More on Facebook and defamation

Not much of a privacy angle here, but I thought I'd post it nevertheless.

I was interviewed yesterday by the CBC to talk generally about issues related to defamation and Facebook, after it was reported that Facebook has shut down a group that falsely accused a Nova Scotia university of using dogs for scientific experiments.

Here's the video:

Substantial potential economic losses don't cut

A plaintiff seeking compensation for having personal information compromised has to face the hurdle of needing to prove damages. Under a conventional cause of action for negligence, harm is an essential element. If there is no harm, there's no negligence. No negligence, no cash. Just a risk of harm or an increased risk of harm is not enough.

This was recently affirmed by a US federal appeals court, which denied a class action brought following the release of personal information of customers of Old National Bancorp. See Wired's coverage:

Threat Level - Wired Blogs

Tens of thousands of Old National Bancorp customers whose personal and financial information was hijacked by a computer hacker cannot recover damages from the Indiana banking institution who lost the data in 2005, a federal appeals court ruled Thursday.

In dismissing a proposed class action against Old National Bancorp, the 7th U.S. Circuit Court of Appeals said damages were unavailable to victims of data theft if those victims did not suffer economically.

The three-judge panel of the circuit, mirroring decisions of federal courts in Ohio, Minnesota, Arizona and Michigan, ruled (.pdf): "Without more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy."

The plaintiffs did not allege direct financial loss and did not claim they had been the victim of identity theft. They alleged they suffered "substantial potential economic damages" and demanded compensation for emotional harm out of fear they would suffer economic damages by those who stole their information.

The bank's customers also demanded a "monitoring procedure to insure prompt notice to plaintiffs of any attempt to use their confidential personal information stolen from the defendants."

The appeals court also ruled that the law in Indiana, where the bank is located, did not protect the customers either.

"Had the Indiana Legislature intended that a cause of action should be available against a database owner for failing to protect adequately personal information, we believe that it would have made some more definite statement of that intent," the court wrote.

The court added that the plaintiffs "have not come forward with a single case or statute, from any jurisdiction, authorizing the kind of action they now ask this federal court, sitting in diversity, to recognize as a valid theory of recovery under Indiana law."

The court noted that the investigation into the security breach was under seal. But the judges added that "the scope and manner of access suggests that the intrusion was sophisticated, intentional and malicious."

Town gossip over sex assaults hits Facebook

In an unsolicited media blitz, I had three reporters call me yesterday about three different stories. The second was about a facebook group that popped up in the wake of a series of unsolved sexual assaults in Carman, Alberta. The group, called "Kiss my ass, Carman rapist", included speculation on who might be a suspect. I understand that the group has since been removed, but it raises the usual internet defamation issues:

Town gossip over sex assaults hits Facebook

... David Fraser, a Halifax lawyer who specializes in privacy and Internet law, said a host of legal issues arise when water-cooler chats move to the Net.

"What was a small conversation in the drug store or at the post office is now being broadcast globally," he said.

Fraser said anyone naming "suspects" or calling someone a rapist online is opening themselves to a potential lawsuit.

"The rules of defamation that apply in the real world also apply online," he said.

"The anonymity of the Internet ... actually makes it easier to say things that perhaps they wouldn't say in front of a crowded auditorium full of people, although there's probably more people seeing it online."

Australian Court awards damages for breach of privacy

This is an interesting development.

An Australian court has awarded damages for breach of privacy following the revelation by the Australian Broadcasting Corporation of the identity of a rape victim. This is important to Australia, but may also have a secondary effect here in the great white north, as Canadian courts are relatively open in citing and following other common law decisions. For the full scoop, check out Open and Shut: Victorian Court awards damages for breach of privacy.

Boring lawsuit over Google's "Street View"

(I couldn't resist.)

Mr. and Ms. Boring of Pittsburgh is suing Google for intentional invasion of privacy since Google's Street View feature shows a picture of the home despite the fact that their street is marked as a private road. The Smoking Gun has the facts and their pleadings:

Couple Sues Google Over "Street View" - April 4, 2008

APRIL 4--A Pittsburgh couple is suing Google for invasion of privacy, claiming that the web giant's popular "Street View" mapping feature has made a photo of their home available to online searchers. Aaron and Christine Boring accuse Google of an "intentional and/or grossly reckless invasion" of their seclusion and privacy since they live on a street that is "clearly marked with a 'Private Road' sign," according to a lawsuit the couple filed this week in Allegheny County's Court of Common Pleas. A copy of the April 2 complaint can be found below. According to the Borings, they purchased their Oakridge Lane home in late-2006 for "a considerable sum of money," noting that a "major component of their purchase decision was a desire for privacy." But when Pittsburgh was added last October to the roster of cities covered by Google's "Street View" feature, the Borings allege, their "private information was made known to the public," causing them "mental suffering" and diminishing the value of their home (which cost the couple $163,000, according to property records). The Borings are seeking in excess of $25,000 in damages and want a court order directing Google to destroy images of their home. Click here for some photos of the Boring property, which is now even easier to locate via Google Maps, since the plaintiffs included their home address on the lawsuit's first page. And while they are litigating, perhaps the Borings should consider suing Allegheny County's Office of Property Assessments, which includes a photo of their home (which was built in 1916 and sits on 1.82 acres) on its web site. Here's a screen grab. (8 pages)

If you look at the pictures of their property, you might think that if the Borings were concerned about their privacy they would have put a fence around their pool. I'm just saying ...

