What digital sovereignty? How a Canadian Court is forcing a French company to break French law

Just recently, I heard about a very significant new decision from the Ontario Court ofJustice, where a judge in Ottawa ordered OVHcloud in France and its Canadian subsidiary to hand over user data stored in France, the UK, and Australia. While Canada is focusing a lot of attention on “data sovereignty”, this decision should get a lot more attention, particularly because the Canadian court is ordering the French company to violate a French law that is designed to protect France’s data sovereignty.

I regularly deal with situations like this in my law practice, where I assist companies in responding to police demands for user data. But rarely does it get to this point, and I’m afraid this sets a very negative precedent.

This case touches on jurisdiction, cross-border data, foreign blocking statutes, and the limits of Canadian investigative powers. It also relies heavily on the controversial Brecknell decision from British Columbia — and I have some things to say about that.

Let’s walk through the case, and then I’ll explain why I think the analysis in the decision goes off the rails.

This case arises out of a national security investigation. The RCMP obtained a Production Order under the Criminal Code s. 487.014, requiring two companies to produce customer information linked to four IP addresses. The two companies are OVH Group SA (a French company that provides cloud computing services globally, OVH’s Canadian subsidiary, Hebergement OVH Inc.

All of the IP addresses were hosted outside Canada — in France, the UK, and Australia. The data sought included subscriber information and metadata, but not the content of any communications.

They argued that they did not have the data. It was held by the French parent company. They are the operating company in Canada that apparently runs servers here for the global business. They don’t manage global accounts or have access to the records that the police were looking for. OVH Canada did not oppose the order as it applied to OVH Canada on any jurisdictional basis. They are a company that has offices, employees and facilities that operates within Canada.

The real issue was the attempt to compel the French parent company — a company with no physical presence in Canada — to produce data stored entirely abroad, and that is subject to foreign laws.

The parent company said:

●      “We don’t operate in Canada.

●      We don’t store this data in Canada.

●      OVH Canada doesn’t control this data.

●      French law — specifically the French blocking statute — prohibits us from producing it. (more about that blocking statute later)

OVH also pointed out that the proper, internationally-recognized channel for this type of request is through Mutual Legal Assistance — the MLAT process — which France said it would expedite. Yes, Canada and France have a treaty under which both countries have agreed to manage situations like this. It’s slower because it contains checks and balances. First Canada has to determine if the request is appropriate, and then France reviews the request before getting a French order to provide the data.

The Crown responded that:

●        OVH Parent has a “virtual presence” in Canada, and based on the Brecknell case from BC, and cases following that, a “virtual presence” is enough.

●        The company “presents itself” as a unified global enterprise on its website

●        OVH Canada has previously responded to production orders about foreign IP addresses

●        The French blocking law is rarely enforced

With those facts on the table, the Court had to decide: Does a Canadian criminal court have jurisdiction over OVH’s French parent? And even if it does, should the order be revoked because of conflicting French law or because MLAT is the proper mechanism?

The Court framed five issues:

1. Did OVH Canada have “possession or control” of the data?
2. Did the Court have jurisdiction over OVH Parent?
3. Would French law prohibit disclosure, triggering s. 487.0193(4)(b) - which justifies varying or revoking a production order where the data is “otherwise protected from disclosure by law”?
4. Should MLAT be required in these circumstances?
5. If French law applies, should the Court exercise its discretion to revoke or vary the order?

The first Question is whether OVH Canada has “Possession or Control” of the data

With respect to possession or control, the Court found that OVH Canada had enough of a connection to the information — including prior instances where it assisted police, and the ability to preserve data — to justify the authorizing judge’s conclusion that it had “possession or control.”

The second question was whether there was jurisdiction over OVH Parent

Regarding jurisdiction over OVH Parent, relying heavily on the Brecknell, Love, and textPlus decisions, the Court held that:

●      A company may be subject to Canadian jurisdiction without physical presence

●      A “virtual presence” or “real and substantial connection” can be enough

●      OVH operates data centres in Canada

●      OVH’s website presents itself as a unified global business

●      Therefore, the French parent was sufficiently connected to Canada

The third question was about the effect of the French Blocking Law

The Court accepted French government statements that the French blocking law applied, but it found it could be largely disregarded because (a) The law has been rarely enforced, (b) There is no “real risk” of prosecution, and (c) Courts in other countries have treated it as an “empty vessel”. Yup. It’s a law but let’s largely ignore it.

The next question was whether the police should go through the mutual legal assistance process instead of a production order. The judge held that the MLAT is not mandatory, it can be slow and it is not mutually exclusive with domestic orders. The police can choose door A or door B. Their call.

In the final step, about discretion, the judge upheld the production order against both OVH Canada and the French parent, concluding that: (a) OVH Parent has a real and substantial presence through its “virtual presence” in Canada; (b) The risk under French law is minimal, and (c) The national security interest outweighs comity concerns.

In a nutshell, that’s what the court decided. And I think it’s deeply flawed.

There are, in my humble opinion, major problems with this decision. And they don’t just affect OVH Parent. It will have a big impact on Canada’s own attempts to assert data sovereignty.

The first problem is following the BC Court of Appeal decision called Brecknell

The Court relies on Brecknell as though it stands for a broad doctrine that Canadian courts can compel any foreign service provider operating online to disclose foreign-hosted data as long as the company is “virtually present” in Canada.

Brecknell is a 2018 case from the British Columbia Court of Appeal. In that case, the police wanted some data from Craigslist. They contacted Craigslist, who said “come back with a production order and we’ll happily give you the data.” So the police go to the court to get their production order and the court says that it can’t issue a production order directed at a company outside of Canada. So the police go to another court and get the same answer. So the police appeal that, and end up in the British Columbia court of appeal. The British Columbia Court of Appeal said that Canadian courts can issue production orders naming companies outside of Canada, as long as they have a “virtual presence in Canada.”

But in the Brecknell case, Craigslist — the target of the order — had already agreed it would comply with Canadian court orders. Through counsel, Craigslist said: “If we get an order, we will respond.”

