Date Issued: September 4, 2025

File: IS-2-2025-003711

Type: Intimate Images

Category: Administrative Penalty

Civil Resolution Tribunal

In the Matter of an Application under the Intimate Images Protection Act
for an Administrative Penalty

Indexed as: Re X Corp., 2025 BCCRT 1228

Publication Ban Applies

NOTICE TO:

X CORP.

 

RESPONDENT

 

NOTICE OF ADMINISTRATIVE PENALTY AND REASONS FOR DECISION
Tribunal Member:	Eric Regehr, Vice Chair

INTRODUCTION

1.      In March 2025, I granted a protection order under Intimate Images Protection Act (IIPA) section 5 in file IS-1-2025-000905. I will refer to it as the protection order decision. The applicant in that unpublished decision, who I will call TR, says X Corp. did not comply with the protection order. TR asks me to order X to pay an administrative monetary penalty for its failure to comply. TR is self-represented.

2.      X says that it complied with the order by restricting access to the intimate image within Canada, a practice it calls geofencing. It argues BC law cannot compel it to take any further steps. X is represented by a lawyer, Andrew Bernstein.

3.      For the reasons set out below, I order X to pay the maximum $100,000 administrative penalty.

JURISDICTION AND PROCEDURE

4.      These are the Civil Resolution Tribunal’s (CRT’s) formal written reasons and order. The CRT has jurisdiction over applications for administrative penalties under IIPA section 16.

5.      Civil Resolution Tribunal Act (CRTA) section 39 says the CRT has discretion to decide the hearing’s format, including whether it is an oral hearing or based on written materials. The CRT’s mandate includes speed, efficiency, and proportionality. The CRT typically obtains initial submissions from parties in IIPA disputes with a fillable PDF form. Even though this is an administrative penalty claim, CRT staff sent the form for protection order respondents to X. As a result, most of the questions on the form X filled out were irrelevant. However, the form ends with a fillable box where parties can include “anything else you would like the tribunal member to know about your response to this claim”. X used that space to provide very brief submissions.

6.      Presumably in recognition of the error, CRT staff invited X to upload evidence and provide further submissions. X did not take either step, despite multiple follow ups. If X had more to say in support of its position, including about the amount of an appropriate administrative penalty if I order one, it had the opportunity to do so. Given that, I find that I can fairly make a decision based on the written material before me.

7.      CRTA section 42 says the CRT may accept as evidence information that it considers relevant and appropriate, even if it would not be admissible in court.

8.      This decision is related to the protection order decision, which I made under IIPA section 5. IIPA section 5(9) says that an individual must not be named in decision related to a “determination or order” under section 5 unless they are a respondent. This is why I have used the initials TR for the applicant. Those are not her real initials.

9.      In the protection order decision, I ordered a publication ban on publishing both parties’ names or anything that would identify them. A publication ban protecting TR’s identity was mandatory under IIPA section 13.

10.   IIPA section 13 does not require a publication ban for administrative penalty decisions. However, I have discretion to order a publication ban, and TR has requested one. I see no reason why there should be a publication ban on the protection order decision but not this decision enforcing it. So, I order a publication ban on TR’s name and anything that would identify her. I also order that the CRT’s dispute file be sealed and only disclosed by order of the BC Supreme Court or the CRT.

11.   Typically, the CRT does not publish protection order decisions or administrative penalty decisions. This is because these decisions generally discuss highly sensitive matters in enough detail that publication could undermine the IIPA’s requirement that applicants’ anonymity be protected. Also, CRTA section 136.4(c) says the CRT does not have to publish intimate image protection decisions, which includes administrative penalty decisions because they are related matters. That said, there is no statutory impediment to publishing administrative penalty decisions, and I decided to publish this one. I did so primarily because it is the first administrative monetary penalty the CRT has ordered against an internet intermediary, so the public may benefit from its publication. I also ensured this decision did not include any information that would inadvertently identify TR, and the publication ban I have ordered otherwise protects her identity.

12.   I previously cancelled and reissued the protection order decision at the request of an affected person who was not a party to that dispute. I had that authority under IIPA section 5(9). That cancellation related only to one image among several at issue in the protection order decision. TR provided evidence about that image in this application, but I find my cancellation renders any failure to comply with that aspect of the protection order moot. The cancellation decision left in place the protection order about another image, which was the focus of the parties’ evidence and submissions here. So, my decision is restricted to considering X’s compliance with that part of the protection order. I will refer to the image at issue simply as the “intimate image”.

