I. Introduction
It is an important task of every litigator to consider the balance between the competing interests of the protection of personal privacy and a party’s disclosure obligations. With the expansion of international commerce, balancing these interests has become more complex. In recent years, the inter-jurisdictional transfer of documents has received increased attention from lawmakers concerned with protecting privacy rights.
This paper considers the interactions between the disclosure obligations in Canada and the United States, and the privacy laws of the European Union. With the exception of the province of Quebec, all jurisdictions in Canada have broad disclosure obligations whereby parties involved in litigation are required to disclose to adverse parties all documents related to the matter at issue. The transfer of documents across provinces or territories within Canada pursuant to these disclosure rules is considered obligatory as a matter of order, fairness, and comity. In 1995, the European Union adopted Council Directive 95/46/EC to respect and protect natural persons’ rights to privacy. In furtherance of this objective, transfers of personal data by Member States to countries without adequate privacy legislations were prohibited. This included prohibiting transfers made pursuant to a foreign jurisdiction’s rules of procedure regarding document discovery. Although Canada has been recognized as providing adequate measures for the protection of personal data, many countries, most notably the United States, do not meet European Union standards.
An examination of this dichotomy, as well as other examples where inter-jurisdictional document disclosure obligations arise, can assist in planning for and shaping future international agreements, such as the Comprehensive Economic and Trade Agreement between Canada and the European Union.
II. Canada’s Legal System
Canada is governed as a parliamentary democracy and is established under the Constitution Act, 1867. Constitution Act, 1867, 30 & 31 Vict. Ch. 3. (U.K.), as reprinted in R.S.C., No. 5 (Appendix 1985). The Constitution Act, 1867 gives the federal government exclusive right to legislate over matters such as trade and commerce, banking, and criminal law, while the ten provinces have jurisdiction over matters such as health care, property and civil rights. Id. at sections 91 and 92. Canada also has 3 territories that have no inherent jurisdiction, but are delegated powers by the federal government.
The provinces and territories each have their own courts of first instance. Appeals from these courts are heard at the appellate court of that province or territory. Appeals from a provincial or territorial appellate court are heard at the Supreme Court of Canada, which is Canada’s highest court. There is also a Federal Court which exists primarily to hear lawsuits that fall under the federal government’s jurisdiction. Appeals from this court can be made to the Federal Court of Appeal, and then appealed again to the Supreme Court of Canada. With the exception of courts in the province of Quebec, Canada’s courts use the common law, or judge-made law, which is based on the principle of stare decisis. Courts in Quebec, on the other hand, use a hybrid legal system; on matters of private law, the courts follow a civil tradition, and on matters of public law, the courts follow the common law.
III. Document Disclosure Obligations in Canada
Matters relating to document disclosure obligations in connection with civil suits are governed by a court’s rules of procedure. Although disclosure obligations across the courts are similar and generally very broad, there are slight differences.
A. Provinces and Territories with the Exception of Quebec
Parties involved in civil actions must disclose every document “relating to” (or, for the provinces of Nova Scotia, Manitoba, and Alberta, “relevant to”) the matter in issue that is in their possession, control, or power (or, depending on the province, some subset of possession, control, and power), as well as documents the party intends to refer to at trial. See Rules of Civil Procedure, R.R.O., Reg. 194 (1990) at Rule 30.02; see Civil Procedure Rules, R.S.N.S., ch. 240 (1989) at Rule 15.02; see Rules of the Supreme Court, S.N.L., ch. 42, Schedule D (1986) at Rule 32.01; see Court of Queen’s Bench Rules, Man. Reg. 553/88 at Rule 30.02; see Supreme Court Civil Rules, B.C. Reg. 168/2009 at Rule 7-1; see Rules of Civil Procedure, R.S.P.E.I., ch. 240 (1989) at Rule 30.02; see Queen’s Bench Rules, R.S.S., ch. Q-1 (1978) at Rule 212; see Alberta Rules of Court, Alta. Reg. 390/1968 at Rule 5.14; see Rules of the Supreme Court, S.N.L., ch. 42, Schedule D (1986) at Rule 32.01; see Rules of Court, Y.O.I.C., 2009/65 at Rule 25(4); see Rules of the Supreme Court of the Northwest Territories, N.W.T., Reg. 034-92 at Rule 219; see also Nunavut Judicial System Implementation Act, S.N.W.T., ch. 34, Schedule A (1998) at s. 59(2); see Federal Court Rules, SOR/2004-283, s. 2, Rule 223. A failure to disclose empowers a court to “make such order as is just”, which in many cases could lead to the party’s action being dismissed or defence being struck out. See, e.g., Rules of Civil Procedure, R.R.O., Reg. 194 (1990) at Rule 30.08; see, e.g., S.N.L., ch. 42, Schedule D (1986) at Rule 32.10. Despite these broad disclosure obligations, parties may claim privilege over certain documents. See, e.g., Supreme Court Civil Rules, B.C. Reg. 168/2009 at Rule 7-1.