This is not a small detail. This is the very foundation of jurisdiction in that case.

In other words: Craigslist voluntarily accepted Canadian jurisdiction.

With that fact, jurisdiction really should not have been an issue. Craigslist said “we have the data, just bring us a production order.”

This is not the situation with OVHcloud. OVH France explicitly said:

●      We do not accept jurisdiction

●      And we are prohibited by foreign law from producing it

OVH Cloud also said, we have the data and we will preserve it for you so you can get it through the established, diplomatic, country-to-country channels.

I am of the view that Brecknell was wrongly decided and this entire line of cases is problematic. We’ve gotten here, I think, they are largely “ex parte” appeals. Craigslist was not at the hearing for the production order. They were not at any level of court. Until the court of appeal, it was just the cops and the prosecution arguing for jurisdiction. At the court of appeal, an amicus was appointed who did a commendable job.

This line of cases also reaches the conclusion that this is the sort of situation that production orders are designed to address. And they are partially right, but again they suffer from generally only hearing from prosecutors on these questions.

The idea behind a production order is that the court can order someone to hand over data or produce data. It is distinct from a search warrant, where the court clearly has to have jurisdiction over the place to be searched and the police need authority as police officers to search the place. Places are physical. There is no way under recognized international law for a judge in Ontario to give the RCMP in Ontario a warrant to search premises in France for these records. If they were to show up in Paris with their warrant, they’d likely be arrested by French police for trespassing. And we’d have an international incident. It would be the same as sending the RCMP to France to arrest someone without the cooperation of the French government. It’s just not done.

Production orders were created so that a person or entity within the court’s jurisdiction can be ordered to produce a record that is under that person’s control. And that generally operates regardless of where the record is. But this depends on the person being within the court’s jurisdiction. It’s a great alternative to a search warrant because it’s not based on the police searching for something, but telling a person to provide data that they control.

A key principle of international law as applied in Canada is that Canadian law does not operate extraterritorially unless Parliament explicitly provides for it. The B.C. Court of Appeal in Brecknell did note this at paragraph 23, but failed to identify any parliamentary signal indicating that production orders were intended to have effect on persons wholly, physically outside of Canada. 

[23]        The need to interpret the section in light of restrictions placed on extraterritorial effects is uncontroversial. The fundamental principles were canvassed in R. v. Hape, 2007 SCC 26. There, Justice LeBel identified a number of settled but important principles. First, customary international law, which has been adopted domestically, limits the actions a state may legitimately take outside its borders. Customary international law is based on respect for the sovereignty and equality of foreign states. Sovereign equality commands non‑intervention and respect for the territorial sovereignty of foreign states. Nonetheless, Parliament may legislate “extraterritorially” in violation of those principles provided it does so expressly: see paras. 35‑46.

...

[30]        The section is silent on issues to do with extraterritoriality, and it is silent on any question dealing with the location of the documents. Section 487.019(2) may offer some assistance by stipulating that, unlike search warrants, the order has effect throughout Canada without requiring endorsement if executed in another jurisdiction. The section reads:

487.019(2) The order has effect throughout Canada and, for greater certainty, no endorsement is needed for the order to be effective in a territorial division that is not the one in which the order is made.

It appears to me that this section is addressing a difference between search warrants and production orders. It does not directly deal with extraterritorial issues.

The only mention of territoriality in the Criminal Code production order provisions is confined to saying that they operate throughout Canada. That seems to me to be a signal in the other direction. That’s parliament saying this is confined to Canada.

The notion of a "virtual presence" was an invention of the Court of Appeal and is contrary to existing principles of international law. Even under the more flexible civil rules, the Supreme Court of Canada has cautioned that "carrying on business" requires some form of actual, not only virtual, presence in the jurisdiction. And public international law - such as criminal jurisdiction - is different from private international law such as determining where a plaintiff can bring a lawsuit.

The Brecknell court wrongly disregarded the inability to enforce the order against a company like Craigslist. The issuance of a production order extending outside Canada is an exercise of enforcement jurisdiction, which violates international law and Canadian domestic law absent clear authority from Parliament. The difference between an “order” and a “request” is the ability to put someone in the defendant’s dock for not following it. A Canadian production order directed at a non-Canadian company has a real potential to offend comity and the other country’s sovereignty.

So what about Mutual Legal Assistance Treaties (called MLATs)? These are the existing, agreed-upon mechanism for Canadian police to obtain data from non-Canadian companies. In circumstances where an order might offend comity and sovereignty, MLATs are how countries decide to deal with the issue.

The effect of privacy laws or blocking laws were not at issue and were not considered – but probably should have been – by the Brecknell court.

In the OVH case, the court refers to the case of The Queen and Love from the Alberta Court of Appeal (R v Love, 2022 ABCA 269), which was a case dealing with the admissibility of data that had been produced by Facebook from the US pursuant to a production order. It was not an application to vary or revoke an active production order. The Love court followed Brecknell. Again, what’s missing is the fact that Facebook provided the data pursuant to that order. Their policy – like most big US tech companies – is that they will follow Canadian legal processes voluntarily where they can do so consistent with their obligations under US law. By and large, Facebook’s voluntary cooperation should have made jurisdiction a non-issue in that case.

The OVH judge also refers to a case involving TD Bank from Quebec (Banque Toronto Dominion c. Cour du Québec, 2025 QCCS 2094). In that case, a big issue was whether TD Bank in Canada could be ordered to produce records held by one of its foreign subsidiaries. The Court concluded it had sufficient control over the subsidiary to require the production of the records. That’s the inverse of the relationship between OVH Canada and OVH Parent. A subsidiary does not control the parent company.

So to use Brecknell as if it resolved this question is — frankly — a misreading of the case.

Problem 2 — The Court Treats Ordinary Corporate Structure as a Legal Fiction

In addition, the decision disregards the fundamentals of second year law school “Business Associations” to treat OVH as effectively one entity, leaning heavily on:

●      OVH’s branding

●      The fact “it” has data centres in Canada

●      The “collaborative language” on its website

●      Shared legal services

●      The appearance of a global enterprise

But this misunderstands how multinational cloud companies operate and how corporate law applies.

