A recent CBC (Canadian Broadcasting Corporation) news report declared: “Canadians could be subjected to the application of the American USA Patriot Act”. Another CBC news report declared on May 16th 2006: “Canadians under American scrutiny”. The question that was raised in these news reports is the following: is the private information of Canadian citizens and businesses effectively protected by Canadian laws? This preoccupation is sufficiently serious that the Canadian government is studying the question.
Indeed, the right to protection of personal information has long been considered as a fundamental right in Canada. In addition to the Canadian Charter of Rights and Liberties, the Universal Declaration of Human Rights and the United Nations’ International Pact Regarding Civil and Political Rights enshrine the protection of personal information either as a fundamental right or as an intrinsic part of the protection of human dignity and freedom.
Beyond the alerting news bulletins, the Legal Insider proposes an analysis of certain dispositions of the USA Patriot Act, in order to verify whether such disquietudes are based in reality.
Background – A Law of Exception?
USA Patriot Act is an acronym for “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism ». This act has been promulgated by the United States on October 24th 2001, in the wake of the terrorist strikes of September 11th 2001. In fact, its effect is essentially to build upon a previous 1978 American statute, the Foreign Intelligence Surveillance Act, by substantially augmenting the powers of American authorities (FBI, CIA, NSA, and American armed forces) in their acquisition of confidential information.
When it was adopted, the USA Patriot Act was presented by the American government as a measure that would allow it to protect the security of the American people by unmasking international terrorists present on national soil. In the aftermath of the terrorist strikes of September 11th 2001, the necessity and urgency of insuring the security of the American nation and its people through an Act allowing access to certain confidential information appeared as a laudable priority. However, in hindsight, many (including certain American groups for the defence of individual liberties) have examined the possibility of abuse in the application of the USA Patriot Act.
Since its inception in 2001, the Act’s restrictive effects upon individual rights and liberties have been much discussed. However, few have analyzed the international effects of its application. Can this law have extraterritorial repercussions, which would affect the privacy of individuals that are neither citizens or residents of the United States? Since its adoption, the USA Patriot Act has allowed the American authorities to access numerous databases containing confidential information on tens of thousands of citizens. Beyond its obvious application to American citizens and businesses, could this Act allow the American authorities to access confidential information about foreign individuals and corporations?
Extraterritorial Effects of the USA Patriot Act – Legal Analysis
It has been forwarded that the effects of the USA Patriot Act‘s application could extend beyond the American borders and infringe upon the right to privacy of thousands of non-American citizens and foreign businesses. Since this Act appears to be here to stay, it becomes important for every foreign individual, Canadian or otherwise, to ponder in which fashion, be it directly or indirectly, this Act could affect him or her.
In order to validate the hypothesis of these extraterritorial effects of the USA Patriot Act, one must study the different steps of its application. For the purpose of the following analysis, the term privacy is construed as any information that an individual (a natural person) or a corporation (a legal person) wishes to keep confidential.
Divulgation of Information
In a report entitled “Privacy Matters: The Federal Strategy to Address Concerns About the USA PATRIOT Act and Transborder Data Flows“, the Treasury Board of Canada Secretariat writes the following:
“Under section 215 of the USA PATRIOT Act, the FBI could potentially obtain records that are held by companies located in the U.S., or records for which U.S.-based companies have direct access, and requires the companies not to disclose these actions.”
To the Treasury Board of Canada Secretariat‘s opinion, the following qualifications may be made: Section 215 of the USA Patriot Act (for which you may refer to the integral text of the Act appended at the end of this newsletter) allows the director of the Federal Bureau of Investigation (FBI) to obtain, as part of an investigation conducted against international terrorism or any covert intelligence activities a Court order, a Court order commanding an American citizen to produce any document (including books, records, files, papers, documents and any other tangible thing) accessible by that citizen. It must be noted that a Court order issued under the USA Patriot Act may be served upon any American citizen, regardless of actual suspicion of having committed a terrorist act (or of intending to commit one) or of engaging in clandestine intelligence activities.
The Application of the USA Patriot Act to American Citizens Residing Abroad
Upon reading the USA Patriot Act, it is interesting to note that an order issued under this Act may be served upon any American citizen, regardless of whether he or she resides on American soil or abroad. Indeed, nothing prevents the American authorities to constrain an American citizen temporarily residing outside his or her native country in order to obtain certain information.
Take as an example the fictitious case of a citizen residing outside the United States for a given time, but that intends to one day return to live in that country or that still owns assets on the American territory. It is most probable that such a citizen would feel vulnerable to and would fear the consequences of refusing to obey a Court order issued under the USA Patriot Act.
Some may hold that this interpretation is rather theoretical and would not find application in reality. However, a reading of the USA Patriot Act leads to the conclusion that this interpretation may very well be retained by the American authorities. Indeed, if even important American banking concerns feel constrained by an order issued by American authorities, imagine the consequence for a private citizen!
