This is the second entry in a three-part blog series about the current state of estates law vis-à-vis privacy law. Part I focused on the relevant federal and provincial privacy legislation. Part II will examine significant court decisions relating to this area. Part III will look at solutions for lawyers to help their clients manage their estate planning to be compliant with privacy law requirements.

The previous entry in this blog series provided a general overview of the issues surrounding digital assets, particularly with respect to instances where an organization refuses to disclose the personal information that it has collected about a deceased person to the executors and trustees (together, the “legal representatives”), as well as the beneficiaries, of that person’s estate. That entry also analyzed the relevant provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA),[1] a federal statute which governs the collection, use and disclosure of personal information by private organizations in most Canadian jurisdictions. The conclusion was that PIPEDA was silent on what the rights of a deceased person’s estate’s legal representatives and beneficiaries are vis-à-vis organizations who hold personal information of that deceased person.

While the previous entry focused mainly on the relevant statutory law, this entry will instead look to the jurisprudence to fill in any gaps left open by the statute. The problem is that, as of the date of this blog post, there is no key jurisprudence that addresses the core conflicting issues of estates law and privacy law. While in estates law, it is a well-understood principle that the legal representative of the estate “steps into the shoes” of the deceased person and is able to do “anything” that the deceased person would be able to do,[2] this conflicts with PIPEDA, as PIPEDA states that an organization “may” disclose information that it has collected about a person to a third party only with the consent of that person.[3] Disclosure of such personal information by such an organization to a deceased person’s legal representatives does not appear to be an exception to that rule, and there is no authority within PIPEDA that equates a deceased person’s will to the consent necessary for the disclosure of such information by such an organization.

However, there are court decisions that, while not directly resolving these conflicting principles, do relate to them. The most relevant of these decisions appears to be the 2017 Ontario Superior Court of Justice decision Henry v. Bell Mobility.[4] In this relatively short decision (which as of the date of this blog post has received no subsequent jurisprudential treatment), the applicant was Maureen Henry, a mother who was seeking her deceased son’s personal information from Bell Mobility, Apple Canada, Google Canada, and Facebook. Several years prior to the decision, someone had discovered her son’s body in Lake Ontario, and the police did not know the identity of the body until she became aware of an unidentified body in the Toronto morgue. Ms. Henry sought her son’s personal information from the aforementioned organizations because she had no knowledge about the circumstances surrounding her son’s death and was thus trying to determine what had happened to him through his phone, email and social media records.

There are several issues with Henry for the purposes of reconciling the conflict between estates law and privacy law. First, Henry does not appear to be an estates law-oriented decision: the court makes no mention of the deceased son’s estate, his will (or lack thereof), or any sort of authority that his legal representatives would have in this situation. In fact, the only authority that Henry—which is only 10 paragraphs long—refers to is PIPEDA, and even then it only does so without reference to any specific provisions within the statute.

The other, overarching issue with Henry is not something that is readily identifiable in the decision. Numerous media outlets covered Ms. Henry’s story because of the obstacles that she had to overcome just to try to find out what had happened to her son.[5] The articles indicate that the reason Ms. Henry brought the issue to court in the first place was that none of the aforementioned organizations had complied with her requests for her son’s personal information. In their initial refusal to provide such personal information, the organizations cited privacy legislation as preventing them from doing so. Interestingly, news articles indicate that although Ms. Henry won a court order in her favour in Henry, only Bell and Apple actually complied with the order.[6] As of November 2019, Google and Facebook have asserted that they can only comply with an order from a U.S. court.[7] Thus, the issue with Henry is one of enforceability: it is one thing to have a Canadian court side with a deceased person’s legal representatives or beneficiaries in these types of matters, but it is another to actually compel an organization to comply with these types of court orders.

Unfortunately, Ms. Henry’s situation demonstrates that the law in this area has not grown as quickly as the internet, and enforcing foreign judgments in disputes involving internet-oriented organizations can be challenging. This is particularly because many different jurisdictions can be involved with a dispute of this nature, as the internet is accessible all over the world, and many websites that collect personal information from Canadians do not have a physical presence in Canada. Such websites may also store such personal information on servers located in an entirely different jurisdiction, which further complicates matters.