I sometimes think that some practitioners who spend all their time focused on criminal law forget the fundamentals of corporate law.

Corporations are separate legal persons. Subsidiaries are not automatically global agents of the parent company. And cloud marketing — “our global infrastructure,” “our data centers around the world” — is not a legal admission of control. It’s marketing.

Corporations are separate legal persons and this corporate separateness is generally only disregarded where there is actual fraud going on.

If courts treat branding copy as determinative of “control,” then:

●      Any cloud provider operating in Canada

●      With foreign infrastructure

●      Could be compelled to produce foreign data

●      Regardless of its actual legal authority to do so

This collapses corporate separateness in a way that is deeply inconsistent with both Canadian corporate law and international norms. Which leads directly to the next problem.

The Court points to a previous investigation where OVH Canada provided subscriber information for a German-hosted IP address to suggest that OVH Canada effectively has access and control over it.

But OVH explained — and this is common across the industry — that:

●      The Canadian subsidiary assisted because doing so was legally safe

●      There was no blocking law that stood in the way

●      The foreign affiliate voluntarily cooperated

This demonstrates cooperation, not control.

Access that is permitted by a foreign affiliate is not evidence of legal authority to compel access.

If you need a particular tool for a project, and I don’t have one but my parents do, I may facilitate YOUR borrowing it from MY parents. That doesn’t mean I have control over that tool.

OVH Canada receives a production order for data that is under the control of its parent company. Rather than say “go to France”, OVH Canada facilitates the parent company producing the data in circumstances where it is lawfully able to do so. It’s called being helpful, and should not lead to the conclusion that the subsidiary has any possession or control of data that’s entirely in the possession and control of the parent company.

By treating occasional past cooperation as proof of control, the Court dramatically expands what “possession or control” means. After this, it would be prudent for the Canadian subsidiary of a foreign corporation to tell Canadian police to just go pound sand, rather than facilitate matters through internal channels.

This is perhaps the most troubling aspect of the decision: The Court Minimizes Foreign Law Because It’s “Not Enforced”

The Court acknowledges that the French blocking law applies. The French government — through the “Service de l’information stratégique et de la sécurité économiques” (SISSE) — which administers and enforces this French law explicitly said so.

But the judge concluded it doesn’t really matter because the French law is apparently rarely enforced, the Canadian prosecutors said there’s no “real risk” of prosecution and other courts have treated it as an “empty vessel”.

I think this approach is dangerous.

The rule of law depends on courts respecting what the law is, not how often a prosecutor decides to enforce it. A foreign state’s policy choices about enforcement:

●      Do not change the meaning of the statute

●      Do not change OVH’s legal obligations under French law

●      Do not give Canadian courts authority to override foreign legislation

A law is a law. I know dozens of Canadian laws that are rarely enforced, but they still need to be followed. Remember, this is a Canadian court shrugging off a law duly enacted by an allied country, France.

If Canada wants foreign law to bend, the proper channel is MLAT — a mechanism built through mutual consent — not unilateral judicial action.

International comity is built on reciprocity. If Canada orders French companies to violate French law, then:

●      Other countries may order Canadian companies to violate Canadian law

●      Canada will have no principled basis to object

●      Global cloud providers will face impossible conflicts

●      And privacy for Canadians abroad will be weakened

Remember, this is happening at the exact time that the Canadian government is focused on Canadian “Digital Sovereignty”. We would find it incredibly offensive if a French or Chinese court were to order a Canadian company, in Toronto, to violate Canadian law.

MLAT exists precisely for situations where:

●      The data is located abroad

●      A foreign statute prohibits disclosure

●      And the foreign state must authorize or supervise the production

France explicitly told Canada it would expedite the MLAT request. Refusing to use MLAT because it might be slow is not a justification for disregarding foreign law. In this case, there is no doubt that the data exists, that France will provide it via the MLAT and will do so speedily. Ordering OVH in France to break French law is unnecessary, unreasonable and – in my view – gratuitous.

This decision is important, but in my view, it’s also misguided.

By stretching Brecknell beyond its facts, by treating global branding as evidence of legal control by a local subsidiary, by using past cooperation as proof of present authority, and by dismissing binding French law because it’s “not vigorously enforced,” the Court has weakened the principles of comity, corporate separateness, and legal certainty.

While Canada is getting excited about “digital sovereignty”, the RCMP, these prosecutors and the court are disregarding France’s explicit law about its own “digital sovereignty.” This is a dangerous precedent to set. After this, why would France give a toss about Canadian laws designed to protect Canadian data?

There is a lawful path — MLAT, letters rogatory, diplomatic channels — and international cooperation depends on states using those channels rather than overriding each other’s laws.

And one important thing to remember: OVH is not suspected of committing any crime. It simply has records about someone that may be relevant for a Canadian investigation. It is not hiding behind a veil of French law to shield itself from liability. It is an entirely innocent third party that is getting dragged into a Canadian investigation, and is now being ordered to violate the law in the country where they are based. And that order is entirely unnecessary, since France and Canada have already negotiated a clear path to get access to this data without violating anyone’s laws.

I understand the case is being appealed – and rightly so. I’ll be keeping an eye on it.

 

Federal Court concludes that a “virtual presence” in Canada is enough to be ordered to assist CSIS

Decision follows trend starting in BC that a virtual presence in Canada is enough to be ordered to produce records

The Federal Court of Canada, in connection with an application for a warrant and an assistance order under the Canadian Security Intelligence Service Act, was required to consider whether an assistance order under s. 22.3(1) of that Act could be issued to order a legal person with no physical presence in Canada to assist CSIS with giving effect to a warrant. The order would have extra-territorial effect.

In a redacted decision, Re Canadian Security Intelligence Service Act (Can), the court concluded that it can, provided that the subject of the assistance order has a “virtual presence” in Canada. The decision notes that the foreign company involved was willing to assist, but needed to see a court order to manage their possible legal liability:

[3]       The affiant explained that [REDACTED] is incorporated and headquartered in [REDACTED] does not have physical offices or employees in Canada. It has a virtual presence in Canada that consists of [_some physical presence in Canada_]. It solicits business from Canadians and [REDACTED].

