access to information Ambush Marketing big data citizen science confidential information copyright data protection ecommerce and internet law Electronic Commerce electronic commerce and internet law Extraterritoriality fair use freedom of expression Geospatial geospatial data intellectual property Internet internet law invasion of privacy IP open courts open data open government personal information Privacy proactive disclosure takings trademark law trademarks transparency
Thursday, 26 May 2016 09:48
What is the status of copyright protected documents or data sets that are provided to government institutions as part of regulatory, judicial or administrative processes? In my previous blog post I considered one instance where a court decided that a regulatory regime effectively expropriated the copyrights in works submitted to certain federal regulatory boards. In early May of this year, an Ontario court considered a similar issue: what happens to the copyright of land surveyors in the documents and drawings they prepare when these are submitted to Ontario’s electronic land registry system.
Keatley Survey Ltd. v. Teranet Inc was a class action law suit brought by a group of Ontario land surveyors against the private sector company authorized by the government to run its electronic land registry system – Teranet. Teranet recovers its costs of creating and operating the system by charging fees for access to and reproduction of the documents contained in the registry. The plaintiffs in this case argued that they had copyright in those documents, and that they were entitled to fees or royalties from the commercial use of these documents by Teranet.
It was undisputed by the defendants that there was copyright in the survey plans created by the plaintiffs. What was more contentious was the issue of ownership of that copyright. The defendants argued that copyright in the plans was owned by the Crown (in this case, the Ontario government). Under section 12 of the Copyright Act, Crown copyright subsists in works that are “prepared or published by or under the direction or control of Her Majesty or any government department. . . .”. The court rejected the argument that the plans were “prepared” under the control of government. Instead, Justice Belobaba ruled that the plans were produced independently of government by the surveyors at the requests of their clients. The fact that the plans might need to conform with regulatory requirements did not mean that they were prepared under the direction or control of the Crown. Justice Belobaba noted that if this argument were accepted, then “lawyers who file pleadings or facta at court registries would lose the copyright in their work simply because they complied with the statutory filing requirements about form or content.” (at para 33).
Teranet also argued that Crown copyright applied because the plans were “published” under the control of government. Justice Belobaba expressed doubts on this point, finding that the reference to publication in s. 12 of the Copyright Act did not independently create a basis for Crown copyright. He stated: “Just because the federal or provincial government publishes or directs the publication of someone else’s work (as opposed to governmental material) cannot mean that the government automatically gets the copyright in that work under s. 12 of the Copyright Act.” (at para 37) Nevertheless, he did not decide the matter on this point. Instead, he found that the legislation relating to the land registry system specifically establishes that any copyrights in surveys are automatically transferred to the Crown when they are filed.
Section 165(1) of the Land Titles Act and section 50(3) of the Registry Act both provide that “all plans of survey submitted for deposit or registration at a land registry office become “the property of the Crown”.” (at para 6). While this might simply refer to ownership of the physical property in the documents, Justice Belobaba found that other provisions in the statutes addressed the rights of the government to copy, computerize and distribute the documents, and to do so for a fee. He wrote: “The statutory prescription and authorization for copying the plans of survey strongly suggests a legislative intention that “property of the Crown” as used in these statutory provisions includes copyright.” (at para 7).
If copyright in these documents becomes the property of the Crown, how does this come about? The Copyright Act requires that any assignment of copyright must be in writing and signed by the owner of copyright. Justice Belobaba found that the declaration required of surveyors to certify that their plans are correct and in accordance with the legislation did not amount to an assignment of copyright. This is an interesting point. Ultimately, the court finds that copyright is “transferred to the province” when plans are deposited, but that there is no signed assignment in writing. This must, therefore, be a form of regulatory expropriation of the copyright in the surveys and plans. Here, any such expropriation is implicit, not explicit. Since copyright is a matter of federal jurisdiction, it is fair to ask whether a provincial government’s expropriation of copyrights is an improper interference with federal jurisdiction over copyrights. Certainly, a provincial government might require an assignment of copyright as a condition of the filing of documents; what is less clear is whether it can actually override the Copyright Act’s provision which requires assignments to be signed and in writing. There is an interesting jurisdictional question below the surface here.
Because the court concludes that the plaintiffs did not retain copyright in their surveys or plans, there was no need to consider other interesting issues in the case relating to fair dealing or whether there was a public policy exception permitting copying and distribution of the documents.
This decision combined that that in Geophysical Services Inc., strongly suggests that courts in Canada are open to arguments around the regulatory expropriation of copyrights by governments in the public interest. In both cases, the courts found support for the expropriation in legislation, although in neither case was it clear on the face of the legislation that expropriation of copyrights was specifically contemplated. As digital dissemination of information, public-private partnerships, and new forms of commercialization of data may impact the commercial value of information submitted to governments by private actors, governments may need to be more explicit as to the intended effects of their regulatory schemes on copyrights.
Monday, 16 May 2016 07:37
Can a government cut short the term of copyright protection in the public interest through a regulatory scheme? This question was considered in the recent decision in Geophysical Services Inc. v. Encana. In my previous blog post I discussed the part of the decision that dealt with whether the works at issue in the case were capable of copyright protection. In this post, I consider the regulatory expropriation issues.