B. Quebec
In Quebec, there is no general duty to produce potentially relevant documents. A party only has to disclose documents it intends to refer to as exhibits at the trial or hearing. Code of Civil Procedure, R.S.Q. ch. C-25 at Article 331.1. However, on application, the court may order a party “having in his possession any real evidence relating to the issues between the parties to exhibit it, preserve it or submit it”. Id. at Article 402.
IV. Privacy Legislation
The European Union, the United States, and Canada have all taken different approaches to the protection of individuals’ privacy rights.
A. The European Union
i) The Privacy Directive
In 1995, the European Union adopted the Privacy Directive to harmonize the data protection laws of its Member States. Carla L. Reyes, The U.S. Discovery-EU Privacy Directive Conflict: Constructing a Three-Tiered Compliance Strategy, 19 DUKE J. COMP. & INT’L L. 357 [hereinafter Reyes] at 358. One of the reasons behind the adoption of the Privacy Directive was the need for data-processing systems to respect natural persons’ fundamental right to privacy. Council Directive 95/46/EC, on the Protection of Individuals with Regard to the Processing of Personal Data and the Free Movement of Such Data, 1995 O.J. (L 281) 31 [hereinafter Privacy Directive]. As part of its data protection mechanism, the Privacy Directive mandates that Member States shall not transfer personal data which are undergoing processing, or are intended for processing after the transfer, to a country unless the Commission determines that the country ensures an “adequate level of protection”. Id. at Article 25. The Commission also has the responsibility of entering into negotiations with countries to encourage them to adopt adequate levels of data protection. Id. If a country does not ensure an adequate level of protection for personal data, the Privacy Directive puts the burden on the individual Member States to each adopt measures necessary to prevent the transfer of personal data to that country. Id. A party or organization in a Member State that violates the Privacy Directive may be subject to Member State-administered penalties, such as a fine and/or imprisonment. See, e.g., Ashley Winton, Data Protection and Privacy Update, July 2007 (reporting that France’s data protection authority, La Commission Nationale de L’informatique et des Libertés, fined Tyco Healthcare 30,000 Euros for transferring employee personal data from France to Tyco Healthcare’s headquarters in the United States). This mechanism ensures that personal data gathered in Member States is guaranteed a minimum amount of protection because Member States must not only adopt protective standards, but also only allow the transfer of personal data which are undergoing processing, or are intended for processing after the transfer, to countries that are deemed to provide adequate data protection. But what does it mean to transfer personal data which are undergoing processing, or are intended for processing after the transfer? The Privacy Directive defines “processing” to mean any operation “performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction”. Id. at Article 2. This definition is very broad and it effectively prevents the transfer of personal data to any country that has not been deemed “adequate”, since such a transfer would almost certainly involve some form of “processing”, as it is defined.