 

[4]       The affiant also explained that [REDACTED] has been fully cooperative in providing assistance to CSIS to date, but has advised CSIS that it requires a judicial authorization from a Canadian court to minimize its legal risk in the event that CSIS uses the collected intelligence beyond analysis; [REDACTED]. [REDACTED] advised that it would continue to be cooperative pending and upon receipt of an Assistance Order.

The company’s willingness to comply wasn’t particularly material to the Court’s decision.

At the urging of the government and largely supported by a court-appointed amicus, the Court followed a trend of cases that have dealt with similar questions but involving production orders under the Criminal Code. The first of these cases is British Columbia (Attorney General) v. Brecknell, where the Royal Canadian Mounted Police were seeking to obtain a production order naming Craigslist. As with this CSIS case, Craigslist said they’d cooperate but needed to see a court order. The British Columbia Court of Appeal, influenced by the Equustek case from the Supreme  Court of Canada, concluded that a court has jurisdiction to issue a production order naming an entity physically beyond the court’s jurisdiction provided they had a “virtual presence” within the jurisdiction.

The Court concluded:

[49]     I find that the jurisprudence in the context of production orders issued pursuant to section 487.014 of the Criminal Code provides a good analogy and support for finding that this Court has the jurisdiction to issue an Assistance Order where in personam jurisdiction can be established. The two provisions are similar in purpose, albeit in different contexts, both are directed to a person, which includes an organization or entity that is a legal person, and similar considerations arise in determining whether the order should be issued where the subject has only a virtual presence in Canada.

[50]     The considerations noted by the SCC in Equustek lend further support to taking an approach that reflects the realities of the internet dominated storage and transmission of documents and information. As noted in Brecknell, document control may exist in one jurisdiction, and the documents in another or in several others and “formalistic distinctions” between virtual and physical presence defeat the purpose of the legislation.

[51]     Whether an organization or entity with only a virtual presence in Canada can establish a real and substantial connection with Canada sufficient to constitute presence in Canada will be a case-by-case determination. Where such in personam jurisdiction is established, the organization or entity that is subject to the Assistance Order and required to provide documents in their possession or control is considered to be in Canada although the documents may be stored elsewhere.

As with a number of the cases following Brecknell, the Court concluded that its ability to issue the order does not turn on whether it would be able to enforce the order, though that is a relevant consideration:

[53]      I have considered the issue of enforcement of the Assistance Order on [REDACTED]. I note that they have been cooperative to date and indicate their ongoing intention to cooperate. However, I also agree with the submissions of the AGC and amicus and the jurisprudence, that the enforcement of the Order is a separate issue from whether the Court has jurisdiction to issue the Order, but remains a relevant consideration with respect to whether the Order should be issued based on the particular circumstances.

Consistent with the previous production order cases cited, the intended recipient was not a party to the hearing. All were ex parte, but some included amici.

Note: I believe that Brecknell was wrongly-decided, but because all of these orders have not been ex parte and unopposed, it'll be some time before these arguments will be made in court.   See: David T Fraser, "British Columbia (Attorney General) v. Brecknell", Case Comment, (2020) 18:1 CJLT 135.

What a CLOUD Act agreement will look like for Canada

The United States Department of Justice and the United Kingdom Home Office have announced that the two countries have signed a bilateral agreement “On Access to Electronic Data for the Purpose of Countering Serious Crime”. The Agreement is intended to be a bilateral agreement of the type anticipated under the CLOUD Act. Passed in March 2018, partially to address the litigation against Microsoft related to evidence in Ireland, the CLOUD Act authorizes the United States to enter into executive agreements with other countries that meet specific criteria related to rule of law, civil rights and privacy. Once laid before Congress and approved, the result is to lift each party’s legal barriers that prevent one country’s legal processes from being recognized in the other. Many countries have been seeking an alternative to the traditional channels of mutual legal assistance, which are seen as time consuming and cumbersome.

When it comes to orders directed at US custodians of information, the main barrier to be overcome is the American Stored Communications Act that prohibits most US service providers from providing the content of communications except in response to a US court order. These can be obtained via the mutual legal assistance system, but all the steps required to obtain these orders are seen by law enforcement and cumbersome and time consuming. Under a CLOUD Act executive agreement, US service providers will no longer be prohibited from providing such content in response to an appropriate foreign order. It is very important to note that the CLOUD Act does not make foreign orders enforceable (with full force of a domestic court order) in the United States, but merely removes this barrier.

On the UK side of the equation, changes were made in UK law to permit this under the Crime (Overseas Production Orders) Act 2019, which received Royal Assent in February 2019. The Agreement will enter into force following a six-month Congressional review period mandated by the CLOUD Act, and the related review by UK’s Parliament.

Australia has already announced that it is seeking its own CLOUD Act executive agreement, and Canada is rumoured to be in similar discussions.

The Canadian Association of Chiefs of Police have been lobbying pretty hard for an executive agreement between Canada and the US, and called for it in their 2018 Annual Resolutions:

BE IT FURTHER RESOLVED that the Canadian Association of Chiefs of Police urges the Government of Canada to negotiate a bilateral data-sharing agreement with the United States of America who are authorized to do so pursuant to the CLOUD Act, and;

BE IT FURTHER RESOLVED that the Canadian Association of Chiefs of Police seeks a commitment from the Government of Canada for meaningful consultation with the CACP during the development of these instruments.

So what would this look like for Canada? The CLOUD Act and executive agreements are based on reciprocity, meaning that not only can Canadian law enforcement obtain information from US-based service providers, but American law enforcement can obtain information from Canadian-based information custodians. Currently, that’s mostly a no-go except through the MLAT.

