Thursday, July 03, 2008

CIRA’s Privacy Policy - Between a Rock and a Hard Place

I respectfully disagree with Michael Geist about CIRA’s latest policy on disclosure of registrant information.

CIRA is right to allow those who are harmed by illegal activity on a website to find out, in appropriate circumstances, who owns and operates that website. This should go beyond criminal behaviour and extend to civil causes of action as well. Here’s the new latest CIRA policy.

People and companies have a right to be able to get necessary information to communicate with and, if necessary, sue those engaged in cyber squatting, IP infringement or other illegal behaviour such as defamation. The new policy does not appear to deal with defamation, and it probably should - subject to the need to provide reasonable protection for whistle blowers and other safeguards. (See below).

It shouldn’t normally be necessary to get a court order to get this information. This is different than the invasion of a private space, as in the BMG case, where the 29 alleged infringers had a reasonable expectation of privacy and our Canadian Courts protected our privacy values. (I’m proud to have been very involved in that case).

A person who puts up a website for public viewing is actively seeking attention and must expect to forfeit some degree of privacy - and indeed routinely did so until the recent advent of CIRA’s ultra privacy protective policy.

By striving to protect registrant privacy, CIRA is putting itself between a rock and a hard place. It could - foreseeably - be sued by either side. So it has an incentive to get this policy and protocol right.

I’m not sure that CIRA’s latest policy does get this right yet - but it’s a step in the right direction. And I fail to understand why defamation is not a ground for a “dispute” under this policy. This may require a different type of handling, in order to protect the privacy of legitimate whistleblowers, etc. And everyone should bear in mind that freedom of expression was just given a big boost by the Canadian Supremes who have brought the law of defamation and “fair comment” much more in line with modern times in WIC Radio v. Simpson and our American friends, who to their credit cherish and defend free speech. So CIRA should be loath to hand over information where defamation is alleged unless it’s a pretty clear case. Whistle blowing doesn’t necessarily involve defamation.

And, interestingly, the law of Ontario, for example, reflects a long and ancient policy that newspapers cannot avail themselves of certain important defences in a defamation action “unless the names of the proprietor and publisher and the address of publication are stated either at the head of the editorials or on the front page of the newspaper.”

If in doubt, CIRA should err on the side of caution (i.e. privacy) and force the IP owner or allegedly defamed person to go to Court - and notify the domain name holder about the proceeding. This will probably be expensive for CIRA, but I’m guessing that CIRA has lots and lots of money.

Those who want to use the internet in a very private way can find ways to do so - although this may involve inconvenience (use of cyber cafes) and use of a blog or other means rather than a normal URL. Those who want a regular website such as or cannot expect a whole lot of privacy, and certainly not anything close to absolute privacy.


1 comment:

  1. By crafting the law in this way there is an assumption made that the government, company, or trademark holder will always do the right thing, not a smart assumption in this day and age.

    For example, what is to stop a government, company or other entity interested from looking up without a warrant or court order the private details of an individual who is a 'whistleblower' or has done something that is not illegal but is 'disliked' and quietly talking to them, suggesting they stop what they are doing or there may be consequences?

    Governments and companies like everyone else should be required to get a warrant and / or court order. This allows other individuals (judges etc.) to have an opinion on the request, allow or disallow the request and most importantly it provides a 'paper trail' that the request was made and granted or not granted, as opposed to a phone call or request over lunch, which is not as traceable.