Geophysical Services Inc (GSI) had argued that the government had violated its copyright in its compilations of seismic data and in its information products based on this data, when it released them to the public following a relatively short confidentiality period. The data had been submitted as part of a regulatory process relating to offshore oil and gas exploration. GSI also argued that the oil and gas companies which then used this data in their operations, without paying license fees, also violated their copyright. As discussed in my previous post, Justice Eidsvik of the Alberta Court of Queen’s Bench found that both the compilation of data and the related analytics were original works and were the product of human authorship.
The infringement issue, however, did not end with a finding of copyright in the plaintiff’s works. The outcome of the case turned on whether the government was entitled to release the information after the end of the 5-15 year confidentiality period established by the regulatory regime – and, by extension – whether anyone was then free to use this material without need for permission. The normal term of copyright protection for such a work would be for the life of the author plus an additional 50 years.
GSI was engaged in geological surveying, using seismic testing to create charts of the ocean floor. In order to engage in this activity it needed a permit from the relevant provincial and federal authorities: the National Energy Board, the Canada Newfoundland and Labrador Offshore Petroleum Board and/or the Canada Nova Scotia Offshore Petroleum Board. It was also required, as part of the regulatory process to submit its data to the relevant Boards. The process of mapping the ocean floor using seismic testing is time and resource intensive, and requires considerable human expertise. Once it was collected and compiled, GSI would license its data to offshore oil and gas exploration companies who relied upon the quality and accuracy of the GSI product to carry out their activities.
According to the regulatory regime any data or information submitted to a Board must be kept confidential by the Board for a specified period. Disclosure is governed by the Canada Petroleum Resources Act (CPRA). Section 101 of the CPRA provides that documentation submitted as part of the regulatory process is privileged and shall not be disclosed except for purposes related to the regulatory regime. In the case of data or information related to geophysical work, the period of privilege is 5 years. It was agreed by the parties that this meant that the data could not be disclosed without consent for at least 5 years. However, the plaintiff argued that its copyright in the materials meant that even if the privilege expired, the plaintiff’s copyrights would prevent the publication of its information without its consent.
In reviewing the legislative history, Justice Eidsvik concluded that it was the government’s clear intention to stimulate oil and gas exploration by ensuring that exploration companies could get access to the relevant seismic data after a relatively short period of privilege. The proprietary rights of GSI (and other such companies) could be asserted within the privilege period. According to the legislative history, this period was set as the amount of time reasonable to permit such companies to recoup their investment by charging licence fees before the data was made public. Justice Eidsvik found a clear intention on the part of the legislature to limit the copyright protection available in the public interest. The 5-year privilege period was designed to balance the rights of the copyright holder with the broader public interest in oil and gas exploration. She also found that the publication of the data was a form of compulsory licence – oil and gas exploration companies were free to make use of this data once it was released by the Boards. Essentially, therefore, the legislative regime provided for an expropriation – without compensation – of the remainder of the term of copyright protection. According to Justice Eidsvik, the inclusion of a no-compensation clause in the statute “acknowledges Parliament’s intent to confiscate private property in return for a policy it believed to be in the public interest to promote early exploration of its resources in the offshore and frontier lands.” (at para 237)
GSI argued that changes in technology combined with the high cost of collecting and processing the data had disrupted any balance that might have been contemplated in setting the original 5-year privilege period. In fact, although the legislation allows for the publication of the data after 5 years, the practice of the Boards has been to delay the release of the data anywhere up to 15 years. However, GSI still maintained that the balance was no longer fair or appropriate. Justice Eidsvik was clearly sympathetic to GSI’s arguments, but she found that as a matter of statutory interpretation the legislation was clear in its effect. She noted that it would be for Parliament to change the legislation if it needs to be adapted to changing circumstances.
The issues raised by this case are interesting. Copyright law already contains many provisions that aim to balance the public interest against the rights of the copyright holder. Fair dealing is just one example of these. In fact, the term of protection (currently life of the author plus 50 years) is another one of these balancing mechanisms. What the court recognizes in Geophysical Services Inc. v. Encana is that other federal legislation can limit the term of copyright protection in order to advance a specific public interest.
This is not the only circumstance in which copyright may be limited by laws other than the Copyright Act. Another case which has recently been settled without being resolved on the merits (Waldman v. Thompson Reuteurs Canada Ltd.—discussed in my blog post here) raised the issue of whether the open courts principle effectively creates an implied public licence to use any materials submitted to the courts as part of court proceedings. This would include documents authored by lawyers such as statements of claim, factums, and other such documents. In Waldman, these materials had been taken from court records and included in a pay-per-use database by a legal publisher.
There are other contexts in which materials are submitted to regulators and later made public as part of that process. (Consider, for example, patent disclosures under the Patent Act). The legislation in such cases may not be as explicit as the CPRA – Justice Eidsvik found this statute to be very clear in its intent to make this data open and available for reuse after the statutory confidentiality period. In particular, she cited from the parliamentary debates leading up to its enactment in which disclosure in the interest of stimulating oil and gas exploration was explicitly contemplated.
One question going forward is in what circumstances and to what extent do legislated requirements to disclose data or documents terminate copyright protection in these materials. Another interesting issue is whether a provincial government could establish a regulatory regime that effectively brings to an end the term of copyright protection (since copyright falls within federal jurisdiction). In an environment where intellectual property rights are increasingly fiercely guarded, Parliament (and the legislatures?) may need to be more explicit about their intentions to cut short IP rights in the public interest.