In order for Canada to sign an executive agreement and give it effect, it would have to amend the Criminal Code and other statutes to give Canadian production orders extraterritorial effect or to create a new class of production orders, in a manner that is similar to the UK Crime (Overseas Production Orders) Act 2019. Notwithstanding the wishful thinking of many in Canada’s law enforcement community (relying, in part, on the wrongly-decided Brecknell decision from BC), Canadian production orders to not operate extraterritorially.

Removing Canadian legal barriers to foreign court orders that are subject to the bilateral executive agreement will likely be the most controversial part of the process. Canadians likely do not mind if Canadian law enforcement are able to obtain data about Canadian suspects in Canadian criminal investigations from foreign service providers. They likely will care about whether US law enforcement can obtain access to information from Canadian service providers.

Currently, all Canadian privacy laws prevent disclosure to foreign law enforcement under foreign orders. That includes private sector privacy laws, like the federal Personal Information Protection and Electronic Documents Act and provincial equivalents. The list would also include the health privacy laws in effect in most Canadian provinces, and each public sector privacy law. Currently, the public sector laws in British Columbia and Nova Scotia specifically prohibit disclosures in response to “foreign demands for disclosure”. This will either have to be removed or Canada will need to negotiate an exception in its executive agreement with the US to carve out information that is subject to public sector privacy laws.

What will likely be lost in the discussion and debate is the fact that CLOUD Act agreements are not intended to simply give effect to all orders from the other state. They are intended to create a form of passing lane in the MLAT for certain kinds of orders where the requesting state has a strong interest in the data and the receiving state has a minimal interest. For example, Canadian authorities can’t use a qualifying order to get information about a US suspect from a US service provider. Those would still have to go through the MLAT, subject to close scrutiny by American authorities. Likewise, US authorities should not be able to obtain information about Canadians from a Canadian service provider under this arrangement.

What also needs to be emphasised is that any Canadian amendments should not go any further than mirroring the changes made in the US law. The CLOUD Act does not make foreign orders enforceable (with full force of a domestic court order) in the United States, but merely removes certain barriers. Canadian amendments should do the same and make sure that a Canadian service provider has resort to Canadian courts and the Charter to review any foreign demands. And these orders should be limited to serious crimes.

I expect it will be an interesting discussion when it is finally announced. I would hope there is meaningful discussion, rather than just unveiling it as a fait accompli.

Presentation: What’s new in cross-border digital evidence gathering for criminal investigations?

I was invited to present at the High Technology Crime Investigation Association's first annual Canadian Cyber Summit.

I spoke about recent issues and trends in cross-border criminal investigations originating in Canada, starting with the current state of affairs and the Mutual Legal Assistance Treaty regime, issues caused by blocking statutes and what the CLOUD Act will mean for Canadian investigators.

In case it's of broader interest, here's the presentation:

Canadian Appeal Court decides “Virtual Presence” is enough for production order for user information against non-Canadian company

The British Columbia Court of Appeal has whipped the door open for the greater use of production orders requiring non-Canadian companies to provide user information. Here's the summary I prepared for my firm (also available here):

The Legal Reality: Canadian Appeal Court decides “Virtual Presence” is enough for production order for user information against non-Canadian company in British Columbia (Attorney General) v. Brecknell

January 12, 2018

By David Fraser, at McInnes Cooper

Whether a provincial court will grant police a “production order” under the Criminal Code of Canada requiring a non-Canadian company to produce any of its records has, to date, depended on the province in which police seek it. Some courts refuse an order where the company is wholly outside of Canada; some require an address in Canada for service to grant the order; and others grant the order, apparently unconcerned about the company’s Canadian “presence”. That could however change with the B.C. Court of Appeal’s January 9, 2018, decision in British Columbia (Attorney General) v. Brecknell. The Court’s decision that Craigslist is “present” in B.C. and can be subject to a Criminal Code production order issued from its provincial court might lead to greater national uniformity – and more exposure to foreign companies doing only virtual business in Canada:

The Legal Trend. The decision lines up with the Supreme Court of Canada’s increasing awareness of the Internet’s inherently global nature, willingness to take jurisdiction in cases that cross borders, and readiness to apply existing legal principles to online business – all as illustrated in the Court’s June 2017 decisions in Google Inc. v. Equustek Solutions Inc. and Douez v. Facebook, Inc. There’s every reason to believe this trend is here to stay – and foreign companies doing business in Canada, even if only virtually, should be prepared for the increased legal exposure it entails.

Broader Implications. The Court’s conclusion that the distinction between a virtual-only presence and a “physical” presence is effectively a distinction without a difference could carry implications far beyond the availability of production orders. Whether its reasoning vis-a-vis an internet-based company’s “presence” in Canada will have application to, for example, tax laws, remains to be seen.

More Production Orders & More Content. Non-Canadian companies will likely see more production orders from Canadian courts. Canadian courts will more willingly assume jurisdiction over companies where the only contacts with Canada are virtual (i.e. over the internet), and more readily available to police to obtain production orders against such companies – no matter where they are “physically” present. And this route is much preferred by police compared to proceeding under mutual legal assistance procedures. In addition to more Canadian production orders against internet companies, more of those orders will likely be for “content”, not just identifying information and metadata. And this decision will likely lead Canadian police to conclude that compliance is no longer a question of voluntariness: many internet companies “voluntarily” comply with Canadian orders for non-content data but require Mutual Legal Assistance Treaties (MLAT) processes for content such as email and other communications.