B. The United States
The United States has taken a very different approach to privacy rights. In 1974, Congress introduced the Privacy Act to regulate federal agencies in their use and disclosure of personal information. Privacy Act, 5 U.S.C. § 552a (1974). However, the Privacy Act’s enforcement mechanisms are considered ineffective. See Jennifer McClennan & Vadim Schick, “O Privacy” Canada’s Importance in the Development of the International Data Privacy Regime, 38 Geo. J. Int’l L. 669 [hereinafter McClennan & Schick] at 675. Instead of enacting comprehensive legislation protecting all of an individual’s right to privacy, Congress has adopted a sectoral approach to protecting private information. For example, the Health Insurance Portability and Accountability Act provides protection for health data, while the Gramm-Leach-Bliley Act governs the collection, disclosure, and protection of consumers’ personal information in the possession of financial institutions. See Health Insurance Portability and Accountability Act, 42 U.S.C. § 201 (2007); see Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 (2007). There are many other examples of sectoral privacy legislation at the federal level. Sectoral privacy legislation can also be passed by state legislatures. For example, California’s Insurance Information and Privacy Protection Act provides protection for personally identifiable information provided to an agent, broker, or insurance company in order to apply for insurance or submit a claim. Insurance Information and Privacy Protection Act, CAL. INS. CODE §§ 791-791.27 (2010).
C. Canada
Canada has what some refer to as a middle-of-the-road approach to the enactment of privacy laws. See McClennan & Schick at 669. While Canada’s privacy laws are comprised primarily of comprehensive legislation that protects all of an individual’s right to privacy, the province of Ontario has also enacted sectoral privacy law legislation.
i) Public Sector
The federal Privacy Act imposes obligations on federal government institutions to respect privacy rights by limiting how they collect, use, and disclose personal information. Privacy Act, R.S.C., ch. P-21 (1985). The Privacy Act empowers the Privacy Commissioner of Canada to investigate any complaints received under the Privacy Act. Id. For provincial government institutions, every province has privacy legislation governing the collection, use, and disclosure of personal information and each is supervised by an independent commissioner or ombudsman.
ii) Private Sector
The Personal Information Protection and Electronic Documents Act controls how private sector organizations collect, use, and disclose personal information in the course of commercial activities. Personal Information Protection and Electronic Documents Act, S.C., ch. 5 (2000) [hereinafter PIPEDA]. PIPEDA is overseen by the Privacy Commissioner of Canada. PIPEDA applies to all organizations engaged in commercial activities, whether they be federal or provincial, unless the Governor in Council exempts the organization or activity. Id. The power to exempt arises if the organization or activity is covered by provincial legislation that is substantial similar to PIPEDA. Id. The Quebec, Alberta, and British Columbia laws have each been recognized as substantially similar to PIPEDA. Organizations in the Province of Quebec Exemption Order, SOR/2003-374; Organizations in the Province of Alberta Exemption Order, SOR/2004-219; Organizations in the Province of British Columbia Exemption Order, SOR/2004-220 [collectively, hereinafter Exemption Orders].
iii) Ontario’s Sectoral Legislation
Ontario’s Personal Health Information Protection Act establishes rules for collection, use, and disclosure of personal health information by health information custodians. Personal Health Information Protection Act, S.O., ch. 3, Schedule A (2004). The Personal Health Information Protection Act has be recognized as substantially similar to PIPEDA. Health Information Custodians in the Province of Ontario Exemption Order, SOR/2005-399.
V. The EU Privacy Directive and Canada’s Disclosure Rules
A. The Issue
Although the Privacy Directive mandates that personal data cannot be transferred outside of the Member States, a party that is involved in litigation in Canada may be ordered to disclose personal data for the purposes of document discovery. See, e.g., British Columbia’s Supreme Court Civil Rules (stating that parties must disclose documents that “relate to any or all matters in question in the action”, unless the documents are privileged). A party may find themselves in the position of having to decide between disclosure, in which case the party would be in violation of the Privacy Directive, and non-disclosure, in which case the party would be in violation of document disclosure obligations. In either case, there is a penalty for the violation.