Wednesday, 11 May 2016 08:04
A Canadian court has just handed down a decision in a case that interweaves interesting issues about copyright in data with issues around how the government can limit the scope of these rights in its view of the public interest. The case is complex – it involves a large number of defendants and is tied to a range of other law suits relating to the regulatory regime for oil and gas exploration in Canada. The complexity of the case is such that I will divide my analysis over two blog posts. This – the first – will address the issues around whether there is copyright in the data submitted to the regulator; the second blog post will deal with the issues relating to the curtailment of the copyright within the context of the regulatory regime.
The plaintiff in this case and in the mass of related litigation is Geophysical Service Inc. (GSI). GSI is a Canadian company that is in the business of carrying out marine seismic surveys and licensing the data that it collected and a compiled as a result of its activities. It claims that its flood of litigation around the copyright and regulatory regime issues resulted from the fact that the government’s approach is driving it out of business. As copyright is often touted as providing incentives to create and innovate, GSI’s precarious status as an innovator in this area sets an interesting context for the issues raised in the litigation.
In a nutshell, GSI – like other companies in this field – had to obtain a licence from the national regulator to conduct its expensive, time and labour intensive work. A condition of the licence was that the data it generated and processed into information products would be submitted to the appropriate regulatory bodies that oversee offshore oil and gas exploration. It is this data and the related information products that GSI claims is protected by copyright law. Under the statutes governing the regulatory process, data submitted to the regulator can be made public after a 5 year period. GSI was in the business of selling its data and information products to companies engaged in oil and gas exploration. GSI argued that the fact that the same data and analysis could be released to the public after 5 years, and was, as a matter of policy released between 5 and 15 years after its submission made its business ultimately unsustainable. They argued, therefore, that they had copyright in the data they collected and in the analytics they carried out on the data. They then argued that the regulator, by releasing this data to the public before the expiration of the copyright term, infringed its copyrights. They also maintained that the other private sector companies which made use of their data obtained from the public sources, violated their copyrights.
The first issue, therefore, was whether the seismic data and related information products produced by GSI amounted to original works that could be protected by copyright law. It is a basic principle of copyright law that there can be no copyright in facts – facts are in the public domain. At the same time, however, it is possible to have copyright in a compilation of facts – so long as that compilation meets the requirements of originality. According to the Supreme Court of Canada in CCH Canadian v. Law Society of Upper Canada, originality requires that a work: a) is not copied; b) reflects an exercise in skill and judgment and 3) can be attributed to a human author. In this case, the defendants argued that the GSI data was ‘copied’ from the environment (i.e. it was factual material not protected by copyright law); that its collection and compilation did not involve sufficient skill and judgment because it was in part automated, and in part collected and compiled according to industry standards; and that the technology-assisted and highly human- and other resource-intensive process involved in its collection and compilation meant that it did not originate from an identifiable human author.
Justice Eidsvik of the Alberta Court of Queen’s Bench found resoundingly for the plaintiffs on the copyright issues. She carefully considered the manner in which the seismic data was both collected and processed. She found that both the raw data and the processed data constituted “works” within the meaning of the Copyright Act. She analogized the raw seismic data to a literary work or a literary compilation. She also found that some of the seismic sections – data represented as squiggly lines – would fall within the definition of an artistic work. Both “works” in this case met the necessary threshold for originality. She noted that the creation and compilation of the seismic data required significant levels of skill, noting that “The data is created, not merely collected, through the intervention of human skill” (at para 79). The collection of this seismic data requires a complex series of choices. She accepted the analogy that it was like taking a photograph. Justice Eidsvik observed:
In this case, the photograph is not just a quick snapshot; rather, it is one that requires careful selection of the location, angle of technological instruments (e.g. the size and depth of the airguns, the length and depth of the streamers, and the number and placement of hydrophones), and finally the filtering and refining of the product. (at para 80)
She also found apt an analogy from one of the expert witnesses between the creation of the data and the conducting of a symphony, where the conductor “ensures that some instruments are played louder, or softer, or faster or slower, to make a beautiful creation. The same types of decisions are made on board the seismic acquisition ship to obtain “beautiful” raw seismic data.” (at para 81)
Having found copyright in the compilation of raw data, it is not surprising that the judge also found copyright in the processed data as well. She found that substantial skill and judgment went into the processing of the data, stating that “The raw data is not simply pumped into a computer and a useful product comes out.” (at para 83) She found that the quality of the processed data is very much dependent upon the participation of a skilled processor, and that different companies would produce different processed data from the raw data depending upon the skill of the processor involved.
Justice Eidsvik also found that the requisite human author was present. In doing so, she addressed the Telstra decision from the Australian High Court which had found no copyright in a telephone director in part because it was created following a largely automated process in which there was relatively little human input. In this case, she found the human input to be a significant factor in determining the quality of the output at both the stage of acquisition of the data and the processing stage. She reviewed the few Canadian cases involving compilations of data, noting that in cases where human input is more significant in terms of the choices made in arranging the facts, the courts accept that the compilation is original.
Justice Eidsvik rejected the argument that it is necessary to identify a specific human author in order to find copyright in a complex factual work. She accepted that a team of “authors” could create a factual compilation. Nevertheless, she was also prepared to identify in this case the head of the seismic crew on the ship as the author of the raw data and the person in charge of the computing as the author of the processed data. She noted as well that in this case the actual owner of the copyright would be the employer of both of these individuals – GSI.
