[ad_1]
The Quebec Superior Court (“the Court”) has ruled that
the social media company Snap Inc. (“Snapchat”), which
runs the social media application Snapchat must provide subscriber
information, transmission data and location data to the Montreal
Police Department (MPD). The decision has important implications
for companies operating in Canada and provides insight into the
need to balance privacy and data protection with the obligation to
cooperate with Canadian law enforcement.
Background
The decision in Re SPVM arose in a criminal investigation into a
Quebec resident who allegedly used a Snapchat account in connection
to child pornography charges. The Criminal Code (“the
Code”) allows law enforcement agencies to seek various court
approved production orders to compel third parties to produce
information in aid of a criminal investigation. For example, a
company may be court ordered to produce documents, general data,
transmission data, tracking data or financial data in their
possession.1
The MPD sought a production order under section 487.014 of the
Code2 to compel the American company Snapchat to provide
information stored in California. Notably, the requested
information was not accessible from Canada.
The Court concluded that to authorize a production order under
the Code requires only that:
- The company in possession or control of the information be
located in Canada; or - The person being investigated or the information that is the
subject of the production order, and the person in possession or
control of the information, have a real and substantial connection
to Canada.3
The Court’s decision has four main takeaways of interest for
corporations offering services in Canada.
1. Corporations operating in Canada may be ordered to provide
information to law enforcement that is stored abroad
The data sought by the MPD was stored and accessible only in
California, which raised questions about the scope and reach of
production orders under the Code. The Court concluded that the data
subject to the production order does not need to be located in
Canada or even accessible in Canada.4 A company that
offers services in Canada can be ordered to produce information in
Canadian criminal investigations, even if they only have a virtual
presence.5
The Court concluded that production orders could apply beyond
the borders of Canada when there was a real and substantial
connection with Canada.6 Snapchat has a significant
presence in Canada by virtue of its products and the services it
offers, and its office in Toronto.7
2. Corporations must be alive to the privacy concerns at issue
when cooperating with law enforcement
Corporations must carefully balance their obligation to
cooperate with law enforcement while being aware to the need to
protect their users’ the statutorily and constitutionally
protected privacy rights.
Although the Court in Re SPVM held that subscriber and
data information could be compelled from Snapchat in a production
order under s. 487.014 of the Code, depending on the information
sought, law enforcement must meet different standards before a
court will approve the request. Corporations should be aware of the
different types of warrants and production orders that enable law
enforcement to compel different types of information. For example,
the Supreme Court of Canada (“SCC”) in R v Telus
Communications Co, held that a “general” warrant
under the Code was insufficient to compel Telus to provide the
prospective, daily acquisition of text messages. A more rigorous
“wiretap” warrant, was required, and to proceed without
one was a violation of Telus customers’ privacy right protected
by section 8 of the Canadian Charter of Rights and
Freedoms (“Charter”).
In addition to the Charter, certain Canadian laws, such as the
Personal Information Protection and Electronic Documents
Act (“PIPEDA”), also protect privacy. The PIPEDA
requires corporations to obtain consent before disclosing personal
information, but contains some exceptions for information collected
by law enforcement.8 Contact McMillan’s privacy
group for help navigating privacy rights and privacy legislation in
Canada.
3. The decision clarifies the obligation for corporations to
cooperate with law enforcement
The decision in Re SPVM concluded that despite the
legal and practical challenges of compelling a corporation to
comply with a production order outside of Canada, the
Court still had jurisdiction to make and enforce the order
within Canada.9 Refusal to comply with a
production order may constitute an offence within Canada, even
where complying with the order would require a company to violate a
law in a foreign jurisdiction.10 The reality that some
companies are present in multiple jurisdictions and may be faced
with conflicts between various laws does not prevent Canadian
judges from exercising their jurisdiction under ss. 487.014-487.017
of the Code.11
4. The decision has potential implications for Competition Act
investigations in Canada
The decision in Re SPVM may also have two significant
implications for competition law investigations. Under s. 11(2) of
the Competition Act, a judge can compel an affiliate of a
corporation under investigation to provide records in the
affiliate’s possession, even where the affiliate is located
outside of Canada.12
The first implication for competition law investigations is that
investigators may bring applications under s. 487.014 of the Code
to avoid the common challenge to the constitutionality of order
under s. 11(2) of the Competition Act. As seen in the
past, s. 487.014 orders can be made for criminal investigations,
but also investigations under any Act of Parliament, including the
Competition Act. If the affiliate of a Canadian company in
a competition investigation has some “real and substantial
connection” to Canada, then they may be ordered to produce
records via a s. 487.014 production order.
The second possible implication is that Re SPVM may
influence the interpretation of s. 11(2) of the Competition
Act. Judges may view any extraterritorial effects of s. 11(2)
order more leniently and be more willing to approve requests for
affiliates to produce records stored abroad. The influence of the
decision in Re SPVM is augmented by the amendments to the
Competition Act in summer 2022. The amendments created an
additional power under s. 11(5) of the Competition Act,
which allows investigators to compel production under s. 11(2)
against any person located outside of Canada who “carries on
business in Canada or sells products in Canada.13
Takeaways
Navigating obligations to law enforcement while ensuring
personal data and privacy rights are protected is a complicated
process rife with potential pitfalls for corporations. The decision
in Re SPVM clarified that companies may be obligated to provide
information to Canadian law enforcement, even where the information
is stored and only accessible in a foreign jurisdiction or where to
do so would constitute an offence in that foreign jurisdiction. The
decision seemingly expands the powers of law enforcement to order
the production of information and data.
Here, the Court concluded that there is a connection to Canada
that justified the production order if
- The crime being investigated was committed in whole or in part,
on Canadian territory; - The information covered by the order related to
telecommunications that occurred in whole or in part in
Canada; - The company subject to the order is in Canada by virtue of the
service it offers in Canada and any physical office in Canada; - The offence under investigation, the information subject to the
production order, and the corporation in possession or control of
the information have a real and substantial connection to
Canada; - The corporation’s presence in Canada and the nature of the
corporation’s activities in Canada were sufficient to establish
that the corporation possesses or has access to the information
sought.14
Footnotes
Footnotes
1. See sections 487.014- .018 of the Criminal Code of
Canada, RSC 1985 c. C-46.
2. Section 487.014 of the Criminal Code provides
“… a justice or judge may order a person to produce a
document that is a copy of a document that is in their possession
or control when they receive the order, or to prepare and produce a
document containing data that is in their possession or control at
that time.”
3. Re Service de police de la Ville de
Montréal, 2022 QCCS 3935 at para 6 [Re
SPVM].
4. Re SPVM at para 11.
5. Re SPVM at para 45.
6. Re SPVM at para 20.
7. Re SPVM at para 23.
8. Personal Information Protection and Electronic
Documents Act, SC 2000, c 5, Principle 3 –
Consent.
9. Re SPVM at para 58.
10. Re SPVM at para 25.
11. Re SPVM at para 28.
12. Competition Act, RSC 1985 c C-34 s.
11(2).
13. Budget Implementation Act, 2022, No. 1, SC
2022, c 10, s. 256.
14. Re SPVM at para 7.
The foregoing provides only an overview and does not
constitute legal advice. Readers are cautioned against making any
decisions based on this material alone. Rather, specific legal
advice should be obtained.
© McMillan LLP 2021
[ad_2]
Source link
