Dealing with police "Letters of Request for Information"

(This post is not intended to be legal advice. If you find yourself in a situation like those described below, seek competent legal advice. This post is principally meant to serve as a resource for lawyers who may have to deal with these issues from time to time. -- And I should emphasize that this relates to Canadian law only.)

As part of my practice, I often deal with business clients who call when the police or national security folks are knocking on the door and are looking for information about customers. When faced with a cop or a CSIS agent with a badge, particularly when they are pushy and use words like "obstruction", the natural inclination may be to hand over the information.

When the police show up and start asking for customer information, unless they have a search warrant and unless they say it is a matter of life and death, the business should request that they put their request in writing. This provides a clear record of what the police asked for and what they assert as the legal basis for their request. In conversation, what appears to be a compulsory process translates into a voluntary one once put in writing.

(If the police clearly say it's a matter of imminent life or death, the business is probably justified in providing the information and any risk of liability for the disclosure would likely be minimal. Still, try to get it in writing.)

Oftentimes, what will arrive next will be a "Letter of Request for Information".

It is important to carefully read and thoroughly understand what the letter says. Here's an example based on one that recently crossed my desk.

[Police letterhead]
LETTER OF REQUEST FOR INFORMATION

Business Name

Bus Address

Bus Fax #

Date of Request: *** Our file: ***

[1] I, Detective/Constable *** of the ***, am a peace officer within the *** Unit. I am involved in the ongoing investigation *** and am requesting *** information pursuant to Section 487.014 of the Criminal Code for this investigation. In accordance with my duty to investigate contraventions of the Criminal Code, I am requesting the following information from you which is necessary for my investigation:

• [2]***

[3]The information I am providing you relates to a criminal investigation. This information and the existence of this query should not be further disseminated or divulged outside the purpose for which it is provided to you; any attempt to further disseminate or divulge the information outside this purpose may be construed as obstructing, perverting or defeating the course of justice possibly resulting in criminal sanctions under s. 139(2) of the Criminal Code.

Please provide the information requested to myself, ***, by means of email to *** or by phone ***.

Peace Office rank and name Peace Officer Badge # Peace Officer Telephone Number Supervisor’s rank and name Supervisor’s Telephone Number

To begin with, it must be clearly understood that nothing in such a letter requires the business to provide any information whatsoever to the police. Unless it is a search warrant, a production order or a subpoena, any information to be provided is voluntary on the part of the business.

Let's parse the letter.

[1] This section sets out some of the background facts to the investigation and is presumably there set the foundation for "lawful authority" to request the information as is required under Section 7(3)(c.1) of PIPEDA:

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is

. . .

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority (emphasis added) to obtain the information and indicated that . . .

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or...

The paragraph continues that the request is pursuant to Section 487.014 of the Criminal Code. This makes it sound like the recipient of the letter has to provide the information, but that's far from the case. This section only says that the police can ask for information to be provided voluntarily.

Power of peace officer

487.014 (1) For greater certainty, no production order is necessary for a peace officer or public officer enforcing or administering this or any other Act of Parliament to ask a person to voluntarily provide to the officer documents, data or information that the person is not prohibited by law from disclosing.

[2] This paragraph or list sets out the information requested.

[3] This paragraph suggests a gag order and implicitly threatens that if the recipient tells anyone, they could be obstructing justice. One has to be very careful with this. Telling the subject of the investigation of the existence of the request would perhaps constitute obstruction, but the business should be free to seek legal advice without fear of this supposed gag order.

So what's a business to do? It is up to the business at this stage to decide whether it wants to comply, but it has to be mindful of any other legal obligations that it might have that would prevent it from making the disclosure. There is some question as to whether Section 7(3)(c.1) of PIPEDA is intended to permit businesses to hand over information without a warrant in connection with a criminal investigation. There is some legal authority either way, but none of the published decisions address any liability for the business. At the very least, the business needs to ask itself if it wants to make the disclosure and whether it's prepared to take the risk of some liability to the subject of the investigation.

Part of the examination of potential liability should involve an examination of any privacy policies or privacy statements that the business uses. For example, if the policy has language that suggests information will only be provided to third parties where "required by law", this written request does not constitute "required by law". Again, it's only voluntary.

If information is provided, the business should keep a copy.

My personal preference is to require a warrant or a production order in all circumstances, since it is not the job of any business to act as a deputy of the police. If the police can convince a judge that they need to have it, then that's good enough for me. Anything less is something less.

---

A final word about subpoenas: a subpoena is not an order to provide particular information to the police, but an order to appear in court with the information. Just because they have a subpoena about the information doesn't mean the recipient can -- or should -- just hand it over.