The leak of the confidential files of a Panamanian law firm, dubbed the “Panama Papers,” has generated much press coverage, but there has been surprisingly little comment about the privacy rights of those named in, or linked to, the disclosures. It seems obvious that the public exposure of the personal information (“PI”) contained in the documents that were unlawfully obtained by an anonymous hacker raises serious privacy concerns for those individuals who are named. In fact, the International Consortium of Investigative Journalists (“ICIJ”) and other media outlets could well be facing regulatory complaints or even tort claims for unauthorized use of PI and/or invasion of privacy under Canadian law. If so, the release of PI by ICIJ members could qualify as the largest intentional privacy breach ever made in Canada by an identifiable entity.
The release of the PI contained in the Panama Papers has taken place in distinct stages. First, the members of the ICIJ published news stories in their respective jurisdictions listing individuals who had set up offshore accounts and companies with the Panamanian law firm (for example, see news stories from The Guardian, Süddeutsche Zeitung and the ICIJ). In general, this initial round of stories listed names and, in some cases, additional details of politicians, celebrities and others, whose creation of offshore accounts and companies, even if perfectly legal, would arguably be of interest to the public (and possibility tax authorities).
More recently, the ICIJ has made available a searchable database containing the confidential information of more than 320,000 offshore companies and trusts. There is an abundance of PI contained in this database, including the names and/or addresses of: (i) directors or shareholders of an offshore company; (ii) the names and addresses of offshore companies; (iii) a list of intermediaries involved with offshore bank accounts. Despite the questionable way in which the documents became public information, as well as the fact that many of the documents are likely protected by solicitor-client privilege, many news media outlets have themselves combed through the Panama Papers database, or encouraged others to do so, to draw conclusions regarding the financial affairs of individuals and companies worldwide.
It is not possible to know with any certainty the purposes for which an individual may be affiliated with an offshore company/trust/account and may find their PI listed in, or linked to, the Panama Papers. A reasonable assumption might be that some or all of these individuals wished to minimize their tax exposure in their home jurisdiction, to engage in tax evasion or to otherwise make the discovery of their income or assets difficult. However, it is also reasonable to assume that many of the individuals now being dragged through media scrutiny originally created offshore accounts and/or companies in an attempt to protect their privacy.
The question which must therefore be asked is whether the release of the names and details of the individuals in the Panama Papers through the database is a breach of Canadian privacy law, and, if so, whether the fact that journalists are making the disclosure somehow saves the disclosure from being such a breach. There are noble and historic reasons to protect journalists and to provide them statutory exemptions from various legal mechanisms. The common law is no different. It has evolved to protect the needs of journalists in a free and democratic society. There are, however, limits. For example, while freedom of expression is a cornerstone of the Canadian Charter, the press is routinely subject to publication bans.
From a Canadian perspective, the collection, use and disclosure of the PI by the members of the ICIJ could be a breach of Canadian privacy statutes or could lead to tort liability for the one of the emerging torts of breach of privacy.
The collection, use or disclosure of PI in Canada is governed by the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (“PIPEDA”) and similar legislation in some provinces. In general, PIPEDA prohibits the collection, use or disclosure of an individual’s PI unless they have given informed consent, which obviously was not given in respect of the Panama Papers PI. Those supporting the disclosure of PI in the Panama Papers database will likely point to s 4(2)(c) of PIPEDA, which exempts any organization that collects, uses or discloses PI for “journalistic purposes.”
In 2012, in Jones v. Tsige, 2012 ONCA 32, the Ontario Court of Appeal declared the existence of a freestanding tort of “intrusion upon seclusion.” The key features of the cause of action are, first, that the defendant’s conduct must be intentional (which includes recklessness); second, that the defendant must have invaded, without lawful justification, the plaintiff’s private affairs or concerns; and third, that a reasonable person would regard the invasion as highly offensive, causing distress, humiliation or anguish. Proof of economic harm is not required, and the scope of the tort was expressly stated to be subject to “freedom of the press,” although the court did not define the scope of this limitation. Damages for “intrusion upon seclusion” will ordinarily attract only moderate damages of up to $20,000. Awards of aggravated and punitive damages may be appropriate in exceptional cases.
