Source: http://www.ipblog.ca/?cat=16
Timestamp: 2019-04-21 16:38:21+00:00

Document:
How far can Canadian courts reach when making orders that seek to control the conduct of foreign companies outside of Canada? This controversial question is still being decided, bit by bit, in both Canadian and US courts. In our past posts we have written about a 2014 pre-trial temporary court order that required Google to de-index certain sites from Google’s worldwide search results, based on an underlying lawsuit that the plaintiff, Equustek, brought against the defendants back in 2011. Google challenged the order requiring it to delist worldwide search results, and fought this order all the way up to the Supreme Court of Canada… where Google lost.
On July 24, 2017, approximately one month after the SCC decision, Google filed a complaint in US Federal Court, seeking an order that the injunction issued by the BC court is unlawful and unenforceable in the United States. That order was granted, first on a preliminary application on November 2, 2017 and then in a final ruling on December 14, 2017. With that US court decision in hand, Google came back to the BC court which had issued the original order, to vary the scope of that order.
On April 16, 2018, in Equustek Solutions Inc. v Jack, 2018 BCSC 610 (CanLII), the BC court again rejected Google’s requests. The BC court said that the US decision (which was in Google’s favour) did not establish that the injunction requires Google to violate American law. And without any significant change in circumstances, the court reasoned, there was no reason to change the original order. As a result, the temporary order against Google – which has been in place since 2014 – remains in place, pending outcome of the trial.
The outcome of that trial will be closely watched. As I mentioned in my earlier article, there has been very little analysis of Equustek’s IP rights by any of the different levels of court. Since this entire case involved pre-trial remedies, the merits of the underlying allegations and the strength of Equustek’s IP rights have never been tested at trial. In order for the injunction to make sense, one must assume that the IP rights were valid. Even if they are valid, it is questionable whether Equustek’s rights are worldwide in nature since there was no evidence of any worldwide patent rights or international trademark portfolio. We can only hope that the trial decision, and Google’s decision to appeal the latest BC court decision, will clarify these issues.
Last month we asked: The Google vs. Equustek Decision: What comes next?
Part of the answer was handed down recently by a B.C. court in Equustek Solutions Inc. v Jack, 2018 BCSC 329 (CanLII), after Google applied to vacate or vary the original order of Madam Justice Fenlon, which was granted way back in 2014. That was the order that set off a furious international debate about the reach of Canadian courts, since it required Google to de-index certain sites from Google’s worldwide search results, based on an underlying lawsuit that the plaintiff Equustek brought against the defendants (which is finally set for trial in April, 2018).
Google of course was always invited to seek a variation of that original court order. As noted by the latest judgment, that right to apply to vary has been recognized by the B.C. Court of Appeal and the Supreme Court of Canada. After Google received a favourable decision last year from a US court, the way was paved to vary the original order that has caused Google so much heartburn. The next step is that Google will seek a cancellation or limitation of the scope of that original order, so that the order applies only to search results in Canada through google.ca.
The last step, with luck, will be a hearing of the merits of the underlying IP claims; some commentators have questioned why Google was used to obtain a practical worldwide remedy when the IP rights asserted by Equustek do not appear to be global in scope. As I mentioned in my earlier article, there has been very little analysis of Equustek’s IP rights by any of the different levels of court. Since this entire case involved pre-trial remedies, the merits of the underlying allegations and the strength of Equustek’s IP rights have never been tested at trial. In order for the injunction to make sense, one must assume that the IP rights were valid. Even if they are valid, Equustek’s rights couldn’t possibly be worldwide in nature. There was no evidence of any worldwide patent rights or international trademark portfolio. So, the court somehow skipped from “the internet is borderless” to “the infringed rights are borderless” and are deserving of a worldwide remedy.
This fascinating Ontario case deals with an Alberta-based individual who complained of certain material that was re-published on the website Globe24h.com based in Romania. The server that hosted the website was located in Romania. The material in question was essentially a re-publication of certain publicly available Canadian court and tribunal decisions.
