Canadian Lawyer InHouse

27 CANADIANLAWYERMAG.COM/INHOUSE MAY 2016 possibly also credit card information (R. v Rogers Communications). The order, which was withdrawn after initial complaints from the two companies, formed part of a police investigation into a string of jewelry store robberies in Mississauga. Describing the production order as "par- ticularly broad and onerous," Ontario Su- perior Court Justice John Sproat ruled that the police requests breached the Canadian Charter of Rights and Freedoms and he is- sued a set of guidelines on how police and the courts should handle requests of this type in future, based on a principle of mini- mal intrusion. "We went to court because we wanted to ensure our customers' privacy rights are protected and that there are ground rules for the scope of what law enforcement is able to request and access," Rogers' chief privacy offi cer David Watt said in a state- ment released after the ruling. "At Rogers, we will only share customer information with law enforcement when required by law, or in emergencies after careful consid- eration of the request. For us, this request did not meet the test and we're glad the court agreed." For Timothy Banks, Canadian leader of the global privacy and cybersecurity prac- tice at Dentons, the case highlights the crucial role that telecommunications com- panies play in protecting their customers against excessively broad production orders like this "tower dump" order, where police ask for large volumes of information from a series of cellphone towers. "The vast majority of people whose data would be taken through these tower dumps . . . have not done anything wrong, and yet in a fundamental way, their charter rights are being engaged," he says. "They will nev- er know, there is no natural forum for them to complain. And so it is very important that organizations like, in this case, Rogers and Telus, stand up on behalf of their custom- ers when they see an over-broad produc- tion order, because there is no one else who can naturally stand up and say 'this actually goes too far'." Banks says the fi fth of Justice Sproat's seven guidelines, a recommendation that the telecommunications companies provide a focused report based on the data that police request rather than handing over raw data, could effectively co-opt companies into do- ing police work. But it does not make the initial data request any less intrusive, and he, like others, is sure that further requests for legal clarifi cation will follow as police seek information and companies and individuals fret about intrusion on privacy rights. "With the Internet of Things and with other devices . . . transmitting data in nearly real time, if not real time, there is going to be a treasure trove of data out there that will be able to track the whereabouts and movements of Canadian citizens generally, and if there is data that can be useful for law enforcement investigation, you can bet that Canadian law enforcement is going to eventually seek ac- cess to it," Banks says. "That's not necessarily a bad thing, but it does mean that private sec- tor businesses are being put in the position of doing investigative work for the police." Scott Hutchison, of Henein Hutchison LLP, who led the case on behalf of Rogers and Telus, says the initial police request was particularly troubling because police knew that most of the information they were ask- ing for would relate to innocent people. He says the judge's guidelines help clarify the roles for police and courts and for the companies, who have contractual and statu- tory obligations to protect their customers' privacy. "The police should ask for less, the justices of the peace should be careful to make sure that they don't grant more than they are supposed to grant, and companies presented with these orders should scruti- nize them and not simply shovel everything out of the door without any kind of con- sideration as to whether or not the order is properly made," he says. "In all of these things, these companies are trying to balance their obligations as good corporate citizens with their obligations to their customers, and, candidly, protecting their customers' privacy is part of being a good corporate citizen," he adds. "In-house counsel has to be ready to have in mind in advance some sense of how your company is calibrated with respect to those issues." Readiness to challenge an order could depend on the urgency of the request, and of the scale of the issue that police are in- vestigating, but the police must be able to explain why they need all the information they are looking for. But Banks notes that legal challenges can be costly, especially for smaller phone or In- ternet providers. "In many cases, it is going to be cheaper and there will be less friction with law enforcement to simply hand over whatever is being requested," he says. "It is important that organizations that receive these requests frequently . . . actually do stand up and ensure that privacy laws and charter rights are respected. Because if not them, who?" IH The police should ask for less, the justices of the peace should be careful to make sure that they don't grant more than they are supposed to grant, and companies presented with these orders should scrutinize them and not simply shovel everything out of the door without any kind of consideration as to whether or not the order is properly made. SCOTT HUTCHISON, Henein Hutchison LLP

• Cover