ISSUES

13.   The issues are:

a.    Does the CRT have the authority to order X to take actions that affect the availability of content outside BC?

b.    Did X comply with the protection order?

c.    Should I order X to pay an administrative penalty, and if so, how much?

d.    Is TR entitled to compensation for her time spent on this dispute?

ANALYSIS

14.   An administrative penalty is a monetary penalty that the CRT can impose on individuals or organizations who fail to comply with a protection order granted under IIPA section 5.

15.   To succeed in this application, TR must prove that X failed to comply with the protection order. The relevant part of that order required X, as an internet intermediary, to immediately do the following:

a.    Remove the intimate image from any platform it operates and from any other electronic form of application, software, database, or communication method,

b.    Delete or destroy the intimate image, and

c.    De-index the intimate image from any search engine.

16.   First, TR must prove she gave X a copy of the order. It is obvious from X’s response that she did so because it describes the steps it took after receiving the order. TR says she gave X the order on April 2, 2025, but the evidence does not show this.

17.   The earliest evidence from TR is from April 8, 2025. She provided 2 emails from X that said what X did in response to TR’s reports. The emails do not say what the reports were for, and do not mention an order. One email says it had suspended an account for breaching X’s terms of service. The other confirms receipt of a report about a different X user. It does not say what, if anything, X did about the second report. These emails do not prove when TR gave X the order.

18.   TR provided evidence that she submitted more reports on April 9, 2025. One refers to an order, which I infer is the protection order, and includes a list of links to X posts. However, it is not clear whether the posts related to the intimate image because the links no longer work. There are no screenshots of those posts. This email shows TR likely gave X a copy of the order on April 9, 2025, but without knowing what the posts contained, I cannot conclude that she reported that someone had posted the intimate image.

19.   There is one X account that has persistently posted the intimate image. TR provided a screenshot of one such post. I have cross-referenced the URL of that screenshot with an April 14, 2025 email from X confirming it had geofenced the post in Canada. This is consistent with X’s submission that it geofenced the intimate image “on or about” April 13, 2025. So, I find that X received the order along with a report about the intimate image by April 14, 2025. With the information before me, I cannot make a more specific finding than that. I note that, according to X, the reason it geofenced the image in Canada and not just BC is that it cannot geofence by province.

20.   TR started this dispute about an administrative penalty on April 8, 2025. X filed a Dispute Response on July 16, 2025. I understand TR had difficulties serving X, which explains the delay.

21.   TR provided several more emails from X showing it had geofenced more posts in response to TR’s reports. These occurred on April 23, 24, and 29, May 22 and 23, and June 9, 2025. TR uploaded her evidence in late July. I find this shows TR continues to monitor X for the intimate image, and in particular the account that persistently posts it. The reports also show that X has continued its practice of promptly geofencing the posts in response to TR’s reports.

Does the CRT have the authority to order X to take actions that affect the availability of content outside BC?

22.   As noted, the CRT’s authority to make protection orders comes from IIPA section 5. Subsection (2)(c) lists 3 orders the CRT may make against internet intermediaries. The protection order matches the language in IIPA section 5(2)(c). So, the IIPA provided specific statutory authority for the protection order’s terms.

23.   Not all aspects of the protection order apply to X. The relevant parts required X to remove the intimate image from its platform and delete it. X provided no evidence or submissions about its technology, so I do not know whether X could accomplish both things by deleting a post. For the purposes of this decision, I have assumed that deleting a post would also delete the image. Because it is relevant to my discussion, I will also state the obvious point that deleting a post has the effect of making it unviewable anywhere in the world.

24.   X argues that the BC legislature’s authority, and by extension the CRT’s authority, ends at BC’s borders. X says that the IIPA must be read with these territorial constraints in mind. In other words, X argues that whatever the IIPA says about the protection orders available to applicants, it cannot empower the CRT to compel action to restrict or eliminate the online availability of intimate images outside BC. By implication, X also argues that the IIPA cannot empower the CRT to order administrative penalties against X for failing to make intimate images unavailable outside BC. So, X’s argument is essentially that the order to remove the intimate image must be interpreted to only require geofencing. Viewed through that lens, X says it complied with my order.