That being said, courts are starting to develop precedent in this area. One particularly relevant case is T. (A.) v. Globe24h.com, a 2017 decision of the Federal Court of Canada which pertains to the application of PIPEDA to websites that are not based in Canada.[8] In that decision, the court confirmed that in order to apply PIPEDA to foreign-based organizations, “the court must consider whether there is a real and substantial connection between them and Canada”.[9] The court then provided a list of relevant connecting factors to determine whether such a “real and substantial” connection exists, which consists of:

• the location of the target audience of the website;
• the source of the content on the website;
• the location of the website operator; and
• the location of the host server.[10]

In Globe24h.com, the defendant website was based in Romania and had no physical presence in Canada. Nonetheless, the fact that the defendant website was collecting information from other Canadian websites about Canadians was enough for the court to determine that it had a “real and substantial connection” to Canada. Based on this precedent, it is plausible that a court would find most well-known social media, eCommerce and other internet-based organizations that collect data from Canadians to have a “real and substantial connection” to Canada. Yet, while it is clear that courts can apply PIPEDA to foreign-based organizations, that precedent is not helpful for the purposes of estates law if PIPEDA itself is not helpful for the purposes of estates law.

Furthermore, again, there is a difference between a court’s ability to make an order with respect to a foreign-based organization, and the enforceability of such an order. A significant case that addresses this topic is Google Inc. v. Equustek Solutions Inc., a 2017 decision of the Supreme Court of Canada.[11] Briefly, Equustek was a networking device manufacturer that had filed a lawsuit against a former distributor which it claimed had used its trade secrets to create and sell a competing product. Equustek obtained court orders against the distributor, but such orders were ineffective in hampering the distributor’s sales of the infringing product. Equustek then applied to the courts in British Columbia to compel Google, a non-party to the action, to de-index any search results referring to the distributor in an attempt to halt the distributor’s sales. Equustek’s logic was that Google is the world’s largest search engine, and buyers were discovering the distributor’s website and subsequently purchasing the infringing products through Google searches. Equustek successfully obtained an order for Google to de-index all of the search results relating to the distributor globally; Google opposed this order, and the dispute made its way to the Supreme Court of Canada.

The Supreme Court of Canada decided in Equustek’s favour. Although the court acknowledged the implications of the wide-sweeping nature of global takedown orders, it pointed to the fact that courts in other jurisdictions have found it necessary, in the context of internet abuses, to pronounce orders that have international effects.[12] Additionally, the court determined that the facts of the case indicated that Equustek had no other practical alternative to enforcing its intellectual property rights.

The court also noted that the global order did not violate the principle of international comity because it would have been inequitable to have Equustek go to the courts of every country where such an order is legally permissible.[13] Lastly, further to this point, the court suggested that the order did not violate the principle of international comity because it did not require Google to violate the laws of any other jurisdiction, and that if it did, Google could apply to the British Columbia courts to vary the order accordingly.[14]

It is this final point that is most relevant. Subsequent to the Supreme Court of Canada’s ruling, Google obtained an order from the U.S. District Court for the Northern District of California granting preliminary injunctive relief on the grounds that the Canadian order disregarded an “immunity” granted to “providers or users of interactive computer services” from being treated as “publishers or speakers of any information provided by another information content provider” in Section 230 of the U.S. Communications Decency Act.[15] Google then applied to the B.C. courts to vary the Canadian order with respect to that order’s applicability to the U.S. In Equustek Solutions v. Jack, the British Columbia Supreme Court denied Google’s request, concluding that despite the fact that the Canadian court order “undermines” the Communications Decency Act, the “U.S. decision does not establish that the injunction requires Google to violate American law”.[16] [Emphasis added.]

Yet, most importantly, although the court denied Google’s application to vary the Canadian order, it acknowledged that the “effect of the U.S. order is that no action can be taken against Google to enforce the injunction in U.S. courts”, but that it “does not restrict the ability of [the B.C.] court to protect the integrity of its own process through orders directed to parties over whom it has personal jurisdiction”.[17]

Thus, the Equustek saga presents a conundrum: although it is clear that Canadian courts can make an order with a global applicability against an internet organization, a Canadian court has also acknowledged a U.S. court’s power to enjoin the enforcement of such an order within its own national jurisdiction. Thus, there still exists a key distinction between a Canadian court’s ability to make an order and its ability to enforce such an order.

What does all of this have to do with estates law? As one of the articles about Ms. Henry’s predicament indicates, Google argues that the disclosure that Ms. Henry is seeking is in violation of the U.S. Stored Communications Act,[18] and a “violation” of another jurisdiction’s laws is what the courts in the Equustek decisions suggest could make a globally-applicable Canadian court order not enforceable in that jurisdiction. Therefore, it seems that there is legal precedent for Google and Facebook’s refusal to comply with the court order in Henry, although the argument surrounding this specific type of “violation” has not actually been tested in a Canadian court. That being said, if organizations based in other jurisdictions can argue that disclosing a deceased person’s personal information to their legal representatives or beneficiaries violates a law in their jurisdiction, then it is possible that a Canadian court order against such organizations would be unenforceable, and this could thus require the legal representatives or beneficiaries to seek a court order from the jurisdiction in which the organization is based.