Considering the consequence of a refusal to comply with an order issued under the USA Patriot Act (discussed hereinafter), what person may dare to, or have the means to, resist such a demand from the FBI? The interest of such a person is difficult to see, as:
- Under section 215 of the USA Patriot Act, it is prohibited to any individual or corporation receiving such a Court order to disclose the existence of that order on pain of sanction. Following this logic, an employee of American citizenship that is required to provide certain documents to which he or she has access as part of his employment may not even inform his employer (or supervisor) or the corporation’s board of directors.
- An individual or corporation that communicates information to the FBI following a Court order issued under the USA Patriot Act is granted total immunity and may not be sued for damages by a third party regarding, as an example, the communication of private or privileged information concerning that third party.
Furthermore, it is troubling to note that, while this prerogative of the FBI is in theory subject to the prior approval of the American Courts, the tribunals have in practice no discretion regarding the issuance of the requested order. Indeed, as long as the requirements for the issuance of the order are met (i.e. existence of an ongoing investigation concerning terrorism or clandestine intelligence activities, conducted under guidelines set by the Attorney General), the judge must issue the order. Also, the American authorities are under no obligation to prove probable cause (that is, the existence of specific facts leading to the belief that a crime has been committed or is about to be committed). The authorities have only to invoke the fact that the information to be communicated could be related to an ongoing investigation concerning terrorism or clandestine intelligence activities; the proof of an actual, probative link is not required.
Practical Application: Some Examples of the Extraterritorial Effects of the USA Patriot Act
1. Implications for Outsourcing Contracts Granted to American Corporations
The present economy is information-based. Indeed, information and know-how count among the main elements creating wealth today in industrialized countries. Thanks to the new technologies of the Information Age, the western nations are becoming a society based on information. Computers, databases, and advanced software allow businesses, governments, and individuals to easily share information with each other and thus carry out their activities in any place and at any time. The flow of computer data from one country to another, including personal information and other sensitive data, is called “transborder data flow’.
The volume of transborder data flow increases every day, due in part to the phenomenon of outsourcing, a practice becoming more and more popular with businesses and governments. Outsourcing is the practice of contracting with an external supplier in order to implement a program or provide a service such as managing a database. Outsourcing often leads to savings on costs and improvement in the quality of service.
The utilisation of outsourcing has taken a global scale. Thus, a business located in Canada can outsource the management of some of its activities, such as storing and managing personal and confidential information, to an organization based in a foreign territory.
Even though transborder data flow has led to gains in efficiency, has opened access to new products and services, and has generated non-negligible financial advantages, the transfer of personal information from one country to another also raises concerns, notably regarding the danger that the information may fall in the hands of third parties to which it is not destined. This later eventuality may bypass the protection of confidential personal information afforded under Canadian law.
Notably, one may fear that personal information would thus become more easily accessible in the United States (by the American authorities), when it should be protected (and non-accessible) under Canadian laws such as the Personal Information Protection and Electronic Documents (Federal) Act (PIPED Act). The PIPED Act obliges organizations based in Canada and relying upon third-party service-providers to institute measures ensuring a level of confidentiality equal to the level they would themselves have to offer. Typically, the organization will include in the outsourcing convention a contractual obligation, for the third-party supplier, to respect the confidentiality rules elaborated by Canadian law. However, once the clients’ personal information is in the possession of a third-party supplier established in a foreign country, the information is subject to the laws of that country. If a conflict arises between the contractual confidentiality obligation and a legal obligation to disclose (such as a subpoena issued under the USA Patriot Act), there is no contest that the law of the land will prevail.
Hence, there exists, at least in the law as written, a risk that American governmental agencies may gain access, through the application of the USA Patriot Act, to the personal information of Canadian citizens, when such information is outsourced to an American service-supplier. In consequence, a corporation based in Canada that outsources its data management to the United States should at the very least inform its clients that their confidential information could be made available to the United States government under a legal court order of that country.
2. The American Corporation and Its Foreign Subsidiaries
A fictitious example, which might as well happen in reality: a Canadian hotel chain, with establishments throughout Canada, is bought by an American corporation. Every year, the American head office dispatches its team of comptrollers to each of its subsidiaries in order to evaluate the profitability of the branch hotels. These persons, American citizens residing and working in Miami, are mandated with verifying the accounting, as well as the implementation of policies and quality standards set by the head office. Ordinarily, comptrollers can access about any documentation they themselves consider pertinent. It would thus be tempting for the FBI to compel such a comptroller to disclose confidential information such as hotels’ guest lists, the date and length of stay, etc. Would this comptroller be at liberty to refuse to disclose the requested information? If yes, would he or she even be inclined to refuse? It is very likely that a comptroller in such a situation would have not even have an interest in refusing to disclose such information, because:
- As an American citizen residing in the United States, he or she will not take the risk of personally suffering the onerous legal consequences of a refusal to disclose the requested information;
- He or she in under no obligation to disclose the existence of the FBI order to anyone, and in fact doing so would be prohibited by law;
- In any case, he or she is granted total immunity with regards to any damages that may be caused by the disclosure of the requested information.
