The impending decision of the U.S. Second Circuit Court of Appeals in Microsoft v. United States could reverberate throughout the cloud computing environment worldwide.
The case, which has become known as “Microsoft Ireland,” was heard on September 9. It puts in issue the scope of the US government’s power to seize the personal information of a company’s clients, even when the data resides on a company server located abroad.
Chantal Bernier, the former Interim Privacy Commissioner of Canada who now practises with Dentons Canada LLP in Ottawa, urges Canadian companies doing business in the US to follow the case closely.
“If the appeals court upholds the decision of the lower courts, Canadian companies in the US will find that they might be subject to US jurisdiction in respect of any data they control whether it is located in the US, in Canada, or elsewhere,” she says.
Ireland started as a narcotics case. In aid of an ongoing investigation, the US Department of Justice obtained a warrant ordering Microsoft’s MSN email service to turn over certain client records residing on a server in Dublin. The company refused, pointing out that the government could seek access by virtue of its mutual legal assistance treaty with Ireland.
But both a federal magistrate and a district judge in the United States District Court for the Southern District of New York ruled against Microsoft.
As Bernier sees it, these rulings trend in the same direction as recent jurisprudence in Canada, particularly the British Columbia Court of Appeal’s decision earlier this year in Equustek Solutions Inc. v. Google. The court upheld an order requiring Google, a foreign entity that was not a named defendant in the main proceedings, to remove a company’s websites from all its worldwide search results.
At first instance, the B.C. Supreme Court concluded that Google, which is incorporated in Delaware and operates from California, was carrying on business in the province because it sold advertising to BC clients, an activity inextricably linked to its search engine, which provided the forum for the ads. The ad revenue also paid for the search engine’s operation.
The upshot was that the BC courts had territorial jurisdiction over Google. That was enough to justify a global order.
“Once it is accepted that a court has in personam jurisdiction over a person, the fact that its order may affect activities in other jurisdictions is not a bar to it making an order,” the motions judge concluded, a view with which a unanimous BC Court of Appeal agreed.
While Ireland and Equustek engage different issues in strict terms, the issues in the cases are decidedly linked.
“Both cases raise the issue of the extraterritoriality in the context of jurisdiction over the Internet and both seem to conclude that if you are a worldwide business that controls data located outside the jurisdiction, the fact of control can make you subject to a domestic order that impacts the foreign data,” she says.
At the heart of Ireland is the foundational question as to the distinction between a domestic order affecting operations abroad and an extraterritorial order. Microsoft’s argument is that the outdated 1986 statute that applies to the case, the Electronic Communications Privacy Act, says nothing about the seizure of private electronic data stored extraterritorially. Absent legislative action, the company urges, the court should not enforce the statute so as to give it extraterritorial effect.
For its part, the DOJ counters that the order requiring Microsoft is not extraterritorial at all: it is a domestic order requiring a company that is clearly subject to US laws to turn over data that it controls. The upshot is that the location of the data matters not a whit.
David Young of David Young Law in Toronto believes that the US appeals court will rule in the government’s favour.
“Like the Google decision in Canada, a ruling that has extraterritorial impact would not surprise me,” he says.
The issue becomes even more difficult, however, if local law where the data resides prohibits the disclosure of the information that is being ordered.
“Then, companies could be subjected to a real and serious conflict of laws,” Young says. “But that doesn’t mean the Ireland case will not be making a useful contribution to the discussion.”
The ultimate goal, Young says, is the evolution of principles of comity and mutuality similar to the ones that now apply to the enforcement of foreign judgments.
“That would make things a lot easier for businesses everywhere,” Young says. “But we’re not there yet.”