In 2016, the Royal Canadian Mounted Police (R.C.M.P.) applied to the B.C. Provincial Court for a production order requiring Craigslist to produce certain information about one of its users. In particular, R.C.M.P. sought the user’s name or physical address, its email address, the IP address assigned to the user when the post was created, the phone numbers used to verify the user account, the dates and times the post was created post and the record of the posting. The court refused on the basis Craigslist had only a “virtual presence in B.C.” The R.C.M.P. appealed and on January 9, 2018, the B.C. Court of Appeal agreed: Craigslist is “present” in the province of B.C. and police can obtain a production order naming it, even though it has no “physical” presence in Canada or an address in Canada to effect service:

Virtual Presence = Physical Presence. Under Canadian law, a Canadian court has jurisdiction where there is a “real and substantial connection” between Canada (or a Canadian province) and the activity in issue. There’s no “bright line” rule, but courts have consistently decided that actively doing business over the internet with residents of a particular Canadian province is enough to create that connection. This in turn gives the court jurisdiction over the specific subject matter and parties (a.k.a “in personam” jurisdiction), a proposition about which the Supreme Court of Canada most recently pronounced in its June 2017 decision in Google v. Equustek Solutions Inc. Here, the Court of Appeal interpreted the Criminal Code provisions as limiting courts’ ability to issue a production order “…only against a person in Canada”, making the question whether Craigslist – a U.S. company with no physical presence in Canada – is “a person in Canada” for this purpose. The Court concluded the distinction between a virtual-only presence and a “physical” presence is effectively a distinction without a difference (at para. 40):

“… [I]n the Internet era it is formalistic and artificial to draw a distinction between physical and virtual presence. Corporate persons … can exist in more than one place at the same time. … I do not think anything turns on whether the corporate person in the jurisdiction has a physical or only a virtual presence. To draw on and rely on such a distinction would defeat the purpose of the legislation and ignore the realities of modern day electronic commerce…”

The Test is Canadian Presence – not Canadian Possession. The Court was clear that the test for a production order is only the presence of the recipient – and not the information sought to be produced – in Canada. Once the Court of Appeal concluded Craigslist was “a person in Canada”, the test was met (at para. 39):

“In the first instance, the [Criminal Code] section, properly interpreted, stipulates only that the person subject to the order must be a person in the jurisdiction. In my view, Craigslist is such a person. Second, the person must be a person who has possession or control of a document. The section says nothing expressly about where that possession or control exists. Indeed, it may not even be sensible to pose the question in terms of the location of control. A person either does or does not have possession of a document. The question is one of control, not where the control is exercised. In this case, Craigslist has possession or control of the relevant records and the provision requires nothing further. In other words, there is nothing in the section that requires the person in the jurisdiction to be a custodian of the documents in the jurisdiction. In my view, it is sufficient that the person is present within the jurisdiction. I do not think that there is anything extraterritorial in such an interpretation. To conclude that Craigslist is a person within the jurisdiction who has possession or control of documents does not give the section an impermissibly extraterritorial interpretation.”

No Other Barriers. The Court of Appeal rejected the argument that a production order against a foreign company effectively intrudes into another country’s sovereignty, essentially deputizing a non-Canadian company to carry out a search in a foreign country that Canadian police could never carry out themselves. The Court concluded the weight of U.S. legal authority doesn’t treat subpoenas in this manner, noting it appears instead to recognize the U.S. validity of subpoenas directed to persons in the U.S. over whom there is personal jurisdiction to disclose documents in the U.S. even where they must be obtained from outside the U.S. The Court also considered – and rejected – the arguments that enforcement difficulties or the existence of Mutual Legal Assistance Treaties (MLAT) militate against the use of production orders in cases like this.

Tower dump case raises troubling questions about law enforcement and privacy

I blogged a couple of days ago about the important case of R v Rogers, 2016 ONSC 70 (Canadian Privacy Law Blog: Ontario court provides clear guidance on privacy and "tower dumps" in R v Rogers and Telus). You may recall that it is the decision that provides police and justices of the peace with guidance on how to formulate “tower dump” production orders in compliance with the Canadian Charter of Rights and Freedoms. This is very important for the future of the use of this investigative technique.

But I think we need to look closely at what happened that gave rise to the decision, and to carefully consider what this says about law enforcement in Canada. I see an institutional attitude that does not even consider privacy rights of Canadians and the Charter that creates them. I find this to be very troubling.

If you’ve read the decision or a summary of it, you will know that the Peel Regional Police were investigating a string of jewelry store robberies. So the Peel Police sought a series of production orders requiring telecommunications companies to deliver the records of all the cellphone towers that are in the vicinity of the crimes being investigated. But its nature, this is purely a fishing expedition. They were hoping that information about a small number of suspects was among the details of tens of thousands of Canadians uninvolved with the crime.

I am told that they got production orders against six telcos, but only two of them pushed back ultimately leading to the court hearing.

So at one point one (or more) police officers thought it was appropriate, and presumably legal, to ask for a production order that would hand him (or her) the personal information of tens of thousands of innocent people, hoping to find that there was information in there about a possible suspect. Presumably, a senior officer signed off on it. A crown prosecutor may have signed off on it, as well.

So what kind of personal information was being sought? A staggering range:

• Names of all customers connected to the towers at the relevant times;
  
• Addresses of all those customers;
  
• Who all those customers were calling at the relevant times, including the names and addresses of those persons
  
• Who all those customers were texting at the relevant times, including the names and addresses of those persons
  
• Billing information, including credit card and bank information, of all those customers

As found by the court, they sought production of information that was entirely irrelevant to their investigation. Billing information would not be helpful at all to this investigation, but they sought it anyways.

Starting this this grossly overbroad request, which included irrelevant information, the police went to a justice of the peace who granted the order. Justices of the peace are the independent judicial officers who are supposed to ensure that intrusive orders are appropriate in the circumstance, including whether they are proportional. This one got by.

Then, when Rogers and Telus pushed back, they tried to withdraw the order in secret, tried to convince the Court that the question was now moot and the Court should not consider Rogers and Telus’ arguments about the privacy of their customers. I infer from this that the police did not want either this production order or their practices regarding “tower dumps” to be scrutinized by a superior court judge. They were caught with their hands in the privacy cookie jar.

The police sought a grossly overbroad order, which included sensitive personal information that was entirely irrelevant to their investigation. This request was presumably signed-off on by a senior officer. They managed to get a justice of the peace to approve it. The detective who testified said that the practice is to limit the request to what is “manageable and can be meaningfully reviewed.” No mention that it is limited because of privacy, proportionality or the Charter.