In finding copyright in both the raw and the processed data, Justice Eidsvik was careful to note that she was not deviating from the principle that there could be no copyright in facts or ideas. She found that the “seismic data is an expression of GSI’s views of what the image of the subsurface of the surveyed areas represents.” (at para 97). The raw facts – the features of the subsurface – are there for anyone to see and are in the public domain – but the data collected about those facts is authored. Critical data theorists will recognize in here the seeds of the essential subjectivity of collected data, where choices are made as to how to collect the data, and according to what parameters.
Justice Eidsvik also rejected the idea that the works at issue lacked originality because their collection and compilation were dictated by “practical considerations, utility or externally imposed requirements.” (at para 105) Notwithstanding the presence of industry standards that would influence some of the decision-making involved in the collection and processing of the data, she found that “the original skill and judgment that comes to bear on the final product of the seismic work far outweighs the portion of “hard wired” industry standards in play.” (at para 105)
Based on the facts of this case it is not surprising that Justice Eidsvik would conclude that there was copyright in both the compilation of seismic data and in the processed data. Her extensive review of the process by which the data is first collected and then processed reveals a substantial amount of skill and judgment. In a “datified” society, the decision may give some comfort to those who collect and process all manner of data: their products – whether compilations of raw data or processed data (analytics) – are works that can be protected under copyright law. Such protection will be dependent upon an ability to show that the collection and/or processing involve choices motivated by skill and judgment, rather than mechanical decision-making or compliance with industry norms or standards.
While for GSI it was a victory to have copyright confirmed in its data products, the victory was largely pyrrhic. The second part of the decision – and the part that I will consider in a subsequent blog post – deals with the regulatory regime which the court ultimately finds to have effectively expropriated this copyright interest. Stay tuned!
Monday, 25 April 2016 07:06
A recent news story from the Ottawa area raises interesting questions about big data, smart cities, and citizen engagement. The CBC reported that Ottawa and Gatineau have contracted with Strava, a private sector company to purchase data on cycling activity in their municipal boundaries. Strava makes a fitness app that can be downloaded for free onto a smart phone or other GPS-enabled device. The app uses the device’s GPS capabilities to gather data about the users’ routes travelled. Users then upload their data to Strava to view the data about their activities. Interested municipalities can contract with Strava Metro for aggregate de-identified data regarding users’ cycling patterns over a period of time (Ottawa and Gatineau have apparently contracted for 2 years’ worth of data). According to the news story, their goal is to use this data in planning for more bike-friendly cities.
On the face of it, this sounds like an interesting idea with a good objective in mind. And arguably, while the cities might create their own cycling apps to gather similar data, it might be cheaper in the end for them to contract for the Strava data rather than to design and then promote the use of theirs own apps. But before cities jump on board with such projects, there are a number of issues that need to be taken into account.
One of the most important issues, of course, is the quality of the data that will be provided to the city, and its suitability for planning purposes. The data sold to the city will only be gathered from those cyclists who carry GPS-enabled devices, and who use the Strava app. This raises the question of whether some cyclists – those, for example, who use bikes to get around to work, school or to run errands and who aren’t interested in fitness apps – will not be included in planning exercises aimed at determining where to add bike paths or bike lanes. Is the data most likely to come from spandex-wearing, affluent, hard core recreational cyclists than from other members of the cycling community? The cycling advocacy group Citizens for Safe Cycling in Ottawa is encouraging the public to use the app to help the data-gathering exercise. Interestingly, this group acknowledges that the typical Strava user is not necessarily representative of the average Ottawa cyclist. This is in part why they are encouraging a broader public use of the app. They express the view that some data is better than no data. Nevertheless, it is fair to ask whether this is an appropriate data set to use in urban planning. What other data will be needed to correct for its incompleteness, and are there plans in place to gather this data? What will the city really know about who is using the app and who is not? The purchased data will be deidentified and aggregated. Will the city have any idea of the demographic it represents? Still on the issue of data quality, it should be noted that some Strava users make use of the apps’ features to ride routes that create amusing map pictures (just Google “strava funny routes” to see some examples). How much of the city’s data will reflect this playful spirit rather than actual data about real riding routes is a question also worth asking.
Another important issue – and this is a big one in the emerging smart cities context – relates to data ownership. Because the data is collected by Strava and then sold to the cities for use in their planning activities, it is not the cities’ own data. The CBC report makes it clear that the contract between Strava and its urban clients leaves ownership of the data in Strava’s hands. As a result, this data on cycling patterns in Ottawa cannot be made available as open data, nor can it be otherwise published or shared. It will also not be possible to obtain the data through an access to information request. This will surely reduce the transparency of planning decisions made in relation to cycling.
Smart cities and big data analytics are very hot right now, and we can expect to see all manner of public-private collaborations in the gathering and analysis of data about urban life. Much of this data may come from citizen-sensors as is the case with the Strava data. As citizens opt or are co-opted into providing the data that fuels analytics, there are many important legal, ethical and public policy questions which need to be asked.
Published in Geospatial Data/Digital Cartography
Monday, 04 April 2016 11:34
The Federal Court has released a decision in a case that raises important issues about transparency and accountability under Canada’s private sector privacy legislation.