The Alberta individual complained that this conduct – the re-publication of a Canadian tribunal decision on a foreign server – was a breach of his privacy rights since he was named personally in this tribunal decision.
So, let’s get this straight, this is a privacy-based complaint relating to republication in public of a publicly available decision?
Yes, you heard that right. This Romanian site scraped decisions from Canadian court and tribunal websites (information that was already online) and made this content searchable on the internet (making it …available online).
The Romanian site made a business out of removing data from this content, but the court’s conclusion that “The evidence leads to the conclusion that the respondent was running a profit-making scheme to exploit the online publication of Canadian court and tribunal decisions containing personal information.” [Emphasis added] – in a general sense, that statement could just as easily apply to Google or any of the commercial legal databases which are marketed to lawyers.
The court concluded that it could take jurisdiction over the Romanian website, and ordered the foreign party to take-down the offending content.
This decision represent another reach by a Canadian court to takedown content that has implications outside the borders of Canada. From the context, it is likely that this decision is going to stand, since the respondent did not contest this lawsuit. The issue of extra-terrtorial reach of Canadian courts in the internet context is going to be overtaken by the pending Supreme Court decision in Equustek. Stay tuned.
Last week, hearings concluded in the important case of Google Inc. v. Equustek Solutions Inc., et al. The Supreme Court of Canada (SCC) will render its judgment in writing, and the current expectation is that it will clarify the limits of extraterritoriality, and the unique issues of protected expression in the context of IP rights and search engines.
In Part 1, I admonished Google, saying “you’re not a natural person and you don’t enjoy Charter rights.” Some commentators have pointed out that this is too broad, and that’s a fair comment. Indeed, it’s worth clarifying that corporate entities can benefit from certain Charter rights, and can challenge a law on the basis of unconstitutionality. The Court has also held that freedom of expression under s. 2(b) can include commercial expression, and that government action to unreasonably restrict that expression can properly be the subject of a Charter challenge.
The counter-argument about delimiting corporate enjoyment of Charter rights is grounded in a line of cases stretching back to the SCC’s 1989 decision in Irwin Toy where the court was clear that the term “everyone” in s. 7 of the Charter, read in light of the rest of that section, excludes “corporations and other artificial entities incapable of enjoying life, liberty or security of the person, and includes only human beings”.
Thus, in Irwin Toy and Dywidag Systems v. Zutphen Brothers (see also: Mancuso v. Canada (National Health and Welfare), 2015 FCA 227 (CanLII)), the SCC has consistently held that corporations do not have the capacity to enjoy certain Charter-protected interests – particularly life, liberty and security of the person – since these are attributes of human beings and not artificial persons such as corporate entities.
It is also worth noting that the Charter is understood to place restrictions on government, but does not provide a right of a corporation to enforce Charter rights as against another corporation. Put another way, one corporation cannot raise a claim that another corporation has violated its Charter rights. While there can be no doubt that a corporation cannot avail itself of the protection offered by section 7 of the Charter, a corporate entity can avail itself of Charter protections related to unreasonable limits on commercial expression, where such limits have been placed on the corporate entity by the government – for example, by a law or regulation enacted by provincial or federal governments.
There is a good argument that the limited Charter rights that are afforded to corporate entities should not extend to permit a corporation to complain of a Charter violation where its “commercial expression” is restricted at the behest of another corporation in the context of an intellectual property infringement dispute.
International Federation of Film Producers Associations.
The line-up at Starbucks must have been killer.
The case has generated a lot of interest, including this recent article (Should Canadian Courts Have the Power to Censor Search Results?) which speaks to the underlying unease that many have with the precedent that could be set and its wider implications for free speech.
You may recall that this case is originally about IP rights, not free speech rights. Equustek sued Datalink Technologies for infringement of the IP rights of Equustek. The original lawsuit was based on trademark infringement and misappropriation of trade secrets. Equustek successfully obtained injunctions prohibiting this infringement. It was Equustek’s efforts at stopping the ongoing online infringement, however, that first led to the injunction prohibiting Google from serving up search results which directed customers to the infringing websites.