In court, the police and crown argued that Rogers and Telus have no standing to assert their customers’ privacy interests. The judge dismissed this. (I expect the original production order included a “gag order”, as well. I can’t think of the last time that I saw one that did not include a gag order.) The police and the crown also tried to argue that there was no search in this case that would engage the Charter. The judge dismissed this, too.

The crown also tried to put forward an absurd proposition: if faced with an over-broad production order, the burden should be on the telco to negotiate with the police to narrow it down. I have been in the position of representing companies like these telcos (but not these exact telcos) in discussions with police who are seeking access to customer information. It is really not a discussion. In no way can it be called a negotiation. Threats of obstruction and contempt are to be expected. Not surprisingly, the judge dismissed this out of hand.

Importantly, the judge said that the police have to present the justice of the peace with a constitutionally valid request. They can’t go for everything they can get and then hide behind the justice’s signature.

In this context, we need to recall that Bill C-30, when put forward to Vic Toews and supported by the law enforcement community, could have required Rogers and Telus to hand over this information without a justice of the peace ever having seen the application or the basis upon which it would be based. Recall also, that the current RCMP Commissioner is pushing for a way to go around the Charter and the R. v. Spencer decision from the Supreme Court to get access to this sort of information without judicial oversight.

As a postscript, I should be clear: I think that tower dumps should remain available to law enforcement in the appropriate circumstances. I think that the judge in this case did produce a set of guidelines that -- if followed -- will give police access to this useful tool in a manner that decreases the threat to the privacy of uninvolved persons and is consistent with the Charter.

Ontario court provides clear guidance on privacy and "tower dumps" in R v Rogers and Telus

It is becoming clear that internet companies and telcos are the guardians of personal privacy in this connected age. We surf the internet and walk through the streets in relative anonymity, but the telcos are able to make the connections and name you for the police. For that reason, we need clear rules so that this ability is only used where it is reasonable to do so, in accord with our Charter of Rights and Freedoms.

This morning, the Ontario Superior Court released its important decision in R. v. Rogers & Telus, 2016 ONSC 70 [PDF]. (Some previous discussion is here.)This is a very important decision, which finally provides police and prosecutors with clear guidance on when and how they can obtain telco customer information through "tower dumps". In a nutshell, tower dumps are the production of all the records of a cell phone tower at a particular time. Since your mobile phone is always communicating with at least one tower, tower dumps can tell the police who is in the vicinity of a particular location at a particular time. They are really troubling or problematic because the records overwhelmingly contain information about people who have nothing to do with the underlying investigation.

The production orders obtained by the Peel Regional Police at issue were breathtakingly broad. The police were investigating a string of robberies and went to at least Telus and Rogers, looking for the following information related to cellular towers operated by them:

• Names of all customers connected to the towers at the relevant times;
  
• Addresses of all those customers;
  
• Who all those customers were calling at the relevant times, including the names and addresses of those persons
  
• Who all those customers were texting at the relevant times, including the names and addresses of those persons
  
• Billing information, including credit card and bank information, of all those customers

Rogers asserted that complying with the order would result in the disclosure of information about 34,000 customers. Telus said their demand would involve 9,000 customers. Remember, there was probably only one suspect in all that data, so it would have given the police detailed information about approximately 43,000 people who had NOTHING TO DO WITH THE CRIME. Also note that a justice of the peace granted these orders.

Thankfully, Rogers and Telus pushed back and went to court to challenge the production orders. The police withdrew them, presumably having been caught with their hands in the proverbial cookie jar seeking a breathakingly broad order, and argued that the telcos' application was now moot and that Rogers and Telus didn't have standing to assert the privacy interests of their customers. The court disagreed and ordered a hearing, which leads us to this decision.

The court agreed with the police that tower dumps are a valuable investigative technique. A police detective described the two most common scenarios in which tower dumps are sought:

a. the police have reasonable grounds to believe that a series of crimes were committed by the same person in various locations. For example, a series of robberies with similar hallmarks. Cellular records can identify any subscribers who were in close proximity to more than one of the crime scenes.

b. the police are investigating a single incident, such as a robbery or murder, and have reasonable grounds to believe that the perpetrator used a cell phone at or near the crime scene. The names of persons accessing the cell tower(s) close to the crime scene can then be cross-referenced with other investigative leads. Other such leads might be a list of the owners of Ontario registered vehicles of the type observed leaving the crime scene or the name of a person whose DNA was found at the scene.

The court framed the issues under review as (a) whether there is a reasonable expectation of privacy in the records at issue, (b) do Rogers and Telus have standing to assert their customers' privacy interests, (c) were the production orders overly broad? Did they thus infringe s. 8 of the Charter and what's the appropriate declaration, and (d) what guidance to the police and justices of the peace are appropriate?

Do users have a reasonable expectation of privacy in the cell phone records (including banking information)?

With respect to "reasonable expectation of privacy", the Court said it's a matter of common sense:

[19] Common sense indicates that Canadians have a reasonable expectation of privacy in the records of their cellular telephone activity. Whether and when someone chooses to contact a divorce lawyer, a suicide prevention hot line, a business competitor or a rehabilitation clinic obviously implicates privacy concerns. The location of a person at a particular time also, raises privacy concerns. Was the person at the Blue Jays game instead of at work?

[20] Admittedly this type of information is in the vast majority of cases innocuous. It remains that in a number of cases it will be quite sensitive. It is also not tenable to reason that since only the police will be in possession of this information any sensitive information will never see the light of day. One needs only read a daily newspaper to be aware of the fact that governments and large corporations, presumably with state of the art computer systems, are frequently "hacked" resulting in confidential information being stolen and sometimes posted on-line.

[21] I appreciate that cell phone data is not right up there with Wikileaks and Ashley Madison in terms of information likely to be hacked and published. It remains that it is information Canadians certainly regard as private. The law supports this conclusion.

...

[23] The Criminal Code, s. 492.2, requires judicial authorization, on a "reasonable grounds to suspect" standard, to install transmission data recorders, which can capture the telephone numbers of persons sending and receiving communications. This supports the conclusion that there is a reasonable expectation of privacy in this information.

...