Canadian courts are also moving to recognize other privacy-related torts which have their origins in US law, including public disclosure of embarrassing private facts and publicity which places the plaintiff in a false light in the public eye (see Doe 464533 v N.D., 2016 ONSC 541 at paras 41-48; Grant v. Winnipeg Regional Health Authority et al, 2015 MBCA 44 at para 26; Doe v. Canada, 2015 FC 916 at paras 41-43). The tort of public disclosure of embarrassing private facts includes a requirement that the matter is not “of legitimate public concern,” while the other invasion of privacy torts require that a reasonable person would regard the invasion of privacy as highly offensive.
In our view, while there may well be public outrage as to the use of offshore accounts and tax havens, there are serious questions concerning whether there is truly a “journalistic purpose” for the public disclosure of the Panama Papers PI through the creation of a public database. In particular, while it can be cogently argued that the original stories published about selected individuals in the public eye using offshore accounts and corporations have a journalistic purpose, the publication of a database containing the PI of all the individuals named in the Panama Papers is far from black-and-white. This is not a case of exposing government or individual wrongdoing – the members of the ICIJ have repeatedly stated that the appearance of someone in the Panama Papers does not mean that they were involved in any activities which are illegal or even morally blameworthy. As David Canton has already noted, the Panama Papers leak is not the same as the Snowden leaks and the nature of the information which was leaked “does not justify this kind of breach to the press.”
It has been made clear by the ICIJ that the searchable Panama Papers database was only released because, other than the original set of stories which targeted a small subset of noteworthy individuals, their reporting partners did not have sufficient resources to determine whether there might be a public interest in the other individuals named in the database. As Mar Cabra, editor of the ICIJ Data and Research Unit stated, the ICIJ“ […] wanted to start tapping into the public’s power to crowdsource tips and stories that we probably may have missed.” In other words, by releasing the PI of all of the individuals named in the Panama Papers, the members of the ICIJ decided to outsource the examination of the Panama Papers to the public in the hopes of finding additional stories that the journalists did not have the information or resources to identify.
While the scope of both the “journalistic purpose” exemption in PIPEDA and the corresponding exemptions which could apply in respect of the privacy torts outlined above have not yet been well-defined by Canadian courts, it is clear that those justifications must have some reasonable limits. Journalists cannot randomly expose the PI of private individuals without demonstrating that the disclosure is for a legitimate journalistic reason, which will generally require some important public interest that justifies the disclosure. In addition, whatever test is to be used to determine the appropriateness of such disclosure will also probably consider the nature and source of the PI in issue. The fact that, as with the Panama Papers, the PI being disclosed is financial in nature (generally considered to fall within the class of “sensitive” information subject to enhanced protection) and that the PI was obtained illegally and in breach of solicitor-client privilege would likely indicate that an even more stringent standard be applied to the determination of whether the disclosure can be justified.
In our view, it is certainly arguable that there is little or no “legitimate public concern” which would justify the public disclosure of all the PI in the Panama Papers database, especially since it is undisputed that many, if not most, of the individuals named in the database have done nothing illegal by setting up offshore accounts or being involved with offshore corporations. In essence, the members of the ICIJ have violated the privacy of a large number of innocent individuals in the hopes that members of the public will identify new stories to be published by those journalists who released the information. It is also likely, and ICIJ members would have been well aware, that an individual’s inclusion in the Panama Paper’s database had the likelihood, if not a certainty, to cause embarrassment and potential harm to the individual. It strikes us, as privacy lawyers, that such disclosure in such circumstances could well be considered to be highly offensive to a reasonable person and beyond the scope of protected journalistic activity.
If the members of the ICIJ have overstepped the proper bounds of the exemptions to privacy law granted to journalists, the consequences under Canadian law could be severe. Although the damages that have been awarded by the Federal Court for violations of PIPEDA have to date been modest, provincial privacy statutes in Alberta and B.C. have more scope for significant damages to be awarded. And while to date the courts have stated that the damages to be awarded for privacy torts are relatively modest, the number of individuals named in the Panama Papers database (reportedly over 625 Canadians named in the documents) could certainly attract the attention of creative class action lawyers.
While some individuals or corporations named in, or linked to, the Panama Papers may be engaged in inappropriate, unethical or even illegal activity, we believe that it is questionable whether the invasion of the privacy of numerous other individuals is truly justified, or whether those individuals are without a legal remedy. It may in time turn out that the publication of the Panama Papers database will be seen as Canada’s largest intentional privacy breach.