The Personal Information Protection and Electronic Documents Act (PIPEDA) governs privacy with respect to the collection, use and disclosure of personal information by private sector organizations. Under PIPEDA, individuals have the right to access their personal information in the hands of private sector organizations. The right of access allows individuals to see what information organizations have collected about them. It is accompanied by a right to have incorrect information rectified. In our datified society, organizations make more and more decisions about individuals based upon often complex profiles built with personal information from a broad range of sources. The right of access allows individuals to see whether organizations have exceeded the limits of the law in collecting and retaining personal information; it also allows them the opportunity to correct errors that might adversely impact decision-making about them. Unfortunately, our datified society also makes organizations much more likely to insist that the data and algorithms used to make decisions or generate profiles, along with the profiles themselves, are all confidential business information and thus exempt from the right of access. This is precisely what is at issue in Bertucci v. Royal Bank of Canada.
The dispute in this case arose after the Bertuccis – a father and son who had banked with RBC for 35 and 20 years respectively, and who also held business accounts with the bank – were told by RBC that the bank would be closing their accounts. The reason given for the account closure was that the bank was no longer comfortable doing business with them. Shortly after this, the Bertuccis made a request, consistent with their right of access under PIPEDA, to be provided with all of their personal information in the hands of RBC, including information as to why their bank accounts were closed. RBC promptly denied the request, stating that it had already provided its reason for closing the accounts and asserting that it had a right under its customer contracts to unilaterally close accounts without notice. It also indicated that it had received no personal information from third parties about the Bertuccis and that all of the information that they sought was confidential commercial information.
RBC relied upon paragraph 9(3)(b) of PIPEDA, which essentially allows an organization to refuse to provide access to personal information where “to do so would reveal confidential commercial information”. On receiving RBC’s refusal to provide access, the Bertuccis complained to the Office of the Privacy Commissioner. The OPC investigated the complaint and ultimately sided with RBC, finding that it was justified in withholding the information. In reaching this conclusion, the OPCC relied in part on an earlier Finding of the Privacy Commissioner which I have previously critiqued, precisely because of its potential implications for transparency and accountability in the evolving big data context.
In reaching it conclusion on the application of paragraph 9(3)(b) of PIPEDA, the OPC apparently accepted that the information at issue was confidential business information, noting that it was “treated as confidential by RBC, including information about the bank’s internal methods for assessing business-related risks.” (At para 10)
After having their complaint declared unfounded by the OPC, the applicants took the issue to the Federal Court. Justice Martineau framed the key question before the court in these terms: “Can RBC refuse to provide access to undisclosed personal information it has collected about the applicants on the grounds that its disclosure in this case would reveal confidential commercial information” (at para 16)
RBC’s position was that it was not required to justify why it might close an account. It argued that if it is forced to disclose personal information about a decision to close an account, then it is effectively stripped of its prerogative to not provide reasons. It also argued that any information that it relied upon in its risk assessment process would constitute confidential business information. This would be so even if the information were publicly available (as in the case of a newspaper article about the account holder). The fact that the newspaper article was relied upon in decision-making would be what constituted confidential information – providing access to that article would de facto disclose that information.
The argument put forward by RBC is similar to the one accepted by the OPC in its earlier (2002) decision which was relied upon by the bank and which I have previously criticized here. It is an argument that, if accepted, would bode very ill for the right of access to personal information in our big data environment. Information may be compiled from all manner of sources and used to create profiles that are relied upon in decision-making. To simply accept that information used in this way is confidential business information because it might reveal how the company reaches decisions slams shut the door on the right of access and renders corporate decision-making about individuals, based upon the vast stores of collected personal information, essentially non-transparent.
The Bertuccis argued that PIPEDA – which the courts have previously found to have a quasi-constitutional status in protecting individual privacy – makes the right of access to one’s personal information the rule. An exception to this rule would have to be construed narrowly. The applicants wanted to know what information led to the closure of their accounts and sought as well to exercise their right to have this information corrected if it was inaccurate. They were concerned that the maintenance on file of inaccurate information by RBC might continue to haunt them in the future. They also argued that RBC’s approach created a two-tiered system for access to personal information. Information that could be accessed by customers whose accounts were not terminated would suddenly become confidential information once those accounts were closed, simply because it was used in making that decision. They argued that the bank should not be allowed to use exceptions to the access requirement to shelter itself from embarrassment at having been found to have relied upon faulty or inadequate information.
Given how readily the OPC – the guardian of Canadians’ personal information in the hands of private sector organizations – accepted RBC’s characterization of this information as confidential, Justice Martineau’s decision is encouraging. He largely agreed with the position of the applicants, finding that the exceptions to the right to access to one’s personal information must be construed narrowly. Significantly, Justice Martineau found that courts cannot simply defer to a bank’s assertion that certain information is confidential commercial information. He placed an onus on RBC to justify why each withheld document was considered confidential. He noted that in some circumstances it will be possible to redact portions of reports, documents or data that are confidential while still providing access to the remainder of the information. In this case, Justice Martineau was not satisfied that the withheld information met the standard for confidential commercial information, nor was he convinced that some of it could not have been provided in redacted form.
Reviewing the documents at issue, Justice Martineau began by finding that a list of the documents relied upon by the bank in reaching its decision was not confidential information, subject to certain redactions. He noted as well that much of what was being withheld by the bank was “raw data”. He distinguished the raw data from the credit scoring model that was found to be confidential information in the 2002 OPC Finding mentioned above. He noted as well that the raw data was not confidential information and had not, when it was created, been treated as confidential information by the bank. He also noted that the standard for withholding information on an access request was very high.