B. Origins of the Issue: Common Law and Civil Law Approaches to Evidence Gathering
It has been suggested that this issue really stems from a difference between common law and civil law approaches to evidence gathering. Reyes at 361. In common law jurisdictions, such as in most provinces in Canada, the parties themselves are responsible for gathering evidence. There is a pre-trial discovery period which takes place after the filing of a lawsuit but prior to trial. During this period, evidence can be gathered by the parties involved in the litigation. The scope of this evidence gathering is extremely broad and parties are expected to disclose all potentially relevant documents, whether or not the documents are detrimental to their case. If there is a dispute about whether a document should be disclosed, the courts have the power to resolve the issue. See, e.g., British Columbia’s Supreme Court Civil Rules at Rule 7-1. Conversely, most civil law countries do not have a system for pre-trial discovery. See also Craig P. Wagnild, Civil Law Discovery in Japan: A Comparison of Japanese and U.S. Methods of Evidence Collection in Civil Litigation, 3 ASIAN-PAC. L. & POL’Y J., Winter 2002 [Hereinafter Wagnild], at 1, 2. Most evidence production takes place at trial, and the judge assumes primary responsibility for gathering the evidence. See also id. at 4; see also Reyes at 362 (commenting that judges actively question witnesses then decide what documents are discoverable). The parties themselves may only gather evidence through voluntary cooperation or by court intervention. See also id. Given the evolution of these two different legal approaches, it is perhaps not surprising that transnational discovery issues have arisen. Civil law countries have a different concept of the role of a judge, so extensive pre-trial document disclosure is often considered unnecessary. Wagnild at 16. Even worse, it can be seen as a method of fostering fishing expeditions. Reyes at 362. We suggest that the solution to transnational discovery should not be to force litigants to conjure up creative ways to navigate so as to avoid penalties under common law or civil law rules, but rather, the solution should be to find a way to reconcile the differences between the laws.
C. Reconciling the Privacy Directive and the Disclosure Rules
The Privacy Directive permits the transfer personal information from Member States to a third country which ensures an adequate level of data protection. In an opinion dated January 26, 2001, the Privacy Directive’s Article 29 Data Protection Working Party reported on the adequacy of Canada’s PIPEDA. Working Party, Opinion 2/2001 on the Adequacy of the Canadian Personal Information and Electronic Documents Act, 5109/00/EN, WP 39 (Jan. 26, 2001) [Hereinafter WP 39]. The Working Party recommended that any adequacy findings made by the Commission be limited to reflect the scope of PIPEDA. Id. at 7; see also PIPEDA (stating that PIPEDA only applies to organizations that collect, use, and disclose personal information in the course of commercial activities). In a Commission Decision dated December 20, 2001, the Commission decided that for the purposes of the Privacy Directive, Canada be considered a country that ensures an adequate level of protection for personal data. European Commission, Commission Decision on the Adequate Protection of Personal Data Provided by the Canadian Personal Information Protection and Electronic Document Act, 2002/2/EC (Dec. 20, 2001), at Article 1 [hereinafter Commission Decision]. Therefore, transfers of personal data from Member States to recipients in Canada, whether or not the transfers are made pursuant to Canadian discovery obligations, are not a violation of the Privacy Directive. However, the Commission Decision only applied to transfers to Canadian recipients subject to PIPEDA. Id. The problem is that under PIPEDA, the Governor in Council could exempt an organization, a class of organizations, an activity, or a class of activities, from the application of PIPEDA with respect to the collection, use, or disclosure of personal information in a province if the province has legislation deemed to be substantially similar to PIPEDA. PIPEDA at s. 26. The Working Party invited the Commission “to look into the process leading to the definition of “substantially similar” and to ascertain whether it is appropriate to individually recognise provincial laws as providing an adequate level of protection or if the same objective can be attained at the Federal level through an Order in Council.” WP 39 at 7. Recognizing that amendments could be made to PIPEDA and that provincial legislation may be declared by the Governor in Council to be substantially similar to PIPEDA, the Commission declared that the functioning of their adequacy decision would be evaluated in three years. Commission Decision at Article 4. Until that evaluation, the Commission Decision would cover only the organizations subject to Canada’s PIPEDA, and not to those organizations subject to substantially similar provincial legislation. On August 3, 2002, Industry Canada established a process for the determination of “substantially similar” provincial legislation (Office of the Privacy Commission of Canada, Substantially Similar Provincial Legislation). The process involves a consideration of the provincial legislation, and whether the provincial legislation follows the ten principles outlined in Schedule 1 of PIPEDA, provides for an independent and effective oversight and redress mechanism with powers to investigate, and restricts collection, use, and disclosure of personal information to purposes that are appropriate or legitimate. Id. Subsequently, provincial laws in Quebec, Alberta, and British Columbia, as well as Ontario’s sectoral legislation, were determined to be substantial similar to PIPEDA, and therefore organizations or activities subject to them would be exempt from PIPEDA. See Exemption Orders. The question was whether transfers of personal data to these exempt groups satisfied the adequacy requirement under the Privacy Directive. On November 20, 2006 the Commission released a Commission Staff Working Document to re-examine the functioning of the Commission Decision given that some provincial legislation had been deemed by the Governor in Council to be substantially similar to PIPEDA. Commission of the European Communities, Commission Staff Working Document, SEC(2006) 1520 (Nov. 20, 2006). The Working Document concluded that PIPEDA continues to provide an adequate level of protection of personal data within the meaning of the Privacy Directive. Id. at 6. So a determination by Canada’s Governor in Council that provincial legislation is substantially similar to the federal PIPEDA is sufficient for meeting the adequate level of protection standard required under the Privacy Directive. The European Union Privacy Directive and the Canadian disclosure rules were reconciled.