It is common for an intellectual property infringer (as the defendant Datalink was in this case) to be ordered to remove offending material from a website. Even an intermediary such as YouTube or another social media platform, can be compelled to remove infringing material – infringing trademarks, counterfeit products, even defamatory materials. That is not unusual, nor should it automatically touch off a debate about free speech rights and government censorship.
This is because the Charter-protected rights of freedom of speech are much different from the enforcement of IP rights.
Although free speech will be hotly debated at the courthouse, the Google case is, perhaps, not the appropriate case to test the limits of free speech. This is a case about IP rights enforcement, not government censorship.
Xylem Water Solutions is the owner of the registered Canadian trademark AQUAVIEW in association with software for water treatment plants and pump stations. Xylem received a Section 45 notice from a trademark lawyer, probably on behalf of an anonymous competitor of Xylem, or an anonymous party who wanted to claim the mark AQUAVIEW for themselves. This is a common tactic to challenge, and perhaps knock-out, a competitor’s mark.
A Section 45 notice under the Trade-marks Act requires the owner of a registered trademark to prove that the mark has been used in Canada during the three-year period immediately before the notice date. As readers of ipblog.ca will know, the term “use” has a special meaning in trademark law. In this case, Xylem was put to the task of showing “use” of the mark AQUAVIEW in association with software.
How does a software vendor show “use” of a trademark on software in Canada?
The general rule is that a trademark should be displayed at the point of sale (See: our earlier post on Scott Paper v. Georgia Pacific). In that case, involving a toilet paper trademark, Georgia-Pacific’s mark had not developed any reputation since it was not visible until after the packaging was opened. As we noted in our earlier post, if a mark is not visible at the point of purchase, it can’t function as a trade-mark, regardless of how many times consumers saw the mark after they opened the packaging to use the product.
The decision in Ashenmil v Xylem Water Solutions AB, 2016 TMOB 155 (CanLII), tackles this problem as it relates to software sales. In some ways, Xylem faced a similar problem to the one which faced Georgia-Pacific. The evidence showed that the AQUAVIEW mark was displayed on website screenshots, technical specifications, and screenshots from the software.
The decision frames the problem this way: “…even if the Mark did appear onscreen during operation of the software, it would have been seen by the user only after the purchaser had acquired the software. … seeing a mark displayed, when the software is operating without proof of the mark having been used at the time of the transfer of possession of the ware, is not use of the mark” as required by the Act.
The display of a mark within the actual software would be viewed by customers only after transfer of the software. This kind of display might constitute use of the mark in cases where a customer renews its license, but is unlikely to suffice as evidence of use for new customers.
In this case, the software was “complicated” software for water treatment plants. The owner sold only four licenses in Canada within a three-year period. In light of this, it was reasonable to infer that purchasers would take their time in making a decision and would have reviewed the technical documentation prior to purchase. Thus, the display of the mark on technical documentation was accepted as “use” prior to the purchase. This would not be the case for, say, a 99¢ mobile app or off-the-shelf consumer software where technical documentation is unlikely to be reviewed prior to purchase.
Website screenshots and digital marketing brochures which clearly display the mark can bolster the evidence of use. Again, depending on the software, purchasers can be expected to review such materials prior to purchase.
Software companies are well advised to ensure that their marks are clearly displayed on materials that the purchaser sees prior to purchase, which will differ depending on the type of software. The display of a mark on software screenshots is not discouraged; but it should not be the only evidence of use. If software is downloadable, then the mark should be clearly displayed to the purchaser at the point of checkout.
The cases have shown some flexibility to determine each case on its facts, but don’t rely on the mercy of the court: software vendors should ensure that they have strong evidence of actual use of the mark prior to purchase. Clear evidence may even prevent a section 45 challenge in the first place.
To discuss protection for your software and trademarks, contact us.