The law on jurisdiction over the internet—as well as on interjurisdictional issues generally—is complicated, and despite there not being clear precedent for these issues, there is a fair amount of jurisprudence that relates to it. For example, the above analysis does not even factor in the “Terms of Service” or “Terms of Use” agreements that individuals agree to when they open an account with most popular websites, and these agreements often include forum selection and choice of law clauses in favour of the websites (although there is also precedent to suggest that these clauses are unenforceable in certain situations).[19] That being said, if there was clear statutory guidance on these topics, then clear jurisprudence would not necessarily be compulsory to have.

A final case that is relevant to this topic, albeit has nothing to do with the internet, is Hicks Estate v. Hicks, a 1987 decision of an Ontario District Court.[20] This case dealt with what happens to the solicitor-client privilege between a client and a lawyer once the client dies. The court ultimately ruled that “privilege reposes in the personal representative of the deceased client” and that as such the personal representative “can waive the privilege and call for disclosure of any material that the client, if living, would have been entitled to from” the solicitor.[21] While it seems that no subsequent jurisprudence has cited this case in the context of a privacy law-related dispute, it would be interesting to see its application to the digital assets issue when considering the parallels between a lawyer who holds confidential client information and a website that owns confidential personal information.

A concluding thought is that third-party organizations in these situations are arguably quite justified in declining to disclose a deceased person’s personal information to third parties. Not only is there privacy legislation in multiple jurisdictions at play in these types of situations, there is also the ethical issue of whether or not a deceased person would actually want their legal representatives and beneficiaries to access certain types of situation. In any event, again, just as with legislation in this area, the jurisprudence does not provide clear answers to the outstanding questions. That being said, the final blog post in this series will discuss potential solutions for individuals who would like to avoid these types of issues from occurring during the administration of their estates.

[1] Personal Information Protection and Electronic Documents Act, SC 2000, c 5 [PIPEDA].

[2] Sustrik Estate v Floyd, 2005 ABQB 880, [2005] AJ No 1837 at para 33 [Sustrik Estate].

[3] PIPEDA, supra note 1 at s 7(3).

[4] Henry v. Bell Mobility, 2017 ONSC 6070, 284 ACWS (3d) 416 [Henry].

[5] Jonathan Ore, “Ottawa mother’s quest for her late son’s passwords an uncharted legal road, say experts”, CBC (24 November 2019), online: <https://www.cbc.ca/radio/outintheopen/diy-justice-1.5351892/ottawa-mother-s-quest-for-her-late-son-s-passwords-an-uncharted-legal-road-say-experts-1.5366292> [Ore]; see also Molly Hayes, “Pressing Google and Facebook for answers in her son’s death, an Ontario mother stirs the digital-privacy debate”, The Globe and Mail (27 August 2019), online: < https://www.theglobeandmail.com/canada/article-pressing-google-and-facebook-for-answers-in-her-sons-death-an/> [Hayes].

[6] Ibid.

[7] Ore, supra note 5.

[8] T. (A.) v. Globe24h.com, 2017 FC 114, 275 ACWS (3d) 155 [Globe24h.com].

[9] Ibid at para 52.

[10] Ibid at para 53.

[11] Google Inc v Equustek Solutions Inc, 2017 SCC 34, 279 ACWS (3d) 822 [Google Inc].

[12] Ibid at para 39.

[13] Ibid at para 47.

[14] Ibid at paras 44, 46.

[15] Google LLC v. Equustek Solutions Inc., 2017 WL 5000834 (ND Cal 2 November 2017) [Google LLC].

[16] Equustek Solutions Inc v Jack, 2018 BCSC 610, 291 ACWS (3d) 150 at paras 15-20. [Equustek Solutions Inc].

[17] Ibid at para 22.

[18] Stored Communications Act, 18 USC Chapter 121 §§ 2701–2712 (1986) [Stored Communications Act]; please note that an analysis of this statute is beyond the scope of this blog post.

[19] Douez v Facebook Inc., 2017 SCC 33, [2017] 1 SCR 751 [Douez].

[20] Hicks Estate v Hicks (1987), [1987] OJ No 1426, 3 ACWS (3d) 221 (Ont Dist Ct, Judicial Dist of Algoma) [Hicks Estate].

[21] Ibid at para 15.