U.K.-U.S. Data Sharing Agreement – Implications for Canada
On 3 October 2019, the governments of the United States and United Kingdom signed the U.S.-U.K. Bilateral Data Access Agreement (the “Agreement”). The purpose of the Agreement is to enable more efficient and effective access to electronic data for use in criminal investigations between their respective criminal law enforcement agencies.
While the Agreement is between the U.S. and U.K., it is nonetheless important for other countries, including Canada, because it is the first agreement reached under the United States Clarifying Lawful Overseas Use of Data Act (“CLOUD Act”) from 2018. The CLOUD Act allows American law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data is stored in the U.S. or on foreign soil, and attempts to resolve a long-running legal battle between ‘big tech’ and law enforcement. The U.S. is also in talks with the European Union, and Australia regarding signing a CLOUD Act agreement with those jurisdictions as well.
The CLOUD Act and the Agreement are aimed at speeding up the law enforcement investigations dependent on electronic data stored abroad. Previously, Mutual Legal Assistance Treaty requests (“MLATs”) had to be submitted by law enforcement agencies to another nation’s central government and then the central governments had to go to the private party hosting the data. The process could take months to years. Under the Agreement, law enforcement (after obtaining appropriate court authorization based in the other country) may go directly to tech companies or communication service providers (“CSPs”) to access electronic data, based on probable cause that the communications contain evidence of a crime, thus cutting out the middleman.
Potential Implications for Canada
The Agreement is based on reciprocity. The U.K. Crime (Overseas Production Orders) Act (“C(OPO) Act”) authorizes British law enforcement agencies to apply for a court order with extraterritorial effect to obtain data stored electronically directly from CSPs based outside the U.K. These provisions effectively mirror the CLOUD Act, meaning that under the Agreement, British law enforcement can obtain information from U.S.-based CSPs and American law enforcement can obtain information from U.K. based CSPs. A Canada-U.S. data sharing agreement would likely be based on similar reciprocity. The Agreement provides a roadmap for the kind of data sharing agreement that the U.S. may seek with Canada.
If a data sharing agreement between Canada and the U.S. is pursued, consideration would have to be given to amending Canadian privacy laws that may inhibit or prevent disclosure to foreign law enforcement under foreign orders. For requests with data outgoing from Canada, there would be a need for a new class of production orders with extraterritorial effect either under amendments to the Criminal Code or under new legislation similar to the C(OPO) Act in the U.K. Such developments related to the possible negotiation and implementation of a data sharing agreement between Canada and the U.S. remain speculative. For now, the Agreement is another indication that the world is ‘getting smaller’ in the sense that law enforcement is increasingly able to access data across borders.
Implications for White Collar Investigations
The stated purpose of the Agreement is to target terrorism and child abuse crimes. However, there is potentially a much broader scope of application. The Agreement may be used to investigate money laundering, fraud, corruption, cyberattacks and other serious offences, offering the potential to make investigations of those crimes more efficient than under the traditional MLAT process. This may make it easier for law enforcement to pursue those investigations on a more frequent basis and organizations should be aware of that.
Canadian organizations should monitor the Agreement, as well as negotiations for CLOUD Act arrangements between the U.S. and other jurisdictions. This means becoming familiar with how the new system is meant to work between the U.K. and U.S. and understanding the processes and procedures to respond to electronic data production orders from foreign agencies, within the relatively short timeframes anticipated.
With decades of experience, McCarthy Tétrault’s White Collar Defence and Investigations Group is uniquely positioned among Canadian law firms to represent individuals and companies in connection with serious investigations and proceedings.
 See Section 1 of the Crime (Overseas Production Orders) Act 2019 c. 5 and the Policy background Explanatory Notes available at: <www.legislation.gov.uk/ukpga/2019/5/notes/division/3/index.htm>.