In a sprawling, billion-dollar lawsuit that started in 2010, a jury yesterday returned a verdict in favour of Google, delivering a blow to Oracle. (For those who have lost the thread of this story, see : API Copyright Update: Oracle wins this round).
The essence of Oracle America Inc. v. Google Inc. is a claim by Oracle that Google’s Android operating system copied a number of APIs from Oracle’s Java code, and this copying constituted copyright infringement. Infringement, Oracle argued, that should give rise to damages based on Google’s use of Android. Now think for a minute of the profits that Google might attribute to its use of Android, which has dominated mobile operating system since its introduction in 2007. Oracle claimed damages of almost $10 billion.
In prior decisions, the US Federal Court decided that Google’s copying did infringe Oracle’s copyright. The central issue in this phase was whether Google could sustain a ‘fair use’ defense to that infringement. Yesterday, the jury sided with Google, deciding that Google’s use of the copied code constituted ‘fair use’, effectively quashing Oracle’s damages claim.
Oracle reportedly vowed to appeal.
Silverpop Systems provides digital marketing services through a cloud-based tool called ‘Engage’. Leading Market Technologies, Inc. (“LMT”) engaged Silverpop through a service agreement and during the course of that agreement LMT uploaded digital advertising content and recipient e-mail addresses to the Engage system. A trove of nearly half a million e-mail addresses, provided by LMT, was stored on the Engage online system. In November 2010, Silverpop’s system was hacked, putting LMT’s email list at risk. Silverpop notified LMT of the data breach. After LMT refused to pay for further service, Silverpop suspended the agreement.
Litigation commenced in 2012, with LMT claiming damages for breach of contract and negligence based on Silverpop’s failure to keep the email list secure. Should the service provider be liable? Silverpop argued that it was engaged to provide access to its online system, not specifically to keep data secure. Thus there was no breach of its obligations under the agreement. And anyway, if LMT suffered any damages, they were indirect or consequential and consequential such damages were excluded under the terms of the agreement. LMT countered that, in fact, the agreement quite clearly contained a confidentiality clause, and that the damages suffered by LMT were direct damages, not indirect consequential damages.
The court was careful to review both the limit of liability clause (which provided an overall cap on liability to 12 months fees), and the exclusion clause (which barred recovery for indirect or consequential damages). The overall limit of liability had an exception: the cap did not apply to a breach of the confidentiality obligation. However, this exception did not impact the scope of the limit on indirect or consequential damages. Since the court decided that the claimed breach did not result from a failure of performance, and the consequential damages clause applied to LMT’s alleged loss. As a result, LMT’s claims were dismissed.
Those limitation of liability and exclusion clauses are often considered “boilerplate”. But they really do make a difference in the event of a claim. Ensure you have experienced counsel providing advice when negotiating these clauses, from either the customer or service provider perspective.
Clickwrap Agreement From a Paper Contract?
The answer is clearly… it depends. Consider the American case of Holdbrook Pediatric Dental, LLC, v. Pro Computer Service, LLC (PCS), a New Jersey decision which considered the enforceability of a set of terms which were linked from a paper hard-copy version of the contract. In this case, PCS sent a contract to its customer electronically. The customer printed out the paper version and signed it in hard copy. A hyperlink appeared near the signature line, pointing to a separate set of Terms and Conditions in HTML code. Of course on the paper copy these terms cannot be hyperlinked.
PCS asserted that these separate terms were incorporated into the signed paper contract, since they function as a clickable hyperlink in the electronic version. The court disagreed: “In order for there to be a proper and enforceable incorporation by reference of a separate document . . . the party to be bound by the terms must have had ‘knowledge of and assented to the incorporated terms.’” Here, there was no independent assent to the additional Terms and Conditions, and the mixed media nature of the contracting process worked against PCS. In addition to the fact that the separate terms were not easily accessible by the customer, the text was not clear. It merely said “Download Terms and Conditions”, without providing reasonable notice to the customer that assent to the main contract included assent to these additional terms. The additional terms were not binding on the customer.
Lessons for business? Get legal advice!
