3 ms·
I hear what you are saying about the intent of the actor, but that's tricky. What if the actor doesn't believe in private property? What if the actor accidental
by harryh 9y ago
I hear what you are saying about the intent of the actor, but that's tricky. What if the actor doesn't believe in private property? What if the actor accidentally misreads "private" as "public."? These things aren't really mitigating.
This is why the law tends to fall back on what a hypothetical "reasonable person" would think.
I'm not as much of a hardliner as rayiner on this particular case as I think there are some facts in favor of thinking of these documents as public:
- it was a government website
- it was specifically set up for the purpose of sharing foia requests
- the data in the documents was not easily identifiable as private
But when it comes to the general principle where some HNers seem to think "If the webserver responds with a 200 then it's perfectly fine." I have to disagree.
Imagine a different scenario in which we were talking about tax returns instead of foia requests. You're looking at yours at http://www.canadataxes.com/return?id=1234 http://www.canadataxes.com/return?id=1234 and you realize that if you inc the ID you get the tax return of some other random Canadian citizen. In that case it would be immediately obvious that someone had made a mistake and you were accessing information you shouldn't. A "reasonable person" would understand that a mistake had been made. It would then be clearly illegal to write a script to scrape down the docs for every ID.
- EamonnMR 9y agoLet's say he picked his first random URL and got someone's tax documents. A reasonable person would probably report it and quit prying. But it sounds like the bad documents where mixed in with good documents that he was downloading programmatically, so a reasonable person probably would not have the time to read every single document to determine if it contained personal information.
- harryh 9y agoYes, that's what I was getting at when I said: "the data in the documents was not easily identifiable as private" as a mitigating factor.
- c22 9y agoBut what if someone had just moved to Canada from Norway and didn't realize that tax return information was supposed to be private? I think it's fair to put most of the responsibility on those who have implemented a system that serves private data in response to public http requests. Presumably this is the party that has both been entrusted with the private data and has the technological and legal resources to understand what can and cannot be served publicly and appropriately configure their systems to do so.
- harryh 9y agoThose that move from one country to another are responsible for learning the laws and customs of the place they are moving to.
- c22 9y agoNo doubt. I still would consider the implementors of said contrived-example-website to be far more liable than our hypothetical confused batch downloading Norwegian friend. Just like I don't yell at my toddler when she knocks over the glass of water I left on the floor.
- harryh 9y agoI agree that the Canadian government has been negligent in the situation under discussion. It's not an either or situation though. Both can be guilty at once.