UPDATE (2008.04.06): The Wall Street Journal's Law Blog has a response from Google:

There is no merit to this action. It is unfortunate litigation was chosen to address the concern because we have visible tools, such as a YouTube video, to help people learn about imagery removal and an easy-to-use process to facilitate image removal.

As a matter of policy, imagery for Street View is taken in public streets and what any person can readily capture or see in the public domain. Street View is a popular, engaging feature that allows people to easily find, discover, and plan activities relevant to a location.

What's most interesting -- at least from my perspective -- is that this argument doesn't hold much water in Canada. Up here, there are two different privacy laws. There is some caselaw that's similar to tort law in the US suggesting that you can sue for invasion of privacy, if there's been an "unreasonable invasion of privacy". In the US, there is no expectation of privacy in the streets or in a public place and, other than in Quebec, that's probably the law in Canada. The second law is PIPEDA, which is a separate statute that governs all collection, use and disclosure of personal information in connection with commercial activity. Since Google's doing commercial activity, the law requires consent for the collection and disclosure of personal information. (There's some serious doubt that the photo of your house without any other information would be your personal information.) Since street view often includes photos of people, Google would require consent to use those photos for commercial purposes. Since the Google street sweepers do not get consent, there's no easy way to have street view in Canada.

I expect that Google will have technology to blur out individuals so they can take street view to Canada and other jurisdictions where privacy laws would prohibit photos of pedestrians.

Finding the smoking gun in security breaches

In most cases of fraud following a security breach, the biggest problem for consumers seeking a remedy is proving the connection between the breach and the ensuing fraud. According to CIO Blogs, the TJX breach is different and a small bank in New England has made the connection. It has found the smoking gun and says it will seek damages against the company.

This may be the wakeup call that will force companies to be more diligent about security. See: CIO Blogs - The TJX security breach. This one's different. Way different. |.

Thanks to John Gregory for the link.

Second video voyeurism conviction in NS

The second (that I know of) conviction under Canada's new voyeurism laws took place yesterday in Halifax.

The Daily News: News Former sailor pleads guilty after trying to videotape neighbour

LINDSAY JONES

The Daily News

CRIME – A former sailor has pleaded guilty to trying to videotape a woman while she was changing in her own apartment.

In August of 2006 the woman was getting dressed in her walk-in closet when she spotted a video camera in the window pointed towards that part of the room. She was changing in the closet because her window was only partially covered by a blanket.

Karlson Glen Chaulk, who had been in the armed forces for nearly seven years, lived in the apartment above her. The two did not know each other, the court heard.

The woman called police and Chaulk admitted to committing the offence. He asked police if there was any way to make it go away, the court heard. Police found no images on the video camera.

Chaulk has two previous convictions, for impaired driving and possessing narcotics.

The court heard the victim moved from the residence because she no longer felt safe, costing her her damage deposit and moving expenses.

Chaulk told the court he was “truly sorry” for his actions and promised it would never happen again. “I do realize now that I shouldn’t have conducted myself in the way I did with the camera,” he said.

Judge Michael Sherar said not only is the charge sad and juvenile, but also deplorable. He asked Chaulk what he intended when he surreptitiously looked into someone else’s apartment. He also outlined how everyone has the right to privacy in their own home.

Chaulk has since resigned from the Defence Department and plans to move to Alberta tomorrow.

He was sentenced in Halifax provincial court yesterday to 90 days probation, ordered to pay a $500 fine and $450 restitution to the victim, as well as undergo counseling. He must also stay 150 metres from the woman’s home and workplace.

Chaulk is the second person in Canada to be sentenced for voyeurism, since the law was enacted in November 2005. The law makes it illegal to “surreptitiously observe or make a visual recording” for a sexual purpose.

The only other prosecuted case of voyeurism in Canada also took place in the province.

Winston Charles Patriquin of Port Howe, Cumberland Co., pleaded guilty last August to using a video camera to tape a girl in the bathtub.

ljones@hfxnews.ca

---

Technology takes place of peeping Toms: lawyer

A Halifax privacy lawyer says technology is taking the place of the guy lurking outside the window.

David Fraser said what’s traditionally considered trespassing is now occurring digitally, without the physical presence of a perpetrator.

“People can be observed in a number of different contexts,” he said. “Hidden cameras in change rooms in stores. Hidden cameras in bathrooms in hotels.”

Canada’s voyeurism law was enacted in November 2005 to better protect children and other vulnerable victims from harm. The law makes it illegal to “surreptitiously observe or make a visual recording” for a sexual purpose.

Fraser said the law reflects the potential seriousness and intrusiveness of voyeurism. Enacting it was necessary, he says, to keep up with technological advances and the advent of miniature, wireless cameras.

“Thousands of companies sell wireless cameras and it’s pretty plain in the description of their products that they’re selling them for this sort of voyeurism,” he said. “Once this information is in digital form, it’s very easily transmitted.”

— Lindsay Jones

Suing for privacy invasion

David Canton's regular Canoe.ca and London Free Press column this week discusses the movement toward recognizing the right to sue for invasion of privacy. See: eLegal Canton: Can we sue for privacy invasion?.

Live in NJ? You apparently have a right to online privacy

Wired's 27B Stroke 6 is reporting on an interesting decision from New Jersey in which an appeals court has held that internet users have a right to privacy in their "ISP Address" or "screen name". While technologically incorrect, I'll leave it to others to comment on whether it's technically correct. See: WIRED Blogs: 27B Stroke 6: Jerseyites Have Right to Protect "ISP Address".

Winners class action

This didn't take long: WINNERS STORES NATIONAL CLASS ACTION.