The Ontario Superior Court of Justice released its decision on an application in York University v. Bell Canada Enterprises this Friday.  The case is based on an allegedly defamatory e-mail about the President of York University, Mamdouh Shoukri, saying he had “perpetrated an outrageous fraud.”

A group calling itself “York Faculty Concerned About the Future of York University” protested the appointment of Martin Singer of the new Faculty of Liberal Arts and Professional Studies, questioning his credentials and attaching a letter from other academics who did disclose their names.

But the University is more interested in the identity of the unsigned e-mail, presumably by York faculty, sent from a Gmail account, yfcfyu@gmail.com.

G.R. Strathy J. approved a Norwich order against Bell Canada Enterprises and Rogers Communications Inc. to disclose the identity of the account owners.  A previous order had been approved against Google back in May, which identified the two ISPs as the holders of the information.

A Norwich order is a pre-action discovery mechanism that is described by Spence J. in Isofoton S.A. v. The Toronto-Dominion Bank,

Requests for Norwich relief are largely unfamiliar to Canadian courts.  A Norwich order essentially compels a third party to provide the applicant with information where the applicant believes it has been wronged and needs the third party’s assistance to determine the circumstances of the wrongdoing and allow the applicant to pursue its legal remedies.

The 5 elements identified in this case for granting such an order include:

(i) Whether the applicant has provided evidence sufficient to raise a valid, bona fide or reasonable claim;
(ii) Whether the applicant has established a relationship with the third party from whom the information is sought such that it establishes that the third party is somehow involved in the acts complained of;
(iii) Whether the third party is the only practicable source of the information available;
(iv) Whether the third party can be indemnified for costs to which the third party may be exposed because of the disclosure, some [authorities] refer to the associated expenses of complying with the orders, while others speak of damages; and
(v) Whether the interests of justice favour the obtaining of disclosure.
[emphasis added]

The privacy interests of the alleged wrongdoer were overcome by the last element, the interests of justice, because of the applicant’s equitable right to information.  Spence J. pointed to Alberta v. Leahy and Bankers Trust Orders (from Bankers Trust Co. v. Shapira) indicating that court orders can override confidential information, even for financial records, and Glaxo-Wellcome PLC v. M.N.R. that the privacy interests of alleged wrongdoers is somewhat diminished.

What is troubling about the latter citation is that the rationale used by the Federal Court of Appeal was that the information could not be considered especially sensitive since it had passed through several hands.  Although the York case does demonstrate that multiple parties may be involved in identifying a defendant, many privacy watchdogs would be concerned that IP information loses its privacy value simply because it is shared.

However, Spence J. did point to other reasons why the privacy expectation may be overridden, because the information is limited by terms of the order for specific purposes and the use of this information is not absolute.  Additionally, a strong case of fraud removes the possibility of a frivolous or vexatious application of the order.

G.R. Strathy J. also discussed the necessity of granting the order for York by citing GEA Group AG v. Ventra Group Co,

…there is no suggestion in the established jurisprudence that [necessity] is a stand-alone requirement for the granting of a Norwich order…

In my opinion, the precise placement of the necessity requirement in the inventory of factors to be considered on a Norwich application is of little moment. The important point is that a Norwich order is an equitable, discretionary and flexible remedy. It is also an intrusive and extraordinary remedy that must be exercised with caution. It is therefore incumbent on the applicant for a Norwich order to demonstrate that the discovery sought is required to permit a prospective action to proceed, although the firm commitment to commence proceedings is not itself a condition precedent to this form of equitable relief.

…The crucial point is that the necessity for a Norwich order must be established on the facts of the given case to justify the invocation of what is intended to be an exceptional, though flexible, equitable remedy.

G.R. Strathy J. then pointed to a number of other ways that this information could be obtained without the Norwich order, including the pre-action disclosure in the now-infamous Cohen v. Google Inc. Although both ISPs had privacy policies for the customers, these could be overridden by s. 7(3)(c) of PIPEDA to comply with a court of law.

Given the recently ruling, and assuming it’s not overturned in the future, it’s likely were going to see more Norwich orders used for the purposes of identifying Internet activity.