Justice Martineau gave RBC 45 days to provide the applicants with all but a few of the documents which the court agreed could be withheld as confidential commercial information. Although the applicants had sought compensatory and punitive damages, he found that it was not an appropriate case in which to award damages.
Given the importance of this decision in the much broader big data and business information context, RBC is likely to appeal it to the Federal Court of Appeal. If so, it will certainly be an important case to watch. The issues it raises are crucial to the future of transparency and accountability of corporations with respect to their use of personal information. In light of the unwillingness of the OPC to stand up to the bank both in this case and in earlier cases regarding assertions of confidential commercial information, Justice Martineau’s approach is encouraging. There is a great deal at stake here, and this case will be well worth watching if it is appealed.
Tuesday, 15 March 2016 11:01
The department formerly known as Industry Canada (now Innovation, Science and Economic Development or ISED) has just released a discussion paper that seeks public input on the regulations that will accompany the new data breach notification requirements in the Personal Information Protection and Electronic Documents Act (PIPEDA).
The need to require private sector organizations in Canada to report data breaches was first formally identified in the initial review of PIPEDA carried out in 2007. The amendments to the statute were finally passed into law in June of 2015, but they will not take effect until regulations are enacted that provide additional structure to the notification requirements. The discussion paper seeks public input prior to drafting and publishing regulations for comment and feedback, so please stop holding your breath. It will still take a while before mandatory data breach notification requirements are in place in Canada.
The new amendments to the legislation make it mandatory for organizations to report data breaches to the Privacy Commissioner if those breaches pose “a real risk of significant harm to an individual”. (s. 10.1) An organization must also notify any individuals for whom the breach poses “a real risk of significant harm (s. 10.1(3). The form and contents of these notifications remain to be established by the regulations. A new s. 10.2 of PIPEDA will also require an organization that has suffered a reportable breach to notify any other organization or government institution of the breach if doing so may reduce the risk of harm. For example, such notifications might include ones to credit reporting agencies or law enforcement officials. The circumstances which trigger this secondary notification obligation remain to be fleshed out in the regulations. Finally, a new s. 10.3 of PIPEDA will require organizations to keep records of all data breaches not just those that reach the threshold for reporting to the Privacy Commissioner. In theory these records might enable organizations to detect flaws in their security practices. They may also be requested by the Commissioner, providing potential for oversight of data security at organizations. The content of these records remains to be determined by the new regulations.
From the above, it is clear that the regulations that will support these statutory data breach reporting requirements are fundamentally important in setting its parameters. The ISED discussion paper articulates a series of questions relating to the content of the regulations on which it seeks public input. The questions relate to how to determine when there is a “real risk of significant harm to an individual”; the form and content of the notification that is provided to the Commissioner by an organization that has experienced a breach; the form, manner and content of notification provided to individuals; the circumstances in which an organization that has experienced a breach must notify other organizations; and the form and content or records kept by organizations, as well as the period of time that these records must be retained.
There is certain that ISED will receive many submissions from organizations that are understandably concerned about the impact that these regulations may have on their operations and legal obligations. Consumer and public interest advocacy groups will undoubtedly make submissions from a consumer perspective. Individuals are also welcome contribute to the discussion. Some questions are particularly relevant to how individuals will experience data breach notification. For example, if an organization experiences a breach that affects your personal information and that poses a real risk of harm, how would you like to receive your notification? By telephone? By mail? By email? And what information would you like to receive in the notification? What level of detail about the breach would you like to have? Do you want to be notified of measures you can take to protect yourself? Do you want to know what steps the organization has taken and will take to protect you?
Monday, 14 March 2016 07:53
Technology has enabled the collection and sharing of personal information on a massive scale, and governments have been almost as quick as the private sector to hoover up as much of it as they can. They have also been as fallible as the private sector – Canada’s federal government, for example, has a substantial number of data breaches in the last few years.
What has not kept pace with technology has been the legislation in place to protect privacy. Canada’s federal Privacy Act, arguably a ground-breaking piece of legislation when it was first enacted in 1983, has remained relatively untouched throughout decades of dramatic technological change. Despite repeated calls for its reform, the federal government has been largely unwilling to update this statute that places limits on its collection, use and disclosure of personal information. This may be changing with the new government’s apparent openness to tackling the reform of both this statute and the equally antiquated Access to Information Act. This is good news for Canadians, as each of these statutes has an important role to play in holding a transparent government accountable for its activities.
On March 10, 2016 Federal Privacy Commissioner Daniel Therrien appeared before the Standing Committee on Access to Information, Privacy and Ethics, which is considering Privacy Act reform. The Commissioner’s statement identified some key gaps in the statute and set out his wish list of reforms.
As the Commissioner pointed out, technological changes have made it easier for government agencies and departments to share personal information – and they do so on what he describes as a “massive” scale. The Privacy Act currently has little to offer to address these practices. Commissioner Therrien is seeking amendments that would require information sharing within the government to take place according to written agreements in a prescribed form. Not only would this ensure that information sharing is compliant with legal obligations to protect privacy, it would offer a measure of transparency to a public that has a right to know whether and in what circumstances information they provide to one agency or department will be shared with another.
The Commissioner is also recommending that government institutions be explicitly required under the law to safeguard the personal information in their custody, and to report data breaches to the Office of the Privacy Commissioner. It may come as a surprise to many Canadians that such a requirement is not already in the statute – its absence is a marker of how outdated the law has become. Since 2014, the Treasury Board of Canada, in its Directive on Privacy Practices has imposed mandatory breach reporting for all federal government institutions, but this is not a legislated requirement, nor is there recourse to the courts for non-compliance.