VI. Interjurisdictional Discovery Examples
A. The Privacy Directive and Disclosure Rules in the United States
Unlike the privacy legislation in Canada, the privacy laws in the United States have not been recognized as providing an adequate level of protection. Working Party, Opinion 10/2006 on the Processing of Personal Data by the Society for Worldwide Interbank Financial Telecommunication (SWIFT), 01935/06/EN, WP 128 (Nov. 22, 2006). As a result, a party with personal data located in a Member State that discloses the documents by transferring them to the United States pursuant to the discovery rules of the United States is in violation of the Privacy Directive. Parties are forced to carefully navigate through both the Privacy Directive and the discovery rules in order to avoid penalties. Methods for doing so include: using the safe harbour mechanism, agreeing to abide by mandatory data protection provisions, developing a set of binding corporate rules, entering into model contracts, seeking a protective order releasing the party from its obligation to produce documents, or using a letter of request pursuant to the Hague Evidence Convention. See also Reyes (providing a detailed discussion of these methods).
B. Quebec
i) Quebec’s Internal Discovery Procedure
Quebec has been influenced by common law conceptions of discovery. See JOHN E.C. BRIERLY & RODERICK A. MACDONALD, QUEBEC CIVIL LAW 52 (Emond Montgomery Publications Limited 1993). Although a party is only required to disclose documents that it intends to rely on at trial, certain persons may be required to allow copies to be made of any documents relating to the issues. Code of Civil Procedure at Articles 331.1, 397, 398. Also, a Quebec court may hear an application for the production of documents. Id.
ii) Interprovincial Document Discovery with Quebec
Despite this, the province of Quebec was reluctant to allow documents within the province to be transferred outside the province. Quebec enacted the Business Concerns Records Act to prohibit the removal from the province of documents relating to any business concern in Quebec pursuant to any order or requirement of a juridical authority outside the province. Business Concerns Records Act, R.S.Q., ch. D-12. Quebec’s prohibiting act came into conflict with British Columbia’s disclosure rules in Hunt. Hunt v. T&N plc, [1993] 4 S.C.R. 289 (Can.). In that case, the appellant requested documents relating to the action, but the Quebec Provincial Court granted orders preventing the transfer of documents out of the province. The case went up to the Supreme Court of Canada, which held that Quebec’s Business Concerns Records Act was constitutionally inapplicable to other provinces because it did not respect the minimum standards of order and fairness, namely the right to use discovery as a tool in civil litigation. Id. In the aftermath of the Hunt decision, it became clear that a province would not be able to block a transfer of documents that is pursuant to another province’s disclosure rules. Moreover, Hunt has international implications as well. The Supreme Court of Canada reaffirmed that there is a need for greater comity in our modern era of international transactions. Id.
