kim_kardashian_portrait_2009

“Society has been scrambling to catch up to this problem [the publication of intimate photos or videos online without consent] and the law is beginning to respond to protect victims.” – Justice Stinson in Jane Doe 464533 v N.D., 2017 ONSC 127

Gradually courts have been awarding damages for the tort of public disclosure of private information. The tort of public disclosure of private information consists of the following elements: (a) the defendant publicized an aspect of the plaintiff’s private life; (b) the plaintiff did not consent to the publication; (c) its publication would be highly offensive to a reasonable person; and (d) the publication was not of legitimate concern to the public.

In Jane Doe 72511 v N.M., [2018] OJ No. 5741, Jane Doe sued her ex-boyfriend for abusing her and for uploading an intimate video of them online. Jane Doe also sued her abuser’s parents for failing to stop the abuse in their home.

One day, after a highly violent encounter, Jane Doe reported the defendant N.M. to the police. “N.M. forced Jane into his car… N.M. grabbed her head and smashed it into the passenger side window. Jane pulled the mirror down and, seeing that she was bleeding, ripped off the sun visor in shock… N.M. was angry that Jane had damaged the car. He parked in the driveway and came around to her side of the car… he dragged her out of the car by her feet and shoved her into his parents’ house.” He was charged and later convicted of assault.

In retaliation for his criminal conviction, N.M. uploaded a video of them engaged in a sex act. The video was seen over 60,000 times and downloaded an unknown number of times. The video has since been removed at the request of the plaintiff.

In deciding the civil suit, Justice Gomery found that N.M. was liable for assault, battery, and public disclosure of private information. He was ordered to pay her $20,000 in general damages for the abuse and $100,000 for the posting of the video online ($75,000 for general and aggravated damages and $25,000 in punitive damages). His parents were also found to be jointly and severally liable for Jane’s damages from the assault and battery as occupiers of the house. As occupiers of the house, they had a duty to take steps to keep her safe while she was there.

In recognizing the tort of public disclosure of private information, Justice Gomery reaffirmed that the courts should provide a civil recourse for victims of public disclosure of private information. Justice Gomery wrote that our courts need to “address a challenge posed by new technology… Failing to provide a remedy in this case would deprive Jane of recourse in the face of the breach of her privacy rights.”

In this case, the website was not sued for the publication of the video. Perhaps the company running the website was outside the jurisdiction of Canada. In which case, the best recourse may be to pressure the company in charge of the domain name registration to disable the site’s web address. (see the NYT article “Shut the Site Down,’ Says the Creator of 8chan, a Megaphone for Gunmen.) However, if there was a connection to Ontario, then courts should be willing to assume jurisdiction and sanction a company in the appropriate circumstances.

In the article “Ontario’s New Invasion of Privacy Torts”, Sarit Mizrahi writes that “the courts should be willing to treat a company’s decision to utilize inadequate security measures as sufficient to engage the tort of intrusion upon seclusion and public disclosure of private facts where the risk of privacy is appreciated.” Malicious users exist beyond revenge porn, including hackers. Hackers can exploit security flaws in our devices to breach privacy rights and disclose private information. For example, hackers can gain access to a television’s microphone and listen in on you in your home; hackers can gain access to a baby monitor; they can access a company’s database of credit cards and release the information.

Mizrahi writes that “While the law obliges these companies to protect the information and devices against unauthorized access, the reality is that the steps taken are often insufficient to abolish the security flaws exploited by malicious users… users are often left without a sufficient legal remedy for this serious invasion of their privacy.” By recognizing a civil right of action, the courts are enabling individuals to enforce their privacy rights.

(This article was originally posted on slaw.ca; Views are my own and do not reflect the views of any organization.)