Limitations of Liability: Do they work in the Alberta Oilpatch?
Let’s consider that contract you’re about to sign. Does it contain a limitation of liability? And if so, are those even enforceable? It’s been several years since we last wrote about limitations of liability and exclusion clauses (See: Limitations of Liability: Do they work?) and it’s time for another look.
A limitation of liability seeks to reduce or cap one party’s liability to a certain dollar amount – usually a nominal amount. An exclusion clause is a bit different – the exclusion clause seeks to preclude any contractual claim whatsoever.
(c) if the clause is held to be valid under (b), whether the Court should nevertheless refuse to enforce the exclusion clause, because of an “overriding public policy, proof of which lies on the other party seeking to avoid enforcement of the clause, that outweighs the very strong public interest in the enforcement of contracts”.
We can illustrate this if we apply these concepts to a recent Alberta case. In this case, the court considered a limitation of liability in the context of a standard form industry contract, the terms of which were negotiated between the Canadian Association of Oilwell Drilling Contractors and the Canadian Association of Petroleum Producers. Anyone doing business in the Alberta oilpatch will have seen one of these agreements, or something similar.
The court describes this agreement as a bilateral no-fault contract, where one party takes responsibility for damage or loss of its own equipment, regardless of how that damage or loss was caused. Precision Drilling Canada Limited Partnership v Yangarra Resources Ltd., 2015 ABQB 433 (CanLII) dealt with a situation where one of Precision’s employees caused damage to Yangarra’s well. In the end Yangarra lost $300,000 worth of equipment down the well, which was abandoned. Add the cost of fishing operations to retrieve the lost equipment (about $720,000), and add the cost of drilling a relief well (about $2.5 million). All of this could be traced to the conduct of one of Precision’s employees – ouch.
Despite all of this, the court decided that the bilateral risk allocation (exclusion of liability) clauses in the contract between Yangarra and Precision applied to allocate these costs to Yangarra, regardless of who caused the losses. The court decided that enforcing this limitation of liability clause was neither unconscionable nor contrary to public policy. The clause was upheld, and Precision escaped liability.
I don’t think I’m going out on a limb by speculating that someone, somewhere is preparing a class-action suit based on the recently disclosed hack of Apple’s app ecosystem.
How did it happen? In a nutshell, hackers were able to infect a version of Apple’s Xcode software package for iOS app developers. A number of iOS developers – primarily in China, according to recent reports – downloaded this corrupted version of Xcode, then used it to compile their apps. This corrupted version was not the “official” Apple version; it was accessed from a third-party file-sharing site. Apps compiled with this version of Xcode were infected with malware known as XcodeGhost. These corrupted apps were uploaded and distributed through Apple’s Chinese App Store. In this way the XcodeGhost malware snuck past Apple’s own code review protocols and, through the wonder of app store downloads, it infected millions of iOS devices around the world.
The malware does a number of nasty things – including fishing for a user’s iCloud password.
Apple could be expected to argue that this clause deflects liability. And if Apple is found liable, then it would seek the cover of its limitation of liability clause. In the current version of the terms, Apple claims an overall limit of liability of $50. Let’s not forget that “hundreds of millions of users” are potentially affected.
As a preliminary step however, Apple would be expected to argue that the law of the State of California governs the contract, and Apple would be arguing that any remedy must be sought in a California court (see our post the other day: Forum Selection in Online Terms).
Will this limit of liability and forum-selection clause hold up to the scrutiny of Canadian courts if there is a claim against Apple?
Apparently Google does not appreciate being ordered by a Canadian court to remove worldwide search results. In Update on Injunction Against Google (Equustek Solutions Inc. v. Google Inc.) we reviewed a 2014 decision in which Google was ordered to de-index certain offending websites which were selling goods that were the subject of an intellectual property (IP) infringement claim (that decision was Equustek Solutions Inc. v. Jack, 2014 BCSC 1063 (CanLII)). Google appealed that decision to the B.C. Court of Appeal.
