Canadians are vulnerable foreign court orders

On July 1, 2008 the New York US District Court ordered YouTube to turn over its logging database information ("Logging Data") to media giant Viacom International Inc. The order arises from the $1 billion court battle in which Viacom has alleged copyright infringement against YouTube and its parent corporation Google, for encouraging and allowing users to upload and share TV episodes and other Viacom-owned content on YouTube's website without Viacom's authorization.

The order allows Viacom to obtain user and visitor login IDs and ISP addresses, to track the viewing habits of users on YouTube, and specifies little, if any, restrictions on use of those data. Privacy advocates worldwide object strongly to the broad scope of the order. The court justified its decision by noting that no authority was cited to bar the disclosure of such information and that privacy concerns were speculative given that the Logging Data could not necessarily identify specific individuals.

This order affects Canadians who have used YouTube. The Information and Privacy Commissioner of Ontario publicly urged Google to appeal the decision, stating that businesses should not rely on surveillance of consumers to protect their copyright interests. The Commissioner noted that despite anticipated safeguards, information in the Logging Data (such as a first and last name as a user's login ID) could specifically identify individuals and should be protected under U.S. Law. In the Commissioner's view, "any form of disclosure of personal information inevitably increases the potential risk of unauthorized uses of personal information" such as identity theft.

Users have also voiced concerns that Viacom may use the Logging Data to pursue copyright infringement enforcement against individuals, although a further court order would be necessary if those details were needed to specifically identify a targeted user. After the court’s order was issued, Google and Viacom confirmed that they were collaborating to create a protocol for removing any personally identifiable information. Viacom posted a public undertaking that the data would be used "exclusively for the purpose of proving our case against YouTube and Google." On July 14, 2008, in a move applauded by the Information and Privacy Commissioner of Ontario and others, Viacom and Google executed and released an agreement that the Logging Data would be anonymized by substituting values for entries in certain fields to safeguard the privacy of individuals.

This settlement demonstrates that at least some of the information ordered disclosed was not necessary for the purposes of the lawsuit, and raises the question of whether it was appropriate for the U.S. court to grant the order. In Canada, the Federal Court of Appeal in BMG v. John Doe recently set out the applicable Canadian standard for disclosure of an ISP user's identity: public interests in favour of disclosure must outweigh legitimate privacy concerns. The Federal Court of Appeal noted that a copyright infringement plaintiff must show a bona fide claim, avoid delay between the investigation and the request for information, and limit the acquisition of information to the pertinent issues. A court ordering disclosure must still exercise caution to ensure that privacy rights are affected only in the most minimal way, and should give specific directions as to the type of information disclosed and the manner in which it can be used.

The U.S. order demonstrates that the privacy rights of Canadians are vulnerable to decisions of foreign courts. Precautions should be taken when providing personal information to any Internet site, and businesses should consider developing appropriate data collection and retention strategies to reduce risk and exposure.