Legal information related to PIPEDA
Letter released about Abika.com, an online data broker in the U.S.
To inform Canadians of the serious privacy concerns associated with online data brokers, the Privacy Commissioner of Canada today released the following letter about Abika.com, an online data broker in the U.S. that collects, uses and discloses the personal information of Canadians.
November 18, 2005
I am replying to your letter of complaint against Abika.com under the Personal Information Protection and Electronic Documents Act (PIPEDA). In your letter of complaint received in our Office on December 24, 2004, you allege that Abika.com collects, uses, and discloses the personal information of Canadians without their knowledge and consent. You also allege that Abika.com compiles and discloses inaccurate personal information under its “psychological profile” service. On March 12, 2005, you clarified that you were alleging not only non-consensual collection, use and disclosure of personal information about Canadians and the provision of false information, but also the collection, use and disclosure of personal information about Canadians for inappropriate purposes.
In 2004, you ordered two searches on yourself from Abika.com: a criminal records search and a psychological profile. You were charged approximately US $100. You were not asked for any proof of identity at that time. You state that the psychological profile is completely inaccurate and we noted that the criminal records check refers only to Ontario.
In the course of our inquiries, we looked at Abika.com's website and learned that Abika.com offers a number of services, including a variety of searches on individuals. Among other things, it purports to provide:
- Background checks including criminal records, court records, education, rumours, current address and 20 year address history, police reports, property ownership, employment status, tax liens, civil judgments, driving history and telephone or cell phone records.
- Psychological profiles including personality traits, consumer preferences and romantic preferences.
- Matching of email or instant message to address or phone number, and of new email addresses to old ones.
- Unlisted numbers and cell phone numbers.
- Details of incoming or outgoing calls from any phone number.
- License plate searches leading to name, address, driving history and insurance status.
We contacted Abika.com in Cheyenne, Wyoming to ask the organization to provide us with the contact information of its Canadian-based sources to aid us in pursuing the investigation. Our investigator informed you that Abika.com responded to our letter of notification to indicate that Abika.com acts as a search engine, not a database. Our investigation efforts have been frustrated by the fact that Abika.com would not respond to our request for the names of Canadian-based sources.
As you know, subsection 11(1) of PIPEDA states that:
An individual may file with the Commissioner a written complaint against an organization for contravening a provision of Division 1 or for not following a recommendation set out in Schedule 1.
Subsection 12 (1) of PIPEDA states that:
The Commissioner shall conduct an investigation in respect of a complaint?
In order to investigate Abika.com based in Cheyenne, Wyoming, our Office must have the requisite legislative authority to exercise our powers outside Canada. However, basic principles of sovereignty and comity under international law state that a country cannot legislate outside its borders. The general convention is that Canada only legislates for Canada and only regulates activities within its borders. While Parliament may legislate with extraterritorial effect, this is rarely done. In the infrequent case that it is, it is for national security purposes or for a limited class of other purposes. In assessing whether a statute is to be applied outside Canada, a court will consider the intention of the legislature when it enacted the statute. There is a strong presumption that, absent an explicit or implicit contrary intention, Canadian legislation will only apply to the persons, property, juridical acts and events that occur within the territorial boundaries of the enacting body’s jurisdiction.
There is nothing explicit in PIPEDA to suggest that it was meant to apply outside of Canada or that the powers of the Commissioner would extend beyond Canada’s borders. According to leading case law, where the language of a statute can be construed so as not to have extraterritorial effect, then that construction must be adopted. It seems clear that this Act should not be construed to have extraterritorial effect. In the absence of any express or implied legislative intent, I must conclude that PIPEDA has no direct application outside of Canada.
While it is clear that the Commissioner may request information from anyone who she believes may have information relevant to an investigation, the formal investigative powers apply only within Canada. Abika.com has not responded to our request for the names of its Canadian-based sources. As such, we have no means of identifying - let alone investigating - those who would represent a Canadian presence for this organization and further, have no ability to compel an American organization to respond.
Although you referred only to Abika.com, we noted that an Abika.ca existed and enquired with respect to its registration information, on the understanding that a “.ca” registration could not be granted without a Canadian presence. We learned that the registrant of the “.ca” may be a Canadian citizen, but is still residing and working in the United States. In other words, despite the existence of a “.ca” registration, there are still insufficient connecting factors to indicate a real and important link between Canada and Abika.com’s operations in the U.S. As such, we cannot bring Abika.com within Canadian jurisdiction and deem them subject to PIPEDA. As for the legitimacy of the website registration application, we have referred this matter to the Canadian Internet Registration Authority (CIRA) to pursue further.
Global e-commerce poses challenges to all national governments that attempt to safeguard privacy and protect consumers. As you are aware from ongoing meetings with our Office, we share your concerns about the indiscriminate, non-consensual collection, use, and disclosure of personal information by profiling and data broker organizations. We agree that this raises serious privacy considerations. To this end, we have asked the Government of Canada to advise us what formal protocols, if any, exist that would allow us to investigate potential privacy breaches which may violate Canadian data protection laws. As important as it is, however, the specific instance you raise cannot be resolved through the complaint mechanism under PIPEDA.
Please be assured that from a policy perspective, we are as frustrated by this state of affairs as you, and we are pursuing the following initiatives with respect to the transborder dataflow issue:
- The Commissioner recently made a presentation at an OECD meeting in Paris that addresses sections 20 to 22 of the OECD guidelines and deal specifically with transborder dataflow and mutual co-operation. We are doing the same with APEC. This issue has rested fundamentally unexplored in a number of multi-national fora for many years; we are pushing to get some action.
- We are looking to obtain the requisite authority (MLATs, MOUs) to be able to pursue this sort of issue with the U.S. in the future.
- We are working to develop fact sheets and are in discussion with the Office of Consumer Affairs at Industry Canada with respect to consumer education.
With respect to these policy initiatives, our Director of Research and Policy, Stephanie Perrin, will be contacting you in the near future to consult you on your views, and enlist the involvement of your organization.
You also requested that we work with the U.S. Federal Trade Commission (FTC) with whom you have also filed a complaint. We did meet with the FTC to carry out discussions on a wide range of issues. As its web-site points out, privacy is a central element of the FTC’s consumer protection mission. While the FTC does not resolve individual consumer complaints, it uses them to spot new trends, uncover new scams, and target suspect companies and individuals for law enforcement actions. I would like to bring to your attention that the American organization, Electronic Privacy Information Center (EPIC) filed a complaint with the FTC on July 7, 2005, urging it to investigate online data brokers, arguing that the information cannot be obtained without violating US federal laws. (For further details, please see the Complaint and Request for Injunction, Investigation and for Other Relief.) We will be watching this closely to see if it helps to uncover any Canadian profilers.
In conclusion, we cannot proceed with your complaint as we lack jurisdiction to compel U.S. organizations to produce the evidence necessary for us to conduct the investigation. As a result, I am sorry to say that we have no choice but to close this file. The organization has been so informed. However, you should know that we have just recently launched an investigation in respect of a similar organization where we have been able to identify the Canadian sources of data.
(Original signed by)
Assistant Privacy Commissioner of Canada (PIPEDA)