The Federal Court of Canada yesterday issued an important decision addressing the jurisdictional reach of Canada's privacy legislation. The case involved a complaint launched by Pippa Lawson of CIPPIC against U.S.-based Abika.com over the collection and use of her personal information. The Privacy Commissioner refused to investigate, arguing that Abika.com declined to cooperate with the investigation and that she therefore lacked the jurisdiction to proceed.
CIPPIC applied for judicial review and yesterday won the case. The court gets it exactly right – "with respect, I think the Commissioner did not distinguish her power to investigate from the effectiveness of her investigation." In other words, Abika's unwillingness to cooperate should not have posed a barrier to investigating. Indeed, the only barrier was erected by the Privacy Commissioner, whose decision made it impossible for Lawson to seek damages in federal court (going to federal court is contingent on completion of an investigation).
This could prove to be an important decision as it highlights the fact that Canadians can launch complaints against out-of-country entities who collect and use their personal information in violation of the law (and rightly concludes the location of the website server is not determinative for jurisdictional purposes). Moreover, it challenges the Privacy Commissioner to address such complaints, concluding that "it would be most regrettable indeed if Parliament gave the Commissioner jurisdiction to investigate foreigners who have Canadian sources of information only if those organizations voluntarily name names."