The Commissioner is also seeking more tools in his enforcement toolbox. Under the Privacy Act as it currently stands, the Commissioner may make recommendations to government institutions regarding their handling of personal information. These recommendations may then be ignored. While he notes that “in the vast majority of cases, government departments do eventually agree to implement our recommendations”, it is clear that this can be a long, drawn out process with mixed results. Currently, the only matters that can be taken to court for enforcement are denials by institutions to provide individuals with access to their personal information. The Commissioner is not seeking the power to directly compel institutions to comply with its recommendations; rather, he recommends that an institution that receives recommendations from the Office of the Privacy Commissioner have two choices. They may implement the recommendations or they may go to court for a declaration that they do not need to comply. On this model, relatively prompt compliance would presumably become the default.
The Commissioner is also seeking an amendment that would require government institutions to conduct privacy impact assessments before the launch of a new program or where existing programs are substantially modified. Again, you would think this would be standard practice by now. It does happen, but the Commissioner diplomatically describes current PIAs as being “sometimes uneven” in both their quality and timeliness. The Commissioner would also like to see a legislated requirement that government bills that will have an impact on privacy be sent to the OPC for review before being tabled in Parliament.
The Commissioner seeks additional amendments to improve transparency in relation to the government’s handling of personal information. Currently, the Commissioner files an annual report to Parliament. He may also issue special reports. The Commissioner recommends that he be empowered under the legislation “to report proactively on the practices of government”. He also recommends extending the Privacy Act to all government institutions. Some are currently excluded, including the Prime Minister’s Office and the offices of Ministers. He also recommends allowing all individuals whose personal information is in the hands of a federal government institution to have a right of access to that information (subject, of course, to the usual exceptions). Currently on Canadian citizens and those present in Canada have access rights.
This suite of recommendations is so reasonable that most Canadians would be forgiven for assuming these measures were already in place. Given the new government’s pre- and post-election commitments to greater transparency and accountability, there may be reason to hope we will finally see the long-overdue reform of the Privacy Act.
Monday, 07 March 2016 09:08
The Fédération Étudiante Collégiale du Québec has succeeded in its opposition to a Quebec entrepreneur’s attempt to register its symbol of protest, the carré rouge (which means “red square”), as a trademark for use in association with T-shirts, posters, cups, wristbands, and other paraphernalia. While this decision offers some protection from the appropriation and commercialization of a protest symbol, it also reveals the limits of such protection.
The carré rouge – essentially a small square of red fabric attached to clothing by a gold safety pin – was adopted by the Fédération in January of 2011 as a symbol of a massive strike that was about to be launched to protest proposed tuition fee hikes in Quebec. Members of the Fédération – which included over 65,000 students – were encouraged to wear the symbol on their clothing and to participate in the series of organized rallies and protests across the province. The student demonstrations received a great deal of media attention and the carré rouge quickly became a public symbol associated with the student unrest.
Very shortly after the last of the major demonstrations in 2012, Raymond Drapeau sought to register as a trademark a design consisting of a red square with a gold pin. The Fédération opposed this registration. While they had clearly been the first to adopt and use the carré rouge as a symbol, they had not used it as a trademark – in other words, they had not used it to distinguish their goods or services from those of others. Absent a prior commercial use, they could not rely on grounds of opposition based upon their greater entitlement to the registration of the mark. This was confirmed by the Trade-marks Opposition Board (TMOB) in its December decision.
The Fédération was, however, successful with its argument that the carré rouge could not be distinctive of Drapeau’s goods because the public would associate the symbol with the Fédération and its protests, and not with Drapeau. The quintessential characteristic of a trademark is its capacity to distinguish its owner as the source of the goods or services in association with which it is used. This quality is referred to as distinctiveness. The TMOB found that the size of the student protests and the degree of media coverage was such that the symbol would be associated with the Fédération’s protest movement. It was therefore not capable of distinguishing Drapeau as a trade source. The application for trademark registration was therefore refused.
The Fédération’s victory is an important one, but it is not one that should allow activist or protest groups to feel complacent. It is important because the TMOB was prepared to recognize the link between a protest group and its symbol as being of a kind that can make the symbol difficult for others to appropriate for commercial purposes. However, the decision of the TMOB merely denies registration of the mark. It does not prevent Drapeau (or others) from using the symbol as an unregistered trademark. Use in this way might actually lead to acquired distinctiveness; which could, in turn, be a basis for eventual trademark registration. Indeed, the TMOB observed that “substantial evidence of use of the Mark by the Applicant might possibly have supported an argument that the Mark had become distinctive as of the relevant date.” (at para 40). It also noted that “a symbol can be a trade-mark if it can serve to identify the source of the goods and services associated with it.” (at para 43)
A protest movement that wishes to acquire the kind of goodwill in its mark or symbol that will give rise to its own trademark rights will need to use the mark in association with goods or services. This type of commercial use might well go against the movement’s ideology – and might, in any event, be too complicated within the context of a spontaneous movement; particularly one that gathers more momentum than initially anticipated at the outset. Copyright law offers a possible source of protection: an original design can be protected by copyright law – and it is possible to oppose the registration of a trademark that would infringe the copyright of another. But the carré rouge as used by the students is not a “work” in which copyright subsisted. In this case, the simplicity of the symbol, while contributing to its uptake and use, undermined its capacity to be “owned” by the Fédération and in turn controlled by it. Of course, the whole concept of private ownership of public symbols runs against the spirit of the protests, and the Fédération maintained throughout that the carré rouge was in the public domain and thus not capable of private ownership. They were successful on the facts as they stood, but the TMOB decision reminds us that even symbols in the so-called public domain may be appropriated in certain circumstances.
