inside the man

Friday, June 24, 2005

ALA (foolishly?) hiding data in Canada?

Mr. Good provides us with a quote from Eric Alterman's recent article on the Patriot Act and libraries:

"While this should be a cause for concern for any citizen, it comes with a sad addendum: It would appear that the ALA [American Library Association] doesn't trust the government enough to house its findings on a computer server anywhere in the United States. The ALA, in surveying U.S. libraries for a report on the impact of the USA Patriot Act, housed its data on a computer server in Canada, beyond the reach of U.S. authorities."

This raises an interesting legal question, does housing data in Canada allow American organizations to protect their records from disclosure to American federal authorities using the powers of the Patriot Act?

At first consideration, housing data in Canada sounds like a great way to avoid having to turn over records under an order from the foreign Intelligence Surveillance (FIS) Court - the body with the power, under the Patriot Act, to issue secret orders for library records. However, based on the results of an unrelated public consultation in British Columbia, ALA may have acted on bad legal advice.

In 2004, The Information and Privacy Commissioner for British Columbia initiated a 10 week long public review of the US Patriot Act, prompted by a legal challenge to a government outsourcing contract to an American health services firm. This review received and analyzed over 500 submissions from individuals and organizations. I quote from page 18 of summary of the commissioner's report (pdf - 151 pages) at length below, but the main conclusion is in bold.

"There is general consensus in the submissions to us that the FIS Court could, under FISA, order a US-located corporation to produce records held in Canada that are under the US corporation's control. US courts have, in fact, been willing over the years to order disclosure, for the purpose of US proceedings, of records held outside the US, as long as a person or corporation subject to the US court' jurisdiction has legal or practical ability to access those records.

This requires us to consider whether control over records can be avoided through practical or contractual arrangements between public bodies and service providers. Some US courts have found that, under US law, control of records exists whenever there is a US parent-Canadian subsidiary corporate relationship, regardless of the contractual or practical arrangements between a British Columbia public body and the service provider or its US parent. Other US cases suggest, however, that contractual or practical arrangements may influence a US court's findings regarding control.

Even if control over Canadian records is found, it is not known whether the FIS Court would order disclosure if our law prohibited it. Submissions to us discussed whether a statutory provision in British Columbia that prohibits compliance with such an order would be eff ective. We cannot ignore the fact that US courts have upheld subpoenas ordering corporations to disclose records located outside the US, even where a foreign law prohibits the disclosure. We nonetheless conclude, however, that the FIS Court might decline to order disclosure in the face of a clear and strong British Columbia law prohibiting disclosure. The benefit of such statutory provision is not limited to its persuasive value to a US court; its compliance and deterrence eff ect within British Columbia is of even greater significance.

We do not exclude the possibility that policy or procedural safeguards exist in respect of FISA applications for disclosure of records located outside the US. In the absence of evidence of such safeguards, however, it is prudent to assume that US authorities are unfettered in their ability to seek such an order, that they may do so in circumstances that are not consistent with Canadian law and policy, and that the FIS Court might issue a FISA order for records located in Canada.

A final thought: We will likely never know if the FIS Court has already ordered ALA to turn over the survey data housed on a Canadian computer to the FBI, as ALA would be legal bound not to tell.

No comments:

Blog Archive

About Me

My photo
Edmonton, Alberta, Canada
Returned to working as a Management Consultant, specializing in risk, security, and regulatory compliance, with Fujitsu Canada after running the IT shop in the largest library in the South Pacific.

CC Developing Nations
This work is licensed under a Creative Commons Developing Nations license.

Site Meter