Last week, in Equustek Solutions Inc. v. Google Inc., 2015 BCCA 265, the B.C. Court of Appeal upheld the original order.
In the underlying action, Equustek alleged that Mr. Jack and Datalink Technologies designed and sold product which infringed the IP rights of Equustek. The original lawsuit was based on trademark infringement and misappropriation of trade secrets. Equustek successfully obtained injunctions prohibiting this original infringement. The infringement, however, continued through a variety of websites, and relying on search engines (such as Google) to attract customers. Equustek obtained another injunction prohibiting Google (“the world’s most popular search engine” – those are the court’s words) from delivering search results which directed customers to the offending websites.
The court drew a parallel with a recent English case, Cartier International AG v. British Sky Broadcasting Limited,  EWHC 3354 (Ch.), where Cartier sought an injunction against a number of ISPs in the UK in order to block access to the offending websites which sold counterfeit Cartier products. The court granted the order in that case.
If Google successfully appeals this decision, it will undoubtedly attract even more intervenors and will provide an opportunity for Canada’s top court to clarify the law in this area.
Need assistance with intellectual property disputes and internet law? Get advice from experienced counsel.
Wondering about outsourcing your data to the U.S.? What follows is an update to one of our most popular posts: Outsourcing by Canadian Companies: Another Look at the USA PATRIOT Act, originally written in January 2013.
In that post, we discussed the concern that U.S. government authorities may use the provisions of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (“PATRIOT Act”) to access the personal information of Canadians where that information is stored in the United States in the context of outsourcing or cloud-computing.
We also noted that for private sector businesses there are no specific legal prohibitions on outsourcing to the United States in light of the PATRIOT Act, provided (1) reasonable safeguards are built into the outsource contract (including confidentiality, use-restrictions, security, and provisions to meet monitoring and audit requirements), and (2) customers are notified in a clear way when their personal information will be stored or handled outside Canada. The only exceptions to this are within the public sector, as reviewed in our earlier post.
This is a complicated area of law. Starting in June 2013, Edward Snowden’s revelations about N.S.A.’s pervasive warrantless surveillance programs triggered a broader debate about privacy, as well as the specific risks of outsourcing to U.S. companies.
Certain provisions of the PATRIOT Act expired under a sunset clause on June 1, 2015. The U.S. Congress passed the USA FREEDOM Act on June 2, 2015 (in keeping with the American penchant for legislative acronyms, the full name is “Uniting and Strengthening America by Fulfilling Rights and Ending Eavesdropping, Dragnet-collection and Online Monitoring Act“).
The USA FREEDOM Act restores many of the expired provisions of the PATRIOT Act through 2019. Some provisions of the Foreign Intelligence Surveillance Amendments Act will expire in 2017 (including Section 702, a provision which underpins some of the N.S.A.’s bulk surveillance of online communications). Under the FREEDOM Act, certain sections of the Foreign Intelligence Surveillance Act of 1978 were amended in an effort to delimit the NSA’s mass data collection programs. However, the restrictions on bulk data collection don’t take effect for 6 months after the USA FREEDOM Act is enacted. There is also a carve-out to permit the government to obtain FISA orders during this 180-day period. The effect of this is unclear, but commentators have speculated that during this 6-month grace period the N.S.A. can continue bulk collection, and obtain FISA orders which are not constrained by the requirement for a “selection term”.
The new law does introduce reforms for oversight of government surveillance. In a nod to transparency, some FISA Court opinions may become available, and technology companies will have the ability to publicly report the number of government surveillance requests or investigation inquiries they receive. Previously, companies were prohibited from reporting that such requests had been received.
Generally, under the FREEDOM Act, indiscriminate bulk data collection is to be reformed by requiring the use of “specific selection terms”. In other words, government agencies such as the NSA must use a search term – the name of a specific person, account, address, or personal device, or any other specific identifier – to limit the scope of data collection “to the greatest extent reasonably practicable”.