Tuesday, 23 February 2016 10:46
I was at the United Nations last week for an Expert Group Meeting on Moving from commitments to results in building effective, accountable and inclusive institutions at all levels. On February 18, 2016, I gave a presentation on balancing privacy with transparency in open government. This is a challenging issue, and one that is made even more so by digitization, information communication technologies and the big data environment.
Openness access to government information and data serve the goals of greater transparency and greater public trust in government. They are essential in fighting corruption, but they are also important in holding governments to account for their decision-making and for their spending of public funds. However, transparency must also be balanced against other considerations, including privacy. Privacy is a human right, and it protects the dignity, autonomy and integrity of individuals. Beyond this, however, the protection of privacy of personal information in the hands of governments also enhances public trust in governments and can contribute to citizen engagement.
How, then, does one balance privacy with transparency when it comes to information in the hands of government? There are no easy answers. My slides from my presentation can be found here, and these slides contain some links to some other publicly available work on this topic.
Tuesday, 09 February 2016 10:19
Carleton University’s Mary Francoli has just released her second report on Canada’s progress towards its Open Government commitments as part of its membership in the Open Government Partnership. The report is currently open for public comment.
The report offers a detailed and thorough assessment of the commitments made by the Canadian government in its second Action Plan on Open Government and the extent to which these commitments have been met. For those interested in open government, it makes interesting reading, and it also sets out a number of recommendations for moving the open government agenda forward in Canada.
Because the report is a review of Canada’s progress on meeting its commitments, it is shaped by those commitments rather than by, for example, a list of open government priorities as identified by multiple stakeholders. Indeed, problems with stakeholder consultation and engagement are themes that run through this report. Although Francoli notes that there have been improvements over time, there is clearly still work to be done in this regard.
Francoli’s detailed review shows that progress has certainly been made in moving forward the open government agenda. She notes that “significant progress” has been made with respect to many of the government’s commitments in the second Action Plan, and that in some cases the government’s progress has exceed its commitments. Not surprisingly, however, much remains to be done. Francoli identifies a number of shortcomings flagged by stakeholders that form the basis for her recommendations.
Foremost among the shortcomings is the woeful state of Canada’s Access to Information Act. Although this legislation has been the subject of criticism and calls for reform for decades – and by a broad range of stakeholders – the previous government remained impervious to these demands. That an open government agenda could be advanced with much fanfare without tackling access to information in any substantive way should undermine confidence in Canada’s commitment to open government. Top among Francoli’s recommendations, therefore, is reform of the legislation, and she has written a separate opinion piece on this topic in the Hill Times. In this article she notes with frustration that although the new Liberal government expressed a commitment to reform the access to information regime in its election platform, that commitment is now being expressed in terms of a “review” of the legislation. Francoli justifiably questions whether we really need further review given the many studies already conducted and the ink already spilled about the deficiencies in the legislation. A commitment to meaningful reform might just require swifter action.
Other issues flagged by Francoli include what she refers to as a “data deficit” – the apparent stalling of progress in the release of open data and the lack of diversity in the available data at the federal level. The concerns over a data deficit extend to the cancellation of government-led data collection; the axing of the long-form census being perhaps the most notorious (though not the only) example of this. Although the census has been revived, Francoli notes that other cancelled studies have not. Further, Francoli cautions that the government’s web renewal strategy is having the effect of pushing departments and agencies to reduce digital content available over the web, with the resultant loss of content available to the public. This latter concern ties in as well to Francoli’s recommendation that the government develop and publicize a clear policy on the preservation of digital material.
In addition to recommendations related to these issues, Francoli also recommends that the government overhaul the Advisory Panel on Open Government. This Panel (on which I served) met only very rarely, and opportunities to provide feedback became very limited by tight time constraints imposed on the few meetings that did take place. Francoli is concerned about a disjunction between stakeholders’ perspectives on open government and those of the government, and she sees an Advisory Panel with a new mandate and a new mode of operation as being one way to ensure more open lines of communication.
There may be a common misperception that open data and proactive disclosure are inexpensive and resource-light endeavors (after all, the government is just publishing online information already gathered, right?). Yet, this is far from the case. Open data in particular is resource-intensive, and Francoli notes that the two Action Plans had identified no additional resources for open government (apart from the $3 million dollars set aside for the mysterious Open Data Exchange (ODX)). She therefore also recommends that the government commit the necessary resources to open government in future action plans.
Francoli’s report can be found here, and comments on the report can be made here. The comments are public, and it is also possible to read comments by other stakeholders and to engage in dialogue about the report. With a new government in the process of setting its open government agenda, this is an opportunity to help shape its direction.
Published in Geospatial Data/Digital Cartography
Canadian Trademark Law
Published in 2015 by Lexis Nexis
Electronic Commerce and Internet Law in Canada, 2nd Edition
Published in 2012 by CCH Canadian Ltd.
Intellectual Property for the 21st Century
Intellectual Property Law for the 21st Century: