Legally this looks like a disaster for Nijisanji, they are in deep shit.
I'm seeing a lot of legal talk thrown around and not a lot of actual investigation of legal code. Here is my trail of determining the proper legal procedure to what we know so far. I'm providing every single document.
https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/03063_01
The Personal Information Protection Act or PIPA, the relevant privacy law in British Columbia where Doki resides, has been thrown around a lot. AnyColor (Nijisanji) is a publicly traded Japanese corporation based in Tokyo, PIPA generally applies to organizations operating in British Columbia, regardless of whether they are based in the province or not.
3(1) Subject to this section, this Act applies to every organization..
1 - "organization" includes a person, an unincorporated association, a trade union, a trust or a not for profit organization, but does not include
1(a) an individual acting in a personal or domestic capacity or acting as an employee, (b) a public body, (c) the Provincial Court, the Supreme Court or the Court of Appeal, (d) the Nisg̱a'a Government, as defined in the Nisg̱a'a Final Agreement, or (e) a private trust for the benefit of one or more designated individuals who are friends or members of the family of the settlor;
AnyColor does not fall into any of these definitions clearly, however, under the Tax Act, foreign employers with employees working in Canada are required to obtain a Canadian tax identification number and open a payroll account with the Canada Revenue Agency. Therefore, incorporated businesses must ensure that they comply with PIPA's provisions, and while PIPA's definition of "organization" may not explicitly mention incorporated businesses, they are typically considered within the scope of the law and must adhere to its requirements regarding the protection of personal information.
PIPA says
3(5) If a provision of this Act is inconsistent or in conflict with a provision of another enactment, the provision of this Act prevails unless another Act expressly provides that the other enactment, or a provision of it, applies despite this Act.
The other acts referred to by PIPA
Federal Personal Information Protection and Electronic Documents Act (PIPEDA)
https://laws-lois.justice.gc.ca/eng/acts/P-8.6/index.html
Ontario Freedom of Information and Protection of Privacy Act (FOIPPA)
https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96165_00
In situations where both federal and provincial privacy laws may apply, such as in BC where PIPEDA and PIPA could potentially both be relevant, the general principle is that the more stringent privacy law will apply. This principle is often referred to as the "federal-provincial balance." If PIPA and PIPEDA have conflicting provisions, the more protective or stringent provisions would prevail. If the provisions of both laws are compatible, organizations operating in British Columbia need to comply with PIPEDA and PIPA simultaneously.
Reference to the FOIPPA has often been dispelled as people claim PIPA would override it, but it's actually the other way around.
3(2) This Act (PIPA) does not apply to the following: (d) personal information if the Freedom of Information and Protection of Privacy Act applies to the personal information;
FOIPPA still needs to be dissected to see what could potentially apply to Nijisanji, but for the most part FOIPPA seems to be designed to cover Canadian public bodies specifically, as private sector laws are already covered under PIPEDA and I can only do so much.
According to this PIPA Definitions (1)
Employee includes a volunteer
"employment" includes working under an unpaid volunteer work relationship
Foreign-based employers: If you're a foreign-based employer without a Canada Revenue Agency (CRA) business number and your business address and operation are outside of Canada, submit your contract or invoice for the goods or services that you're providing in Canada (which means they have to pay tax, which means they are subject to Canadian law in regards to their resident employee)
There is no way to dispute that Doki was not a valid employee even as a contractor when even volunteers are considered by this law to be treated as an employee. We know that she is a resident of British Columbia, and has been employed by AnyColor to work from her place of residence in Canada, not Japan.
We've established that Nijisanji is considered an organization beholden to the PIPA code, and that Doki (as Selen) would be considered their employee.
The next part is where it gets juicy
Nijisanji is fucked, because from the code we can determine that their accusations against Doki, even if entirely true, do not breach PIPA, whereas Niji has already broken the code of PIPA by SELF-ADMISSION.
Some amazing definitions:
"contact information" means information to enable an individual at a place of business to be contacted and includes the name, position name or title, business telephone number, business address, business email or business fax number of the individual;
"employee personal information" means personal information about an individual that is collected, used or disclosed solely for the purposes reasonably required to establish, manage or terminate an employment relationship between the organization and that individual, but does not include personal information that is not about an individual's employment;
"work product information" means information prepared or collected by an individual or group of individuals as a part of the individual's or group's responsibilities or activities related to the individual's or group's employment or business but does not include personal information about an individual who did not prepare or collect the personal information.
