred with the majority reasoning on the seizure issue while also offered a tentative method of analysis of the entry issue, but left a final determination of the point for another day. Justice Côté, writing only for herself, concluded that the issue of the entry into the premises should be addressed, and was not unlawful, and indeed that the seizure was lawful. However, she also concurred in the majority result that the evidence should be excluded.)

The key to the majority’s reasoning rested on their discussion of reasonable expectation of privacy in the context of a computer. In Reeves, the Court continues its sophisticated “large and liberal” understanding of privacy in the technology context. That issue of reasonable expectation of privacy, which the Court again stresses must be evaluated on a normative basis, rests on consideration of four factors: (1) the subject matter of the alleged seizure; (2) whether the claimant had a direct interest in the subject matter; (3) whether the claimant had a subjective expectation of privacy in the subject matter; and (4) whether this subjective expectation of privacy was objectively reasonable. As has increasingly become the case recently (as for example in R v Marakah, discussed in the CanTech newsletter of December 21, 2017) exactly how the first consideration, the subject matter, is defined has a major impact on the rest of the analysis.

The Supreme Court’s point was that the subject matter of this seizure was not merely the computer as a physical item, but “ultimately the data it contained about Reeves’ usage, including the files he accessed, saved and deleted” (para 30). They noted that “When police seize a computer, they not only deprive individuals of control over intimate data in which they have a reasonable expectation of privacy, they also ensure that such data remains preservedand thus subject to potential future state inspection” (para 30). They carried on to say

[31] Thus, I disagree with the Court of Appeal’s assertion that “[s]eizing the computer did not interfere with Reeves’ heightened expectation of privacy in its informational content; it did not imperil any of his legitimate interests, beyond mere property rights” (para. 61). Clearly, the police were not after the physical device (to collect fingerprints on it, for example), but rather sought to preserve and permit access to the data it contained. To focus exclusively on the property rights at issue (that is, on Reeves’ interest in the computer) neglects the important privacy rights in the data that are also engaged by the seizure.

Once the subject matter was defined in that way it was easy for the Court to conclude that the accused had a subjective direct interest in that data, which settled the second and third considerations, and left only whether the privacy interest was objectively reasonable. The Court answered that question affirmatively, as it has on many other occasions relating to electronic data:

[34] Personal computers contain highly private information. Indeed, “[c]omputers often contain our most intimate correspondence. They contain the details of our financial, medical, and personal situations. They even reveal our specific interests, likes, and propensities” (R. v. Morelli, 2010 SCC 8, [2010] 1 S.C.R. 253, at para. 105; see also Vu, at paras. 40-41; Cole, at paras. 3 and 47-48). Computers act as portals — providing access to information stored in many different locations (Vu, at para. 44; R. v. Fearon, 2014 SCC 77, [2014] 3 S.C.R. 621, at paras. 131-32). They “contain information that is automatically generated, often unbeknownst to the user” (Vu, at para. 42). They retain information that the user may think has been deleted (Vu, at para. 43). By seizing the computer, the police deprived Reeves of control over this highly private information, including the opportunity to delete it. They also obtained the means through which to access this information. Indeed, these are the reasons why the police seized the computer.

The Court acknowledged that control is a relevant consideration, and that the shared control over this computer meant that Reeves privacy interest was diminished, but nonetheless it was not extinguished.

Once they had reached that conclusion, it was relatively easy for the Court, relying on previous case law, to conclude that the seizure based only on the consent of Reeves’ spouse was a section 8 violation. To say that Reeves had to take the risk that his spouse, who also had a privacy interest in the computer, might give it to the police would be to substitute a risk analysis for the correct normative approach: as in R v Duarte or Marakah, the existence of such a risk does not mean the accused does not have a privacy interest to be protected. They noted in particular that to find otherwise might “disproportionately impact the privacy rights of low income individuals, who may be more likely to share a home computer” (para 44). Similarly, it is well-established that one person cannot waive another person’s Charter rights, and so to allow the spouse’s consent here to mean that Reeves’ rights were not infringed would be inconsistent with R v Cole.

The result was that the seizure of Reeves’ computer was an interference with his reasonable expectation of privacy for which no lawful authority existed, and therefore was a section 8 breach. More generally, the Court added what can be seen as an addendum to the longstanding general rule that a warrantless search is prima facie unreasonable:

[56] …because someone is always likely to have a reasonable expectation of privacy in a personal computer, the taking of a personal computer without a warrant and without valid consent will constitute a presumptively unreasonable seizure.

Conviction under the Motor Vehicle Act upheld

A judge of the Nova Scotia Supreme Court has determined, on an appeal of a distracted driving offence, that entering coordinates into a GPS unit is equivalent to “engaging in text messaging on a communication device.”

In R. v Anand, Mr. Anand was appealing a conviction that found he had violated the Motor Vehicle Act provisions that prohibit, while driving, “use[ing] a hand-held cellular telephone or engage[ing] in text messaging on any communications device.” Anand had been pulled over by a police officer who initially accused him of texting on an iPhone. The accused disputed that and said he was entering coordinates into this GPS unit. This was determined by the adjudicator to be an admission of guilt and he was convicted.

On appeal before Justice Gabriel, the questions to be determined by the court were whether the accused was “text messaging” when interacting with his GPS unit and whether the GPS unit is a “communications device”. To do this, the Court turned to principles of statutory interpretation and focused on the question of the mischief intended to be addresses.

In its analysis, the Court referred to another Nova Scotia case, R v Ikede, where the accused was speaking to the voice assistant on his smartphone. The Court in that case decided that the interpretation of ‘use’ ought to hinge on the evil that the Legislature aimed to address – that is, preventing drivers from using devices in manners that distract them from the task of driving. There, the use of the voice system did not require Ikede to take his eyes of the road. In R v MacDonald, the accused was looking at his phone to determine whether he had received a text – he was not calling or texting anyone. The Court found the term “use” in the statute included holding the device in anticipation of an incoming message as it would distract a person from keeping their eyes on the road. The Court also referred to , where the accused was using Google Maps on her phone, which was seen to be “use” on the basis that the legislation was intended to prevent distractions while driving.

Using a very purposive analysis, the Court determined that there is effectively very little difference between “messaging” within the scope of an interpersonal conversation and entering coordinates into a GPS system to get information from the system (both involve the input of information in the anticipation of the receipt of a response). Thus, entering information into the device is found to be “text messaging”.

The Court easily determined that the GPS is a “device”. For the determination of whether it is a “communication device”, the Court again did a functional analysis finding there is little difference between a conversation and the input of data into the device in the anticipation of a response from the device. A key factor for the Court was that data entry required Anand to take his eyes from the road while operating his vehicle. Because the GPS unit facilitates an exchange of information, the Court found it to be a “communication device” and that entering coordinates or an address qualifies as text messaging. As a result, the appeal was denied and the conviction under the Motor Vehicle Act was upheld.

With approximately 350 members from across Canada, the Canadian Technology Law Association has become the must join association for any lawyer practicing technology law in Canada. We offer substantive learning opportunities through our annual conferences and quarterly roundtables, as well as invaluable networking opportunities to our members. 

We strive to help our members stay current in this rapidly changing area of the law.