3. American Citizens Working Abroad
Were an American engineer to take up an employment offer to work in Berlin for a German company, would he be subject to American law and, more specifically, to a subpoena of the American government issued under the USA Patriot Act? When he receives such a demand for information, is he obligated to communicate to the American authorities the documents to which he has access in the scope of his employment? In the authors’ opinion, if this engineer intends to return living in the United States one day, if he still owns assets there, and/or if he retains a patriotic fibre, he will in all likelihood communicate the required information to the requesting American agency.
4. Firms of Professionals
In the liberal professions (lawyers, accountants, engineers, architects, etc.), more and more firms and partnerships of an international scale are emerging. Indeed, certain accounting and law firms with offices in the capitals of the world are well known. In these organizations, it would not be out of the ordinary for an American lawyer, member of the New York bar, to take a temporary assignment in his or her firm’s Paris office.
The USA Patriot Act grants broad powers to the American authorities; the application of these powers is discretionary, and follows a non-public procedure. The reader is free to draw his or her own conclusion.
A Real Danger?
According to numerous Canadian studies and experts, the American authorities could use the powers granted by the USA Patriot Act to access personal information concerning Canadian citizens. However, opinions differ as to whether this is likely or not. In other words, some hold that the risk that the confidential information of Canadian citizens would fall into the hands of the American authorities is not high. On the other hand, some are seriously concerned by this possibility. Whether the American authorities will indeed use the powers offered by the USA Patriot Act to systematically constitute a personal information database is up for debate. What none may deny is that the American government has, with the USA Patriot Act, the power and capacity to do so.
In the report cited above (“Privacy Matters: The Federal Strategy to Address Concerns About the USA PATRIOT Act and Transborder Data Flows”), the Treasury Board of Canada Secretariat shares the Privacy Commissioner of Canada’s opinion to the effect that the USA Patriot Act will probably not become the principal information gathering tool for U.S. Agencies; that conclusion is hardly supported by probative arguments. The Secretariat further reports that, according to the Commissioner, it is more probable that the American authorities will continue to rely on other means of information gathering, such as grand jury subpoenas, ordinary search warrants, and information exchange agreements or bilateral judicial-cooperation treaties concluded with Canada and other nations. To this, others retort: why would the American authorities complicate their investigations by relying upon traditional methods to obtain confidential information and documents when they have access to a new, easier alternative? As the authors of the present text are only jurists, they leave the answer to this question to the sociologists, political scientists, and economists. Remaining is the fact that the American government has given itself the power and capacity to collect, on a large scale, information normally considered private or confidential; it seems intent on making use of it.
In light of the following affirmations made by the Privacy Commissioner of Canada, the authors pray the reader to draw his own conclusions regarding the reasons why Canadian authorities seem unconcerned by the potential danger of the USA Patriot Act.
“International Trade Is Vital for Canada
In Canada, one out of four jobs is related to international trade. The world economy does not only concern corporations, organizations, and governments. Citizens, as individuals, also play their part, and Canadians are among the greatest users of electronic commerce.”
“Canada Is One of the Main Beneficiaries of Outsourcing
The United Nations Conference on Trade and Development has lead to the publication, in 2004, of a report titled Report on Investment in the World 2004 – Growth of the Service Industry. This report stated that the countries who beneficiated the most from foreign outsourcing are Ireland, Canada, Israel, and India.” [Our translation]
Still according to the CBC’s May 15th 2006 news report: “more than half of [Canadian] federal agencies and ministries entrust to American businesses the management of Canadians’ personal information.” An alarming number? Could confidential information stored in such databases fall under the scrutiny of the FBI? The Legal Insider does not take position on these issues: the questions are up to debate. It must be kept in mind that the entire process (investigation, information gathering, and issuance of subpoenas) must remain confidential by law. Will the American government use these new legal tools with circumspection, or on the contrary, will it endeavour to constitute the most exhaustive database ever conceived to this day?
As for the foreseeable future, the USA Patriot Act is here to stay, and thus must be taken into account. However, as far as the international public is concerned, the various governments outside the United States, as well as corporations and the citizens themselves, must remain conscious of the existence of this Act and of its potential consequences. Indeed, private citizens must consider who has access to their confidential information, and with what goal.
While they are supposed to be protected (and inaccessible) under Canadian privacy laws, must it be feared that personal information will become more easily accessible in the United States by the American authorities?
Are those that persist in ignoring this problem partially correct? Can Canada afford to oppose its American neighbour, taking into account that the economical stakes are considerable (in the words of the Privacy Commissioner of Canada)?
A corporation based in Canada that outsources its information processing to the United States should, at the very least, inform its clients that the confidential information they submit may become available to the American government, or its related agencies, under a legal order issued by that country.
Last update: October 2006