C. The North American Free Trade Agreement
i) Organization of NAFTA
The North American Free Trade Agreement, or NAFTA, is a trilateral agreement between Canada, the United States, and Mexico. The purpose of NAFTA is to reduce the barriers to trade and investment. North American Free Trade Agreement, U.S.-Can.-Mex., Dec. 17, 32 I.L.M. 289 (1993) [hereinafter NAFTA] at Article 102. The dispute resolution mechanism under NAFTA is driven by the classification of the subject matter of the dispute. NAFTA’s Chapter 11 deals with investment protection and expropriation of assets, Chapter 19 deals with anti-dumping and countervailing duties, and Chapter 20 deals with the general interpretation of the agreement. Id. Chapter 11 disputes can only arise in the context of a NAFTA investor alleging that a government has breached its obligations. The government party, by virtue of being a signatory of NAFTA, pre-consents to arbitration under the International Centre for the Settlement of Investment Disputes, its Additional Facility Rules, and the United Nations Commission for International Trade Law. See id. at Article 1122. Each of these arbitral mechanisms has rules of procedure for dealing with document disclosure, and each ultimately gives the tribunal the power to order disclosure. See International Centre for the Settlement of Investment Disputes, ICSID Convention, Regulations and Rules, ICSID/15 (April 2006) at Rule 34; see International Centre for the Settlement of Investment Disputes, Additional Facility Rules, ICSID/11 (April 2006) at Article 27; see United Nations Commission on International Trade Law, Arbitration Rules, G.A. Res. 65/22, U.N. Doc. A/65/465 (as revised in 2010) at Article 27. Under the Chapter 19 dispute resolution process, parties must file all documentary information with a bi-national panel. NAFTA at Article 1904. Documents which are proprietary or privileged can be sealed and marked. Rules of Procedure for Article 1904 Bi-national Panel Reviews at Rule 41. A party seeking disclosure of these sealed documents needs to submit an application to the panel, and the panel ultimately decides whether or not an order for disclosure should be made. Id. at Rules 46, 50, 52. Chapter 20 disputes involve the general interpretation of NAFTA. The Chapter 20 dispute resolution process involves the appointment of a panel, and the panel has the power to determine the applicable rules of procedure, including those related to document disclosure. See Model Rules of Procedure for Chapter 20 at Rule 17.
VII. Implications for the Comprehensive Economic and Trade Agreement
A. The Comprehensive Economic and Trade Agreement
On October 16, 2008, a study was released showing that a closer economic partnership between Canada and the European Union could be of significant benefit to both sides. What followed was an agreement to start negotiations for a Comprehensive Economic and Trade Agreement (“CETA”) to address tariff issues, investment, and non-tariff barriers. On March 5, 2009, a joint report was released outlining the negotiating agenda. Negotiations for CETA are currently still ongoing.
B. Dispute Resolution under the Comprehensive Economic and Trade Agreement
CETA will also require a dispute resolution mechanism since laws of different jurisdictions are rarely in uniformity. Without a uniform process, the potential for tension exists between the laws of different jurisdictions. One way to avoid this tension is to make pre-arrangements for a dispute resolution process, similar to what was done under NAFTA. In terms of document discovery, it does not matter whether the process involves broad disclosure, like in most common law jurisdictions, or judge-administered disclosure, like in many civil law jurisdictions. As long as there are mutually agreed upon rules of procedure in place, the uncertainty related to disclosure can be minimized.
VIII. Conclusion
Although laws may differ from jurisdiction to jurisdiction, there are ways to reconcile them. The Canada/EU disclosure-privacy example, the Supreme Court of Canada judgment regarding Quebec’s blocking statute, and NAFTA, are all examples of this. In each example, reconciliation came about through different means. The Canada/EU tension was resolved through a Commission decision on the adequacy of Canada’s privacy laws. Quebec’s blocking statute was reconciled through a court ruling on the need for greater comity. And disclosure issues in NAFTA disputes were dealt with pre-emptively through dispute resolution processes being written into the treaty. With negotiations for CETA currently ongoing, it is imperative that consideration be given to a dispute resolution process under CETA. Similar to what was done with NAFTA, Canada and the European Union can agree to either a comprehensive set of rules of procedure or an alternate dispute resolution mechanism to be written into the treaty itself. This would facilitate greater certainty and resolve the issue of which country’s laws should apply in the event of a dispute.