25.   X refers to 2 Supreme Court of Canada cases: Reference re Upper Churchill Water Rights Reversion Act, 1984 CanLII 17 (SCC) and British Columbia v. Imperial Tobacco Canada Ltd., 2005 SCC 49. Those cases were both about provincial legislation that purported to affect rights outside the provinces in which they were enacted. They turned on the court’s interpretation of section 92 of the Constitution Act, 1867, which defines provincial authority to legislate. Among other things, section 92 empowers a province to pass legislation governing “property and civil rights” within the province.

26.   X does not explicitly frame its argument as a constitutional one, although its submissions mirror the language of “property and civil rights” set out in the constitution. X also does not point me to any cases other than the constitutional cases mentioned above. I considered whether any non-constitutional principles could apply, such as those outlined in the Supreme Court of Canada decision Google Inc. v. Equustek Solutions Inc., 2017 SCC 34. At issue was a BC Supreme Court interim injunction that ordered Google to restrict global access to Google search results. The court had made this order after an interim injunction limited to Canada had been ineffective in mitigating harm. Google contested the court’s authority to make an order with global effect, but the Supreme Court of Canada found that the injunction was valid.

27.   So, the relevant part of the order in Google is analogous to the protection order here because they both purport to have global effect. However, I find the principles outlined in that case do not apply here. I say this because the BC Supreme Court’s source of authority for the initial injunction was equitable whereas the CRT’s source of authority is statutory. This is why the question about the extraterritorial effect of a protection order under the IIPA is a constitutional one while the question about the extraterritorial effect of the interim injunction was not.

28.   With that, I find that the question X’s argument raises is whether the BC legislature exceeded its constitutional authority when it passed the IIPA. This includes both section 5, to the extent it empowers the CRT to make orders to delete or remove content from the internet, and section 13, to the extent it empowers the CRT to order penalties against internet intermediaries who fail to do so. In other words, any attack on the CRT’s authority to make or enforce orders under those sections is, in substance, an attack on the constitutionality of the IIPA provisions that authorize the orders. Under CRTA section 119(a), I have no authority to consider constitutional arguments.  

29.   Rather, I find that I must proceed on the presumption that the IIPA is constitutional. In other words, I must presume that I had the authority to make a protection order with global effect and that I have the authority to enforce that order.

Did X comply with the protection order?

30.   The question about X’s compliance is a very simple one. I ordered internet intermediaries, which includes X, to remove the intimate image. X received the order, but it did not remove the intimate image. Instead, it did something less. X did not comply with the protection order.

Should order X to pay an administrative penalty, and if so, how much?

31.   IIPA section 13 says that the CRT “may” order an administrative penalty for failing to comply with a protection order. A penalty is not automatic.

32.   The CRT’s Intimate Images Protection Order (IIPO) rules apply to administrative penalty claims. IIPO rule 11.5 says that when deciding whether to order an administrative penalty, I may consider:

a.    Whether and when TR provided X with the protection order,

b.    Whether X made every reasonable effort to comply with the protection order, and

c.    Any other factor I consider appropriate. 

33.   As discussed above, TR provided X with the protection order. I do not accept that X made every reasonable effort to comply with it. X is capable of reading an order and understanding its clear terms. X said nothing about its reasons for geofencing rather than removal. The evidence before me suggests that X has an established process where posts and accounts can be deleted rather than geofenced if X determines that content breaches its terms of service. This in turn suggests there was no technological or practical reason for X to take the lesser step of geofencing rather than deleting.

34.   The protection order decision explained the potential of an administrative penalty if X failed to comply with the order. Given all that, I see no reason why X should not be penalized. The final question, then, is how much.

35.   Section 9 of the Intimate Images Protection Regulation (IIPR) sets the maximum penalty. For an organization, the penalty is up to $5,000 per day, to a maximum of $100,000 per penalty order. By including a daily amount, the IIPR recognizes that the harm from the non-consensual disclosure of intimate images is a continuing harm that accrues as long as the image is available. I find that the IIPR requires me to focus on the duration of the non-compliance when deciding an appropriate penalty.

36.   As noted above, X was served by April 14, 2025. It filed a Dispute Response asserting it complied with the protection order on July 16, 2025. I find that it would not be appropriate or fair to penalize X after July 16, 2025, when its compliance was in dispute. This means X is exposed to an administrative penalty for 92 days. This length of time comfortably exposes X to the maximum $100,000 penalty. TR argues that the maximum penalty is appropriate.

