Hot Topics in IT Law 2014
Peter Ruby
The Eighteenth Annual
Canadian IT Law
Association Conference
October 20, 2014
Sattva Capital v. Creston Moly
• Interpretive principles
… the interpretation of contracts has evolved towards a practical,
common-sense approach not dominated by technical rules of
construction. The overriding concern is to determine “the intent of the
parties and the scope of their understanding”
To do so, a decision-maker must read the contract as a whole, giving
the words used their ordinary and grammatical meaning, consistent
with the surrounding circumstances known to the parties at the time of
formation of the contract.
The meaning of words is often derived from a number of contextual
factors, including the purpose of the agreement and the nature of the
relationship created by the agreement
2
Sattva Capital v. Creston Moly
While the surrounding circumstances will be considered in interpreting
the terms of a contract, they must never be allowed to overwhelm the
words of that agreement
The interpretation of a written contractual provision must always be
grounded in the text and read in light of the entire contract
While the surrounding circumstances are relied upon in the interpretive
process, courts cannot use them to deviate from the text such that the
court effectively creates a new agreement
3
Sattva Capital v. Creston Moly
The nature of the evidence that can be relied upon under the rubric of
“surrounding circumstances” will necessarily vary from case to case. It
does, however, have its limits. It should consist only of objective
evidence of the background facts at the time of the execution of the
contract, that is, knowledge that was or reasonably ought to have been
within the knowledge of both parties at or before the date of
contracting. Subject to these requirements and the parol evidence rule
discussed below, this includes, in the words of Lord Hoffmann,
“absolutely anything which would have affected the way in which the
language of the document would have been understood by a
reasonable man”. [citations omitted]
4
Sattva Capital v. Creston Moly
• Parol Evidence Rule
The parol evidence rule precludes admission of evidence outside the
words of the written contract that would add to, subtract from, vary, or
contradict a contract that has been wholly reduced to writing
To this end, the rule precludes, among other things, evidence of the
subjective intentions of the parties… The parol evidence rule does not
apply to preclude evidence of the surrounding circumstances.
5
Sattva Capital v. Creston Moly
• Question of Law or Mixed Fact and Law
Historically, determining the legal rights and obligations of the parties
under a written contract was considered a question of law
Contractual interpretation involves issues of mixed fact and law as it is
an exercise in which the principles of contractual interpretation are
applied to the words of the written contract, considered in light of the
factual matrix.
… there is no question that many other issues in contract law do
engage substantive rules of law: the requirements for the formation of
the contract, the capacity of the parties, the requirement that certain
contracts be evidenced in writing, and so on.
6
Netflix and the CRTC
• 1080 And I think we have agreed earlier that I can put in "The Government of
Ontario believes"
• "... the best way to accomplish this..."
• 1081 That is and even playing field:
• "... is to expand the regulation of new media TV, rather than by lightening the
current regulation of traditional TV."
• 1082 To put a blunt face on it, you are inviting the CRTC to regulate Google,
YouTube and Netflix, aren't you, and what advice will you be giving your
Minister later on today when the potential headline is, "Government of
Ontario wants to tax Netflix" or "Government of Ontario wants to regulate the
Internet"?
• 1083 MR. FINNERTY: Well, in fact what we recommend is that new media
broadcasting activities be regulated. We did not recommend that the Internet
be regulated, but we are very clear in our submission, both our written
submission and in today's presentation, that we believe that new media
broadcasting activity should be regulated to support the principles of the
Broadcasting Act and to support Ontario's very important entertainment and
creative cluster.
7
Netflix and the CRTC
• Insight Productions
• 7153 I just wanted to speak briefly about Netflix and the OTTs.
• 7154 I know regulating the Internet is a very slippery slope but the impact to
our cultural industries, as we all know, is huge and will only grow more and
more as more OTT services switch on from the United States and around the
world.
• 7155 As I understand it, Netflix has 4 million subscribers in Canada. At $8
dollars a month, that represents $384 million that Netflix is making in Canada
and I understand that all money goes to the United States and there's no tax
on any of that money.
• 7156 So I'm looking forward in these hearings to hear what Netflix and the
other OTTs are proposing to help us in the Canadian content community and,
more importantly, what is their contribution going to be to our culture when
they are sucking so much money out of the system and creating so much
competition. I wish them well, they're a great service, but I look forward to
hearing what they are going to propose and what their plans are to
participate in a market they are making so much money in.
