Quebec Superior Court Orders That Corporations Must Provide Information to Police – Even Where Data Stored Abroad

Quebec Superior Court Orders That Corporations Must Provide Information to Police – Even Where Data Stored Abroad

The Quebec Superior Court (“the Court”) has ruled that the social media company Snap Inc. (“Snapchat”), which runs the social media application Snapchat must provide subscriber information, transmission data and location data to the Montreal Police Department (“MPD“). The decision has important implications for companies operating in Canada and provides insight into the need to balance privacy and data protection with the obligation to cooperate with Canadian law enforcement.

Background

The decision in Re SPVM arose in a criminal investigation into a Quebec resident who allegedly used a Snapchat account in connection to child pornography charges. The Criminal Code (“the Code”) allows law enforcement agencies to seek various court approved production orders to compel third parties to produce information in aid of a criminal investigation. For example, a company may be court ordered to produce documents, general data, transmission data, tracking data or financial data in their possession.[1]

The MPD sought a production order under section 487.014 of the Code[2] to compel the American company Snapchat to provide information stored in California. Notably, the requested information was not accessible from Canada.

The Court concluded that to authorize a production order under the Code requires only that:

• The company in possession or control of the information be located in Canada; or
• The person being investigated or the information that is the subject of the production order, and the person in possession or control of the information, have a real and substantial connection to Canada.[3]

The Court’s decision has four main takeaways of interest for corporations offering services in Canada.

1.  Corporations operating in Canada may be ordered to provide information to law enforcement that is stored abroad

The data sought by the MPD was stored and accessible only in California, which raised questions about the scope and reach of production orders under the Code. The Court concluded that the data subject to the production order does not need to be located in Canada or even accessible in Canada.[4] A company that offers services in Canada can be ordered to produce information in Canadian criminal investigations, even if they only have a virtual presence.[5]

The Court concluded that production orders could apply beyond the borders of Canada when there was a real and substantial connection with Canada.[6] Snapchat has a significant presence in Canada by virtue of its products and the services it offers, and its office in Toronto.[7]

2.  Corporations must be alive to the privacy concerns at issue when cooperating with law enforcement

Corporations must carefully balance their obligation to cooperate with law enforcement while being aware to the need to protect their users’ the statutorily and constitutionally protected privacy rights.

Although the Court in Re SPVM held that subscriber and data information could be compelled from Snapchat in a production order under s. 487.014 of the Code, depending on the information sought, law enforcement must meet different standards before a court will approve the request. Corporations should be aware of the different types of warrants and production orders that enable law enforcement to compel different types of information. For example, the Supreme Court of Canada (“SCC”) in R v Telus Communications Co, held that a “general” warrant under the Code was insufficient to compel Telus to provide the prospective, daily acquisition of text messages. A more rigorous “wiretap” warrant, was required, and to proceed without one was a violation of Telus customers’ privacy right protected by section 8 of the Canadian Charter of Rights and Freedoms (“Charter”).

In addition to the Charter, certain Canadian laws, such as the Personal Information Protection and Electronic Documents Act (“PIPEDA”), also protect privacy. The PIPEDA requires corporations to obtain consent before disclosing personal information, but contains some exceptions for information collected by law enforcement.[8] Contact McMillan’s privacy group for help navigating privacy rights and privacy legislation in Canada.

3.  The decision clarifies the obligation for corporations to cooperate with law enforcement

The decision in Re SPVM concluded that despite the legal and practical challenges of compelling a corporation to comply with a production order outside of Canada, the Court still had jurisdiction to make and enforce the order within Canada.[9] Refusal to comply with a production order may constitute an offence within Canada, even where complying with the order would require a company to violate a law in a foreign jurisdiction.[10] The reality that some companies are present in multiple jurisdictions and may be faced with conflicts between various laws does not prevent Canadian judges from exercising their jurisdiction under ss. 487.014-487.017 of the Code.[11]

4.  The decision has potential implications for Competition Act investigations in Canada

The decision in Re SPVM may also have two significant implications for competition law investigations. Under s. 11(2) of the Competition Act, a judge can compel an affiliate of a corporation under investigation to provide records in the affiliate’s possession, even where the affiliate is located outside of Canada.[12]

The first implication for competition law investigations is that investigators may bring applications under s. 487.014 of the Code to avoid the common challenge to the constitutionality of order under s. 11(2) of the Competition Act. As seen in the past, s. 487.014 orders can be made for criminal investigations, but also investigations under any Act of Parliament, including the Competition Act. If the affiliate of a Canadian company in a competition investigation has some “real and substantial connection” to Canada, then they may be ordered to produce records via a s. 487.014 production order.

The second possible implication is that Re SPVM may influence the interpretation of s. 11(2) of the Competition Act. Judges may view any extraterritorial effects of s. 11(2) order more leniently and be more willing to approve requests for affiliates to produce records stored abroad. The influence of the decision in Re SPVM is augmented by the amendments to the Competition Act in summer 2022. The amendments created an additional power under s. 11(5) of the Competition Act, which allows investigators to compel production under s. 11(2) against any person located outside of Canada who “carries on business in Canada or sells products in Canada.[13]

Takeaways

Navigating obligations to law enforcement while ensuring personal data and privacy rights are protected is a complicated process rife with potential pitfalls for corporations. The decision in Re SPVM clarified that companies may be obligated to provide information to Canadian law enforcement, even where the information is stored and only accessible in a foreign jurisdiction or where to do so would constitute an offence in that foreign jurisdiction. The decision seemingly expands the powers of law enforcement to order the production of information and data.

Here, the Court concluded that there is a connection to Canada that justified the production order since:

• The crime being investigated was committed in whole or in part, on Canadian territory;
• The information covered by the order related to telecommunications that occurred in whole or in part in Canada;
• The company subject to the order is in Canada by virtue of the service it offers in Canada and any physical office in Canada;
• The offence under investigation, the information subject to the production order, and the corporation in possession or control of the information have a real and substantial connection to Canada;
• The corporation’s presence in Canada and the nature of the corporation’s activities in Canada were sufficient to establish that the corporation possesses or has access to the information sought.[14]

McMillan is happy to assist with any specific advice on navigating your corporate obligations to Canadian law enforcement.

[1] See sections 487.014- .018 of the Criminal Code of Canada, RSC 1985 c. C-46.
[2] Section 487.014 of the Criminal Code provides “… a justice or judge may order a person to produce a document that is a copy of a document that is in their possession or control when they receive the order, or to prepare and produce a document containing data that is in their possession or control at that time.”
[3] Re Service de police de la Ville de Montréal, 2022 QCCS 3935 at para 6 [Re SPVM].
[4] Re SPVM at para 11.
[5] Re SPVM at para 45.
[6] Re SPVM at para 20.
[7] Re SPVM at para 23.
[8] Personal Information Protection and Electronic Documents Act, SC 2000, c 5, Principle 3 – Consent.
[9] Re SPVM at para 58.
[10] Re SPVM at para 25.
[11] Re SPVM at para 28.
[12] Competition Act, RSC 1985 c C-34 s. 11(2).
[13] Budget Implementation Act, 2022, No. 1, SC 2022, c 10, s. 256.
[14] Re SPVM at para 7.

by Guy Pinsonnault and Adelaide Egan (Articling Student)

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2023