Kevin Osborne is a first year law student at Osgoode Hall and is taking the Legal Values: Challenges in Intellectual Property course

When you give your email address to a website, do you expect that site to offer it to anyone who asks for it? How much privacy do you expect? A recent case heard by the Ontario Superior Court of Justice , Warman v. Wilkins-Fournier suggests we all have a very low expectation of privacy online.

After reading Adrienne Ng's excellent blog post on the case, I wanted to offer my thoughts on the court's problematic assertion that users of web forums have “no expectation of privacy.”

The Facts
The facts of the case as as follows. Eight defendants posted allegedly defamatory statements on a web forum at freedominion.ca. In order to try to identify these John Doe defendants, the plaintiff asked the forum's owners to disclose their email addresses and IP addresses. The owners refused. The plaintiff sued both the Does and the owners, requesting the Does' information be disclosed.

Duty to Disclose
The court used a two stage analysis. First, they determined the appropriate test for disclosure, then they considered whether there were any policy reasons to counter that test. In the first stage, the court distinguished prior decisions which suggested that a prima facie or bona fide case was required before disclosure could be made. Instead, they held that “the obligation is on the Defendants to disclose.”

I don't want to comment much on this aspect of the case, other than to point out that the plaintiff's identities are irrelevant to establishing a case of defamation. The plaintiff already has access to the allegedly defamatory statements; it should be possible to make a prima facie or bona fide case without learning the plaintiff's identities. If there is any expectation of privacy online, then it is difficult to see why the court would not require at least a bona fide case to be made before disclosing personal information.

“No Expectation of Privacy”
But in considering policy reasons in the second stage of the test, the court held that the forum users had “no reasonable expectation of privacy,” and ordered their information be disclosed. The decision relied on obiter in R. v. Wilson. The court in Wilson held that there is no reasonable expectation of privacy given that the information sought for disclosure (an individual's name and address) was available “in a public directory” and was not “information one expects to be kept private from the state.”

First, it's not clear that the reasoning is Wilson is correct. It's true that names and addresses can be found in a public directory, but this information is not linked to IP addresses. When names and addresses are linked to IP addresses, anything traced to that user's IP address can be traced to that individual. Their anonymity is severely threatened. Indeed, eight days after Wilson was decided the same court held in R. v. Vasic that there was a privacy interest in such information (as Michael Geist pointed out).

However, the courts in both Vasic and Wilson held that the individual's agreement with their ISP allowed for disclosure in spite of any expectation of privacy. Such an argument was not relied on in Warman, likely because the forum's registration form makes no mention of disclosure. Since the obiter in Wilson might not be valid, and since there was no contract allowing for disclosure, there likely was an expectation of privacy.

But even if the obiter in Wilson is valid, Warman can be distinguished. In Warman, the information sought by the plaintiff was the users' IP addresses and email addresses. This information is not available in a public directory, unlike the names and addresses in Wilson. In fact, most web forum software keeps this information private from everyone except the administrators by default.

Furthermore, Wilson dealt with disclosure to the state, but in Warman the disclosure was to a private party. Even if the personal information sought were analogous in both cases, it isn't clear that the users would expect it to be disclosed to anyone other than the state.

Conclusion
The court's decision in Warman significantly restricts privacy rights online. In filing a lawsuit, a private individual could gain access to email addresses and IP addresses without proving any case against the defendants. Thankfully for those who value online anonymity, the latest news is that the defendants are appealing the decision.