37.   Neither the IIPA nor the IIPR provide guidance about how to assess an appropriate administrative penalty. I find it unnecessary to delve deeply into an assessment here because to reach the maximum global penalty, I would only need to conclude that a daily penalty of about $1,075 is appropriate. This is barely 20% of the maximum. I have no difficulty concluding that X’s conduct justifies a daily penalty in excess of that amount.

38.   I acknowledge that X did not ignore the order. It acted promptly to geofence the intimate image. This act probably reduced the number of people who have seen the intimate image by some unknowable number. However, I find it is a minor point in X’s favour, and certainly not a significant enough mitigating factor to justify any substantial reduction from the daily maximum. I say this for 2 reasons.

39.   First, part of the ongoing harm of intimate images being on the internet is the simple knowledge that people might see it. With that in mind, geofencing is really not a solution at all. TR lives in the knowledge that the vast majority of the world’s population can still see the intimate image on X. I also agree with TR that this could include people within Canada who can easily and legally bypass the geofence using VPN services.

40.   Second, the protection order was unambiguous. X’s decision not to comply with it can only be seen as intentional. X’s non-compliance was repeated several times as TR reported more instances where the intimate image appeared in posts. X decided to remain non-compliant even after being served with the Notice of Application, which presented an opportunity for X to reconsider its position. While I am not imposing penalties for the days after X was served, I consider it relevant that X still did not remove the intimate image, even on an interim or contingent basis while this dispute was ongoing. It would have been a simple matter to do so. X’s refusal exposed TR to unnecessary harm and distress.

41.   I also bear in mind that X is a very large corporation with vast resources. I find that part of the purpose of an administrative penalty is deterrence, which militates in favour of heavier penalties for larger respondents.

42.   Taking the above into account, I find an appropriate monetary penalty is $100,000.

43.   Section 10 of the IIPR says that an administrative penalty is due on the date the respondent receives the notice of it. This means the amount ordered is due immediately on receipt of this decision and order.

Is TR entitled to compensation for her time spent on this dispute?

44.   TR asks for compensation for her time spent on this dispute. IIPO rule 11.4(3) says that the CRT will not order a party to pay another party for time spent on a dispute except in extraordinary circumstances. TR says that there have been repeated violations of the protection order on X as posters continue to upload copies of the intimate image. However, it is not X’s fault that people continue to post the intimate image. She also says that X should have accepted service through its online portal, and its failure to do so wasted her time. However, the IIPO rules dictated how TR needed to serve X, and I find X had no legal obligation to accept service through its online portal. 

45.   Also, TR’s reply submissions were drafted with the assistance of artificial intelligence, a fact TR disclosed. It is becoming increasingly common for parties to use artificial intelligence, often resulting in inaccurate or misleading submissions. In a previous unpublished decision, I warned TR about relying artificial intelligence for these reasons. Unfortunately, her reply submissions suffer from the same flaws. For example, the first case cited in her reply submissions is real. The submissions then reproduce a block quote from paragraph 150 of that case. However, the case is only 124 paragraphs long and the quote does not exist. Her submissions continue to confidently cite the case for legal propositions it does not discuss. So, whether knowingly or negligently, TR provided false and misleading submissions. Given that compensation for time spent is an extraordinary and discretionary remedy, I find this is enough reason alone to dismiss her compensation claim.  

ORDERS

46.   I order X to pay $100,000 for its failure to comply with the protection order in IS-1-2025-000905, from April 15 to July 16, 2025.

47.   As set out in IIPA section 18 and IIPR section 10, an administrative penalty is a debt due to the Government of British Columbia and is due immediately on receipt of this notice.

48.   This $100,000 administrative penalty is to be made payable to the Minister of Finance by cheque or money order. Submit payment to:

Tribunal and Agency Support Division

PO Box 9222, Stn Prov Govt

Victoria, BC  V8W 9J1

49.   I dismiss TR’s claim for compensation for her time spent.

50.   Under IIPA section 13, I order a ban on publishing TR’s name or anything that would identify her.

51.   I order the dispute records sealed. Only the parties, their lawyers or representatives (if any), and the CRT may have access to the dispute records. With the applicant’s consent, the CRT may share information from the dispute record with the Intimate Images Protection Service of the British Columbia Minister of Public Safety and Solicitor General.

52.   Notice to X about compliance with the protection order. If your non-compliance continues or reoccurs, TR can apply to the CRT for a further administrative penalty order, with the same monetary limits.

 

53.   This is a validated decision and order.