In light of the 2013 Snowden revelations (and the 2007 Mark Klein disclosures), we now know that, in fact, the bulk collection of phone and internet data by the N.S.A. would have resulted in a lot of personal information about Canadians being collected by the N.S.A. in the United States through the N.S.A.’s PRISM, ECHELON and related surveillance programs.
Data access by Canadian or American government authorities in the course of investigations is not new. Don’t forget that the PATRIOT Act itself was merely an amendment and expansion to a series of existing government investigation tools which were already part of U.S. law, such as the Electronic Communications Privacy Act, Computer Fraud and Abuse Act, Foreign Intelligence Surveillance Act, Money Laundering Control Act and the Bank Secrecy Act. Going back even further, NSA’s cooperation and information-sharing with Canadian security agencies actually dates to the 1940s (see: the UK-USA Agreement). However, the sheer scope, breadth and depth of surveillance was new.
The Americans are not the only ones who carry on surveillance. There are a number of Canadian laws that enable police, security agencies and government investigators to obtain access to information held in Canada in the course of an investigation. And as in the U.S., Canadian security agencies have also been caught exceeding the legal limits on their online surveillance (see X (Re), 2013 FC 1275; aff’d 2014 FCA 249, where the Federal Court and Federal Court of Appeal decided that CSIS breached the duty of candour owing to the Court in seeking and obtaining search warrants fro surveillance on Canadians outside Canada).
Canadian police and security agencies can also obtain information held in the U.S., just as American security agencies can obtain records held in Canada through information-sharing agreements, protocols and a bilateral treaty between the United States and Canada known as the Mutual Legal Assistance Treaty (the “MLAT”). Other countries have similar investigative powers.
While the Americans are making some modest reforms to their surveillance laws, Canadian authorities are actually expanding their reach; the Anti-terrorism Act, 2015 (Bill C-51) was passed on June 9, 2015, and is awaiting royal assent. This new law expands the information-gathering powers between CSIS, police investigators and other Canadian government agencies.
Further, the effect of so-called “boomerang routing” means that online information flowing between a Canadian sender and Canadian recipient is still often routed through the US. (See: IXMaps.ca) Thus, even where data is not physically stored in the US, it may be caught by ongoing N.S.A. surveillance at the point the data traverses through an internet exchange point located within the United States.
As a matter of risk-assessment for Canadian companies outsourcing data to cloud-computing service providers, should you be concerned that your (or your customers’) Canadian online data will be subject to access by the U.S. government?
2. Best practices still dictate that (a) reasonable safeguards should be built into the outsource contract (including confidentiality, use-restrictions, security, and provisions to meet monitoring and audit requirements), and (b) customers should notified in a clear way when their personal information will be stored or handled outside Canada.
3. There can be no doubt that surveillance practices under the (old) PATRIOT Act resulted in the mass indiscriminate collection of internet and phone data for many years (and very likely continues within the 6-month period after enactment of the FREEDOM Act). It appears very likely that Canadian data outsourced to the U.S. was subject to bulk collection by the N.S.A. Due to “boomerang routing”, it appears likely that even data stored on servers located within Canada often flows through internet exchange locations within the U.S., and therefore would be susceptible to bulk collection by the N.S.A. The USA FREEDOM Act (which is really the PATRIOT Act 2.0) does impose some mild but important reforms on the scope of N.S.A. surveillance. If bulk data and phone-record collection is actually curtailed, the ongoing risk is associated with “targeted” or “selection term” access, in situations where government security and law enforcement agencies exercise rights of accessing and monitoring online data in the course of investigations of a “specific person, account, address, or personal device” in the U.S. It is worth noting that this ongoing risk of access is similar on both sides of the Canada/U.S. border, since Canadian security and law enforcement agencies have similar powers of investigation, and the two governments can rely on MLAT requests and other information sharing protocols to share data.
When you weigh the issues and risks associated with outsourcing Canadian data to the U.S., consider these points and seek advice from experienced IT and privacy counsel.
Further reading: Law, Privacy and Surveillance in Canada in the Post-Snowden Era.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.