On April 20, 2023, the Supreme Court of Canada declined to hear an appeal from the Alberta Court of Appeal’s decision of R v. Love[1], (Love)[2]. As a result, Love stands as guidance for how production orders issued by law enforcement apply to foreign entities. Following Love, law enforcement can now compel a foreign entity to disclose data and information held outside of Canada when that entity has a “virtual presence” in Canada. Despite this apparently clear direction, we will discuss how the practical effect and implementation of the Court’s finding in Love is decidedly less clear.
Production orders
The Canadian production order regime came into effect in 2015[3] with an aim to modernize police investigative powers by making the collection of evidence more efficient. In short, a production order requires the custodian of specific information to make that information available to law enforcement officials. The custodian is often a third party otherwise unrelated to, or involved in, the relevant criminal investigation. A judicially authorized production order is one of the many powers made available to law enforcement and puts into practice the idea that for the efficient and effective investigation of offences, not every instance should require the need for a warrant.
The use of production orders, like any order issued via the Criminal Code[4], is confined to the boundaries of Canada as the power granted by the order cannot be exercised in an extraterritorial fashion. However, the Internet’s inherently global nature and the realities of modern day electronic commerce of Internet service providers and social media websites has challenged the idea of what data is truly defined as “extraterritorial” and what a production order can be used to compel. In particular, prior to Love, it was unsettled as to whether a production order could be used to compel the disclosure of information held outside of Canada by a foreign entity, even when that foreign entity has a “virtual presence” in Canada.
Prior jurisprudence concerning production orders and foreign corporations
Indeed, for the past several years, competing decisions from the Provincial Court in Newfoundland and the Court of Appeal in British Columbia left the Canadian approach on production orders unsettled.
Initially, the prevailing practice had been that if there was content stored outside of the country it would be necessary to seek a Mutual Legal Assistance Request to obtain that data. This was the approach followed by the Provincial Court of Newfoundland In the Matter of an application to obtain a Production Order pursuant to section 487.014 of the Criminal Code of Canada[5] (NFLD Decision), in which the Court determined that a production order could not be issued extraterritorially, and the data or information sought by law enforcement must be located within Canada for a production order to have any effect.
However, this was not the approach favoured by the British Columbia courts, where the test is one of a “Canadian presence” as opposed to “Canadian possession.” The British Columbia decision of British Columbia (Attorney General) v. Brecknell[6] (Brecknell) found that the test for a production order is that the recipient of the information – and not the information sought to be produced – need be in Canada.
The reasoning in Brecknell was followed in the Ontario case of Re Application for a Production Order, s. 487.014 of the Criminal Code[7], otherwise known as the “GoDaddy” decision. It was applied on the basis that the “GoDaddy” website conducted business online in Canada and maintained a virtual presence in Canada.
Love and the aftermath
In the case of Love, law enforcement obtained a production order from the Alberta Court of Justice requiring Facebook Inc. to produce certain subscriber information. The accused appealed the issuance of the production order, arguing that the Alberta Court of Justice did not have the requisite jurisdiction to issue such an order as it would have been an extraterritorial application. Such an appeal urged the Alberta Court of Appeal to follow the NFLD Decision.
The Court of Appeal in Love denied the accused’s appeal and adopted the position in Brecknell, finding that the Alberta Court of Justice had the required jurisdiction to issue the production order against Facebook, due to Facebook’s virtual presence in Alberta.
Love clarified that contrary to the NFLD Decision, a production order has “no impermissible extraterritorial effect when the person subject to the production order has a virtual presence in the local jurisdiction.”[8] The Court in Love further found that this understanding was bolstered by parliament’s intention when enacting the production order regime, highlighting the following Hansard quote:
“Law enforcement agencies and crown prosecutors have been asking for a new investigative tool for some time and with the proliferation of the Internet and the widespread adoption of new communications technologies, the timing is right for this form of investigative tool.
