On September 6, 2019, the Superior Court of Québec, in Opencorporates Ltd. c Registraire des entreprises du Québec,1 issued a declaratory judgment against the Registrar stating that it did not have the authority under its constituting Act — the Act respecting the legal publicity of enterprises (ALPE)2 — to prevent the applicant from publishing and distributing the data it had lawfully collected from the Register.
As a preliminary matter, the Registrar readily acknowledged that nothing in its enabling statute, nor in any other legislation, explicitly granted it the ability to monitor how the Register data is used once it is lawfully obtained.6 That said, the Registrar argued that the applicant’s use of the Register data violated the broader object and purpose of the ALPE, thereby entitling it to take action against OpenCorporates. Considering that OpenCorporates’ database did not restrain the manner in which searches could be conducted — unlike the Register, which was expressly designed to prevent users from conducting searches based on a natural person’s name or address7 — the Registrar alleged that the applicant was violating the purpose of the ALPE. In addition, the Registrar advanced that the ALPE granted it the exclusive authority to maintain and publish information with respect to Québec enterprises and, to that end, it was empowered to ensure the security of the Register data.
At the outset, the court clarified what the case was not about — namely, the legality of the OpenCorporates’ database itself. The court explicitly left open the possibility that a natural person, whose personal information is concerned by the applicant’s activities, may contest those practices under applicable privacy laws.8
Analysis and Business Takeaways
While the decision answers certain key questions, it nonetheless leaves others unanswered. Most notably, the court left open the possibility that a natural person, under applicable privacy legislations, could challenge OpenCorporates’ practices. For example, in Québec, An Act respecting the Protection of Personal Information in the Private Sector10 (Québec ARPPIPS) operates in place of federal Personal Information Protection and Electronic Documents Act (PIPEDA) for intra-provincial matters, and, as a result, applies to personal information collected within the context of this case. OpenCorporates would be subject to Québec ARPPIPS if it is considered as collecting the Register’s information in a commercial capacity11 even if it is a U.K.-based publisher that has no place of business in Québec.12
The Register’s information includes personal information and it should be noted that the Québec ARPPIPS does not include an exception for personal information that is publicly available, although certain parts of the act do not apply to personal information, which, by law, is public.13 In similar type of cases rendered under PIPEDA, the Office of the Privacy Commissioner articulated the view that it was illegal for foreign-based entities to collect publicly available information of Canadians and repurpose/republish such information.14