8
Netflix and the CRTC
• Broadcasting Commission Letter Addressed to Corie Wright
• (Netflix)
• Ottawa, 29 September 2014
• BY EMAIL: cwright@netflix.com
• Ms. Corie Wright
• Netflix
• Director, Global Public Policy
• Dear Ms. Wright:
9
Netflix and the CRTC
The Commission has requested that Netflix provide information related to
activities in Canada, including its Canadian subscribers, its investments in
Canadian made productions and other matters. This request was made for a
very specific purpose. The hearing panel is seeking to better understand
Netflix’s innovative approach in providing Canadian-made content to Canadian
and non-Canadian audiences alike, through non-traditional, consumer-driven
platforms. In addition, Netflix appears to bean increasingly popular service that
operates in Canada.
…
The legislative framework grants the Commission the powers of a superior
court of record to enforce its orders. Specifically, under section 16 of the
Broadcasting Act, the Commission has the authority to request information from
parties, regardless of whether they are Canadian or non-Canadian. As was
made clear at the hearing, the Commission has well-established rules that
allow it to grant confidential treatment to sensitive information filed by parties.
These rules have been consistently and successfully applied for decades,
even through the emergence of new technologies and new operators.
10
Netflix and the CRTC
A company’s refusal to comply with requests and orders duly made at a
public hearing is a serious matter. Parties who choose to engage in
Commission proceedings, especially large important corporations such
as Netflix, cannot unilaterally choose which part of the evidencegathering proceeding they want to participate in. The Commission
views such actions as a direct attempt to undermine its ability to serve
Canadians, as well as impair the procedural fairness owed to all
participants.
…
11
Netflix and the CRTC
For example, at the hearing, you stated that “most consumers use
Netflix and other online video services to supplement their viewing of
traditional broadcasting services.” You added that Canadian content is
“thriving on Netflix” and that “Netflix’s commitment to Canadian content
is market-oriented and driven by subscriber demand and their viewing
habits.”
Yet, by refusing to provide any supporting evidence, the Commission
cannot fully test and evaluate the strengths of Netflix’s argument which,
if supported by evidence, may otherwise be very compelling. The
Commission cannot carry out its duties based on mere anecdotal
information.
…
12
Netflix and the CRTC
In light of the above, Netflix’s intervention and supporting
documentation will be removed from the public record of this
proceeding on October 2, 2014…
As a result, the hearing panel will reach its conclusions based on the
remaining evidence on the record. There are a variety of perspectives
on the impact of Internet broadcasting in Canada, and the panel will
rely on those that are on the public record to make its findings.
13
Voltage v. John Doe
- Norwich Order against ISP
- Voltage had bona fide case
THIS COURT ORDERS that:
1. This action shall continue as a specially managed proceeding and be
referred to the Office of the Chief Justice for the appointment of a Case
Management Judge.
2. TekSavvy Solutions Inc. (TekSavvy) shall disclose to the Plaintiff the
contact information, in the form of the names and addresses, to the
extent it is able, of the TekSavvy customer accounts (Subscribers)
associated with the IP addresses attached as Exhibit B to the affidavit
of Barry Logan.
14
Voltage v. John Doe
3. All reasonable legal costs, administrative costs and disbursements
incurred by TekSavvy in abiding by this Order shall be paid by the
Plaintiff to TekSavvy.
4. The reasonable legal costs and disbursements of TekSavvy referred
to in paragraph 3 herein shall be paid prior to the release to the Plaintiff
of the information referred to in paragraph 2 herein.
5. The Plaintiff shall include a copy of this Order in any correspondence
that is sent to any of the Subscribers identified by TekSavvy pursuant to
this Order.
6. Any of the Subscribers may request a full copy of these Reasons for
Order and Order from the Plaintiff and the Plaintiff shall provide a copy
at no charge to each Subscriber requesting a copy.
15
Voltage v. John Doe
7. Any separate actions commenced by the Plaintiff against any of the
Subscribers shall be case managed in connection with this case.
8. Any correspondence sent by Voltage to any Subscriber shall clearly
state in bold type that no Court has yet made a determination that such
Subscriber has infringed or is liable in any way for payment of
damages.
9. A draft of the proposed letter to be sent to Subscribers shall be
provided to the parties to this motion and to the Court and be the
subject of a case conference with the Case Management Judge to
review and approve the contents of the letter before being sent to any
Subscriber.
16
Voltage v. John Doe
10. The release of the information by TekSavvy shall remain
confidential and not be disclosed to any other parties without further
order of the Court and only be used by the Plaintiff in connection with
the claims in this action.