"personal information" means information about an identifiable individual and includes employee personal information but does not include (a) contact information, or (b) work product information;
PERSONAL INFORMATION DOES NOT INCLUDE CONTACT INFORMATION OR WORK PRODUCT INFORMATION. DOKI'S KNOWLEDGE OF THEIR ADDRESS AND NAMES WHICH WAS MENTIONED IN ELIRA'S VIDEO IS PART OF WORK PRODUCT INFORMATION OR CONTACT INFORMATION. IT IS NOT PERSONAL INFORMATION AND CANNOT BE APPLIED TO PIPA.
"document" includes (a) a thing on or by which information is stored, and (b) a document in electronic or similar form;
3(4) This Act does not limit the information available by law to a party to a proceeding.
1"proceeding" means a civil, a criminal or an administrative proceeding that is related to the allegation of (a) a breach of an agreement, (b) a contravention of an enactment of Canada or a province, or (c) a wrong or a breach of a duty for which a remedy is claimed under an enactment, under the common law or in equity;
Right now, it is unknown if a legal proceeding from Doki has begun against Nij, but she has an incredibly strong case for claiming a contravention of PIPA.
(3) Nothing in this Act affects solicitor-client privilege.
There it fucking is.
Solicitor-client Privilege. The team that Doki and her lawyer was in contact with is also beholden to it when receiving any documents under the expectation that they would remain private, which Doki says is the case.
It does not matter what information on livers was in Doki's document as it is part of solicitor-client privilege, and we've established that it wasn't personal information anyways.
Niji on the other hand? Vox literally said verbatim that he got to "THROUGHLY review the documents sent to AnyColor by her (Doki's) lawyer)"
Firstly, to our knowledge Vox's information was not in these documents, there is absolutely no reason for him to be involved in the process of seeing them. And because Vox is not Canadian, here come Cross-Border Data Transfer Regulations: Transferring personal or sensitive information outside of Canada and Japan could implicate data protection laws and regulations in both jurisdictions. This could also break Japanese law but that's a level to get to another time.
If any of these documents contained Doki's personal information, including employee personal information, it absolutely constitutes a breach of the act. This potentially applies to the livers in Japan too, but even without cross-border regulations the fact it was shared with any talents at all is likely a breach in of itself.
Again, employee personal information is disclosed solely for the purposes reasonably required to establish, manage or terminate an employment. That sounds an awful lot like all of the things Vox said he got to see, and could include the DMs between her and her manager that were shown. This is definitely going being reasonably required, but I'm sure Niji will try to argue on this point if it goes to court.
So here's what AnyColor could potentially be facing altogether, purely based of factual information we have been provided by Nijisanji themselves thus far!
Solicitor-Client Privilege Violation:
Intentionally transferring personal information covered by solicitor-client privilege across international borders without authorization could breach the principles of legal confidentiality and privilege. This could have serious legal implications, potentially resulting in disciplinary actions against the involved legal professionals and loss of privilege protections for the information.
Breach of Data Protection Laws in a Recipient Country
Depending on the destination country, the transfer of personal information may also violate data protection laws in that jurisdiction. For example, if the recipient country has stringent data protection regulations that prohibit the transfer of personal data without appropriate safeguards or consent, the transfer could contravene those laws.
Violation of International Data Transfer Restrictions:
Some jurisdictions impose restrictions or requirements on the transfer of personal data outside their borders. If the transfer does not comply with these restrictions or fails to provide adequate protection for the transferred data, it could violate international data transfer regulations.
Breach of PIPEDA Compliance:
PIPEDA governs the collection, use, and disclosure of personal information in the course of commercial activities. If personal information subject to PIPEDA, such as employee or customer data, is intentionally transferred across international borders without meeting the requirements of PIPEDA, it could constitute a breach of the Act.
Breach of PIPA Compliance:
Similarly, if the personal information in question relates to individuals in British Columbia and is subject to PIPA, the transfer may also contravene PIPA's provisions regarding the collection, use, and disclosure of personal information without consent or lawful authority.
Privacy Breach Notification Obligations
In the event of a privacy breach involving personal information covered by PIPA or PIPEDA, organizations may be required to notify affected individuals and regulatory authorities. Failure to comply with these notification obligations could result in additional penalties or sanctions.
As time goes on, let's see how much further they dig their own hole. Remember that Doki was never the first one to breach any of these regulations. We haven't even gotten into the cluster fuck of them trying to contact her during her hospital stay and the many other ridiculous ways they've tried to handle this situation.