[31] In my opinion the statutes and caselaw align with common sense. Canadians have a reasonable expectation of privacy in their cell phone records.

Do Telus and Rogers have standing to assert their customers' privacy interests

Perhaps not surprisingly, the crown argued that Telus and Rogers have no standing to argue in favour of their customers. And given that the production order likely contained a gag order, the natural result of that would be that nobody can argue for the 43,000 people whose information was implicated. The Court disagreed and notably came to the conclusion that they may have a contractual obligation to stand up for their customers:

[37] The choice is stark. There is an issue concerning the privacy rights of hundreds of thousands of Canadians. If Rogers and Telus are correct, this legal issue can and will be addressed with opposing points of view put forward by counsel. A decision on point can provide guidance to the police and issuing justices. If the Respondent is correct, this legal issue will never be addressed and some justices of the peace will continue to grant similar production orders which, as I will later explain, are overly broad and unconstitutional.

[38] To my mind the choice is clear. Rogers and Telus have standing to assert the privacy interests of their subscribers and are contractually obligated to do so.

Breadth of the production orders

The Court had little trouble concluding that the production orders, described above, were too broad and thus violated s. 8 of the Charter:

[41] The "minimal intrusion" principle embodied in s. 8 was described by Mr. Chan in Morelli and Beyond: Thinking about Constitutional Standards for Computer Searches, the Criminal Lawyers Association Newsletter, vol. 33, No. 2, as follows:

The animating policy is that the state must always be alive to the privacy interests of the individual and must always infringe such interests as little as possible.

[42] The issuing justice did not have the benefit of the evidence before me and the legal submissions of counsel. With that benefit, I have no hesitation in finding that the Production Orders were overly broad and that they infringed s. 8 of the Charter. The disclosure of personal information the Production Orders required went far beyond what was reasonably necessary to gather evidence concerning the commission of the crimes under investigation. For example, the Production Orders:

a) required production of information relating not only to the cell phone subscriber proximate to the crime scene but also the personal information and location of the other party to the call who may have been hundreds or thousands of miles removed from the crime scene;

b) required production of bank and credit card information which, if it had any relevance at all in locating an individual, could have been sought in a follow-up application for a small number of actual suspects (i.e.) a person whose cell phone was proximate to multiple crime locations; and

c) required production of personal information pertaining to over 40,000 subscribers when all the police were really interested in was information, which could have been provided in a report, listing the few individuals, if any, utilizing a cell phone proximate to more than one robbery location.

[43] I, therefore, make the requested declaration that the Production Orders authorized unreasonable searches and so breached the s. 8 Charter rights of the Rogers and Telus subscribers. As the Production Orders have been revoked nothing would be gained by addressing the further issue of whether the Production Orders also violated the rights of Rogers and Telus.

Interestingly (and shockingly, in my view), the Crown argued that the cure for an overly broad order is for the police and the telco to negotiate it down. The Court had little regard for this and I agree. Telcos like Rogers and Telus should only be asked to respond to legal (meaning constitutionally valid) production orders. And having advised clients regarding broad production orders myself, the police will never give you information that substantiates the breadth of the request.

Guidance for police and justices of the peace

The heart of the decision and the portion that will hopefully have a far-reaching and lasting impact, are the guidelines produced by the Court to be followed by the police and justices of the peace. In my view, it hits just the right balance between the clear public interest in having the police investigate crimes with the appropriate tools while respecting the privacy of those whose information is implicated.

Guidelines for police

[65] The police should include in the information to obtain a production order:

a) One — a statement or explanation that demonstrates that the officer seeking the production order is aware of the principles of incrementalism and minimal intrusion and has tailored the requested order with that in mind. — An awareness of the Charter requirements is obviously essential to ensure that production orders are focused and Charter compliant.

b) Two — an explanation as to why all of the named locations or cell towers, and all of the requested dates and time parameters, are relevant to the investigation. — This obviously flows from what is now the s. 487.014(2)(b) Criminal Code requirement that there be reasonable grounds to believe that the documents or data requested will afford evidence respecting the commission of the offence.

c) Three — an explanation as to why all of the types of records sought are relevant. - For example, the Production Orders sought bank and credit card information, and information as to name and location of the party to the telephone call or text communication who was not proximate to the robbery location. This information was clearly irrelevant to the police investigation.

d) Four — any other details or parameters which might permit the target of the production order to conduct a narrower search and produce fewer records. — For example, if the evidence indicates that a robber made a series of calls lasting less than one minute this detail might permit the target of the order to narrow the search and reduce the number of records to be produced. If the evidence indicates that the robber only made telephone calls then there may be no grounds to request records of text messages. (Although the use of voice recognition software may make it difficult to distinguish between a person making a telephone call and a person dictating a text message.)

e) Five — a request for a report based on specified data instead of a request for the underlying data itself. — For example, in this case a report on which telephone numbers utilized towers proximate to multiple robbery locations would contain identifying information concerning only a small number of robbery suspects and not the personal information of more than 40,000 subscribers which the Production Orders sought. This would avoid the concern expressed by Mr. Hutchison that 99.9% of vast amounts of tower dump personal information relates to individuals who are not actually suspects.

f) Six — If there is a request for the underlying data there should be a justification for that request. — In other words, there should be an explanation why the underlying data is required and why a report based on that data will not suffice.

g) Seven — confirmation that the types and amounts of data that are requested can be meaningfully reviewed. — If the previous guidelines have been followed the production order should be focused which will minimize the possibility of an order to produce unmanageable amounts of data. This confirmation does, however, provide an additional assurance of Charter compliance.

Guidelines for Issuing Justices

[66] The guidelines for issuing justices flow from the guidelines for police. Issuing justices should generally insist upon the police providing the information, confirmations and explanations outlined in the Guidelines for Police. Doing so will focus the scope of the production order and ensure that production orders conform to both the requirements of the Criminal Code and the dictates of the Charter.

I think this is ultimately a very important decision that pulls tower dump production orders out of the shadows, shines the light on abusive and overly-broad orders and has led to very sensible, balanced rules to be followed by the police and justices of the peace.