11. The Plaintiff shall undertake to the Court not to disclose to the
general public by making or issuing a statement to the media any of the
information obtained from TekSavvy.
17
Peter Ruby
pruby@goodmans.ca
416-597-4184
18
Dentons Canada LLP
Hot Topics in IT Law 2014
Privacy Issues
Timothy M. Banks, CIPP/C
Partner
October 2014
Legislative rundown
Some Pending developments
• Bill S-4 – now in House of Commons
• mandatory breach reporting
• expanded disclosures without consent
• addresses disclosure in business transactions (finally!)
• Bill C-13 – back from Committee with minor amendment
• creates new preservation orders without judicial
oversight
• orders for production of transmission data
• immunity provision for voluntary cooperation
• Alberta PIPA – clock is ticking; extension sought
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
20
Bill S-4, Digital Privacy Act –
Mandatory breach reporting
As introduced
As passed
10.1(6) The notification [to the
Commissioner] shall be given as soon
as feasible after the organization
determines that the breach has
occurred. However, if a government
institution or part of a government
institution requests that the organization
delay notification for a criminal
investigation relating to the breach,
notification shall not be given until the
institution or part concerned authorizes
the organization to do so.
10.1(6) The notification [to the
Commissioner] shall be given as soon
as feasible after the organization
determines that the breach has
occurred.
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
Sen. Furey: “Before Bill S-4, we were
governed by the common law which would
require a company to inform a victim
immediately or risk a breach of contract
and a negligence lawsuit. As such there
were protections for victims before Bill S-4. So
we must ask ourselves, does Bill S-4 make
things better for the innocent victim whose
data has been hacked, whose financial
security is at risk? We must make sure that
Bill S-4 does not make it worse.” (May 8 2014)
Michael Crystal also spoke out at committee.
21
Bill S-4, Digital Privacy Act –
Voluntary disclosures
Current s. 7(3)(d)
New s. 7(3)(d), (d.1) & (d.2)
[…] an organization may disclose personal
information without the knowledge or
consent of the individual only if the
disclosure is
[…] an organization may disclose personal
information without the knowledge or
consent of the individual only if the
disclosure is
[…]
[…]
(d) made on the initiative of the organization
to an investigative body, a government
institution or a part of a government
institution and the organization
(d) made on the initiative of the organization
to a government institution or a part of a
government institution and the organization
(i) has reasonable grounds to believe that
the information relates to a breach of an
agreement or a contravention of the laws of
Canada, a province or a foreign jurisdiction
that has been, is being or is about to be
committed, or
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
(i) has reasonable grounds to believe that
the information relates to a contravention of
the laws of Canada, a province or a foreign
jurisdiction that has been, is being or is
about to be committed, […]
22
Bill S-4, Digital Privacy Act –
Intra-organization disclosure
New s. 7(3)(d.1) and (d.2)
(d.1) made to another organization and is reasonable for the purposes of
investigating a breach of an agreement or a contravention of the laws of
Canada or a province that has been, is being or is about to be committed
and it is reasonable to expect that disclosure with the knowledge or
consent of the individual would compromise the investigation;
(d.2) made to another organization and is reasonable for the purposes of
detecting or suppressing fraud or of preventing fraud that is likely to be
committed and it is reasonable to expect that the disclosure with the
knowledge or consent of the individual would compromise the ability to
prevent, detect or suppress the fraud;
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
23
Bill C-13, Protecting Canadians from Online Crime
Immunity provision
CC: s. 487.0195 (1) For greater certainty, no
preservation demand, preservation order or
production order is necessary for a peace
officer or public officer to ask a person to
voluntarily preserve data that the person is not
prohibited by law from preserving or to
voluntarily provide a document to the officer
that the person is not prohibited by law from
disclosing.
(2) A person who preserves data or provides a
document in those circumstances does not
incur any criminal or civil liability for doing so.
PIPEDA: 7(3)(c)(ii): (c.1) […] made to a
government institution or part of a government
institution that has made a request for the
information, identified its lawful authority to
obtain the information and indicated that […]
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
R v Spencer, 2014 SCC 43
Neither s. 487.014(1) of the Criminal Code,
nor PIPEDA creates any police search and
seizure powers. Section 487.014(1) is a
declaratory provision that confirms the
existing common law powers of police officers
to make enquiries. PIPEDA is a statute whose
purpose is to increase the protection of
personal information. Since in the
circumstances of this case the police do not
have the power to conduct a search for
subscriber information in the absence of
exigent circumstances or a reasonable law,
the police do not gain a new search power
through the combination of a declaratory
provision and a provision enacted to promote
the protection of personal information.