The production orders will solve a number of nagging issues for investigators including extraterritorial searches and timing issues. Under these new orders, persons who have possession or control of documents, data or information will have to produce that information whether it resides in Canada or abroad. Thus, as long as they have possession or control over the relevant information, they will be required to produce it no matter where it is located. This solves the problem that has in part been created by inexpensive overseas data warehousing.”[9]
Following the decision in Love, the Québec Superior Court also issued a judgment congruent with the Love decision. The Québec Court ruled that Snap Inc., an American company whose information was stored abroad, had to produce the data per the production order to the Montréal police department.[10]
Implications of Love
The decision in Love, along with the decision from Québec, clearly provides that a foreign corporation with a “virtual presence” in Canada can be compelled to produce data located outside of Canada via a production order. The practical implications of Love, however, are yet to be determined.
First, it is not clear what level of virtual presence would bind a corporation to a production order. The Court in Love simply took judicial notice of Facebook’s “virtual presence” in Canada. As a result, no test was provided to determine when a company has a “virtual presence” in Canada. Further, it is not clear if a lesser-known website or entity accessed by an accused in Canada would have a sufficient “virtual presence” to be brought within the production order regime. The British Columbia Court of Appeal in Brecknell found that:
“[40] …in the Internet era it is formalistic and artificial to draw a distinction between physical and virtual presence. Corporate persons, as I have noted, can exist in more than one place at the same time. With respect, I do not think anything turns on whether the corporate person in the jurisdiction has a physical or only a virtual presence. To draw on and rely on such a distinction would defeat the purpose of the legislation and ignore the realities of modern day electronic commerce. Moreover, the current facts illustrate the doubtful relevance of the distinction. Craigslist’s virtual presence is closely connected to the circumstances of the alleged offence, because at least some elements of the alleged offence were facilitated by relying on the services Craigslist provides virtually. In terms of the alleged offence, any physical presence Craigslist may have in the jurisdiction is beside the point. A corporate entity’s physical presence may have nothing to do with the circumstances of an offence. In my view, it would be curious if the presence of a retail outlet which is totally unrelated to the acquisition of information sought by a production order would ground a jurisdiction that did not otherwise exist.”[11]
This conclusion bears the question of whether any virtual presence would satisfy the requirement in order to compel production on a foreign corporation.
Second, the decision in Love also gives rise to questions relating to the data privacy obligations of corporations. Corporations who are interacting with the residents of Canada can be held to the laws of the land. In particular, if a corporation collects personal information from individuals in a specific jurisdiction, corporations are expected to align their practices in accordance with the applicable privacy legislation of that jurisdiction.
In doing so, corporations must be careful to balance their obligation to cooperate with law enforcement while being aware of upholding their customers’ constitutional and statutory privacy rights. There are a number of obligations that corporations will be expected to uphold when disclosing individuals’ personal information under a production order. For that reason, it is important that corporations understand such obligations as set out below to not contravene the law while fulfilling the production order.
Takeaways
- Corporations that have any interaction with users or customers in Canada may be held to a production order if they have a “virtual presence” in Canada.
- Corporations should ensure to notify their customers whose personal information they collect that they may be required to disclose their information to the law authorities of Canada, if compelled and reasonable.
- If faced with a production order, corporations should:
- Only disclose the personal information that is necessary to satisfy the production order; and
- Keep records of the production order request, their decision as to the disclosure, and the information disclosed per the production order.
For more information on this topic, please reach out to the authors, Murray Rodych and Melika Mostowfi.
[1] R v Love, 2022 ABCA 269.
[2] Michael Christopher Love v His Majesty the King, 2023 CanLII 31586 (SCC).
[3] On March 10, 2015, Protecting Canadians from Online Crime Act 2014, SC 2014, c 31 (Bill C-13) came into force re-drafting the production order provisions 487.012 and 487.013, online: <https://canlii.ca/t/52m4g>.
[4] The Criminal Code of Canada, RSC, 1985, c C-46 (“Criminal Code”).
[5] In the Matter of an application to obtain a Production Order pursuant to section 487.014 of the Criminal Code of Canada, Re [2018] NJ No 21, 2018 CanLII 2369 (NL PC).
[6] British Columbia (Attorney General) v Brecknell, 2018 BCCA 5.
[7] Re Application for a Production Order, s 487014 of the Criminal Code, 2019 ONCJ 775.
[8] Love supra note 1 at para 39.
[9] Love supra note 1 at para 40.
[10] (Re) Police Department of the City of Montreal, 2022 QCCS 3935.
[11] Brecknell supra note 3 at para 40.