24
Right to be forgotten
Google turns the tables
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
25
Background to Google Spain SL, Google Inc. v
AEPD, Mario Costeja González
• Mario Costeja González’s name appeared in official notices published in
a newspaper in 1998 regarding the forced sale of properties in relation to
social security debts
• The issues between González and the Spanish state were resolved but a
Google search kept leading to the notices
• Originally, the newspaper was in print but had been digitized
• When asked, the newspaper refused to remove the notices from the
online edition or suppress them from being indexed by search engines
• Google similarly refused to remove / suppress the search results
http://curia.europa.eu/juris/liste.jsf?num=C-131/12
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
26
European Court of Justice’s Decision
Search engines are data controllers
“[…] in exploring the internet automatically, constantly and systematically in search
of the information which is published there, the operator of a search engine
‘collects’ such data which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within
the framework of its indexing programmes, ‘stores’ on its servers and, as the case
may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of search
results.” (para. 28)
“the fact that publishers of websites have the option of indicating to operators of
search engines, by means in particular of exclusion protocols such as ‘robot.txt’ or
codes such as ‘noindex’ or ‘noarchive’, that they wish specific information
published on their site to be wholly or partially excluded from the search engines’
automatic indexes does not mean that, if publishers of websites do not so indicate,
the operator of a search engine is released from its responsibility for the
processing of personal data that it carries out in the context of the engine’s activity.”
(para. 39)
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
27
European Court of Justice’s Decision
Jurisdiction over Google, Inc.
“Since that display of results is accompanied, on the same page, by the display of
advertising linked to the search terms, it is clear that the processing of personal
data in question is carried out in the context of the commercial and advertising
activity of the controller’s establishment on the territory of a Member State, in this
instance Spanish territory.” (para. 57)
“[…] processing of personal data is carried out in the context of the activities of an
establishment of the controller on the territory of a Member State […] when the
operator of a search engine sets up in a Member State a branch or subsidiary
which is intended to promote and sell advertising space offered by that engine and
which orientates its activity towards the inhabitants of that Member State.” (para.
60)
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
28
European Court of Justice’s Decision
Right to be forgotten
Test:
Is information inaccurate, inadequate, irrelevant or excessive after balancing
sensitivity of the information and interest of the public in having access to the
information? (para. 92)
“As regards a situation such as that at issue in the main proceedings, which
concerns the display, in the list of results that the internet user obtains by making a
search by means of Google Search on the basis of the data subject’s name, of
links to pages of the on-line archives of a daily newspaper that contain
announcements mentioning the data subject’s name and relating to a real-estate
auction connected with attachment proceedings for the recovery of social security
debts, it should be held that, having regard to the sensitivity for the data subject’s
private life of the information contained in those announcements and to the fact
that its initial publication had taken place 16 years earlier, the data subject
establishes a right that that information should no longer be linked to his name by
means of such a list.” (para. 98)
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
29
Google’s reaction
• considers Google search to be a “library catalogue”
• initially created a tool to make requests
• believes test is vague and subjective
• more than 135,000 requests; more than 475,000 URLs
• Easy:
• medical history, sexual assault, incidental mentions are removed
• convicted pedophile about recent conviction or politicians are not removed
• seven-city tour of European cities to discuss RTF with experts invited by
Google as part of “Advisory Council”
• how to operationalize principles (so that they can be automated)?
• public consultation denounced by European regulators who have refused
to participate
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
30
Consultation on “Grey Issues”
• how long ago is a conviction spent?
• what about voluntarily provided sensitive information?
• unpopular or illegal political speech or activities?
• is the Internet meant to be a reflection of the world, a parallel world, or
something else?
• should the deletion of link be noted?
• should requests not fulfilled be noted?
October 2014
Timothy M Banks, Partner, Dentons Canada LLP
31
Comments & Questions
Timothy M. Banks, CIPP/C
Partner & Privacy Officer
Dentons Canada LLP
400 – 77 King Street West, Toronto, ON M5K 0A1
Phone: 416.863.4424
timothy.banks@dentons.com
www.privacyanddatasecuritylaw.com
Twitter @TM_Banks
© 2014 Dentons. Dentons is an international legal practice providing client services worldwide through its member firms and affiliates. This publication is not designed to provide legal or other advice and you should not take, or refrain from taking,
action based on its content. Please see Dentons.com for Legal Notices.