T-1472-07
Toronto, Ontario, August 18, 2008
PRESENT: Kevin R. Aalto, Esquire, Prothonotary
BETWEEN:
Docket: T-1661-07
Plaintiff
and
ROYAL BANK OF CANADA; BANK OF NOVA SCOTIA; TORONTO-
DOMINION BANK; CANADIAN IMPERIAL BANK OF COMMERCE; BANK OF
MONTREAL; NATIONAL BANK OF CANADA; SYMCOR INC. and
INTRIA ITEMS INC.
Defendants
AND BETWEEN:
Docket: T-1472-07
TORONTO DOMINION BANK, BANK OF MONTREAL, and
ROYAL BANK OF CANADA
Plaintiffs
and
DATATREASURY CORPORATION
Defendant
[1] Essentially, this is a motion to settle the terms of a protective order. All parties agree that a protective order is required to maintain the confidential aspect of the patented technology in issue in this proceeding, the confidential pricing and cost information of the parties, and the confidential business practises of the parties including the terms and conditions of licensing and settlement agreements.
[2] The parties are in substantial agreement on the form of the protective order. However, there is one paragraph where there is strong disagreement. For simplicity’s sake, that paragraph is referred to as the “Canada Only Clause” and is found in the proposed protective order drafted by the Defendants in T-1661-07 and the Plaintiffs in T-1472-07 (collectively referred to for ease of convenience as the “Banking Group”). The clause reads as follows:
22) If any Party wishes to prevent Designated Confidential Information or Designated Counsels’ Eyes Only Confidential Information from being exported, forwarded or otherwise sent outside of Canada, then the Producing Party shall make a written request to the Receiving Party. The Receiving Party shall reply in writing to the Producing Party within seven (7) days of receiving the request. If the Receiving Party refuses the request then the Producing Party shall have fourteen (14) days after receiving the written reply to serve and file a notice of motion to request an order preventing disclosure of such information outside of Canada. If the Producing Party does not bring a motion within the stipulated timeframe then the Receiving Party shall be free to disclose such information outside of Canada subject to the terms of this Order and any other applicable restrictions. Otherwise, the Receiving Party shall not export, forward or otherwise send such information outside of Canada until after and subject to the final disposition of the motion, including any appeals;
[3] The Banking Group maintain that certain documents that may be produced in the within actions should be precluded from being sent to the United States. DataTreasury Corporation (“DataTreasury”) argues that such a restriction would be highly prejudicial to DataTreasury as its central document database, its document management consultants, United States counsel, witnesses and experts are all located in the United States. DataTreasury has apparently centralized these services in one place because it is also engaged in litigation in the United States with various banks and other corporations.
[4] In general terms, the Banking Group express concerns that if certain of the documents to be produced are sent to the United States the Banking Group may encounter problems involving the United States PATRIOT Act, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and the implied undertaking rule. In particular, the Banking Group expresses the following concerns about a protective order which does not include a Canada Only Clause:
a. Canadian banks have been the subject of highly publicized privacy complaints relating to counter-terrorism laws;
b. The potential that these proceedings could prompt similar complaints and cause serious harm to the goodwill of the Banking Group;
c. The absence of an implied undertaking rule in the United States; and,
d. That the security of the Canadian banking system could be needlessly compromised if detailed information relating to the networks used by the Banking Group for processing financial documents were permitted to leave the country.
[5] The parties have filed a substantial amount of paper in support of their respective positions. In response to the Motion Record of DataTreasury, the Banking Group, to their credit, have provided a single Responding Motion Record and a single set of Written Representations on behalf of all of the members of the Banking Group. DataTreasury then filed a Reply Motion Record to the Banking Group’s responding Motion Record including additional affidavit evidence. The Banking Group then filed a brief Sur-Reply to the Reply of DataTreasury, which not only objects to the Reply but also the supplementary affidavit of DataTreasury. The affidavit in question is that of Mr. Sheppard Lane, United States outside General Counsel to DataTreasury. While various of the parties complain of being ambushed by DataTreasury’s “purported” Reply (to use the words of the Banking Group), in the end result all of the materials filed have been carefully reviewed and were essential to reaching a decision on the proposed protective order.
[6] In support of their position that the Canada Only Clause form part of the protective order, the Banking Group have put forward the affidavit of Annie Thériault, a lawyer, a member of the Bar of the Province of Québec and the Manager of Personal Information Protection in the Operational and Reputational Risks Department of the National Bank of Canada (“National Bank”). Among her responsibilities is compliance by the National Bank Financial Group with the requirements of PIPEDA and other applicable privacy legislation.
[7] Among other things, Ms. Thériault deposes, based on information and belief from counsel for National Bank, that during the documentary and oral discovery process the Banking Group may be required to deliver to DataTreasury a number of documents including documents relating to electronically capturing, transmitting, processing and storing of financial instruments, including but not limited to cheques. As of the present, productions have not yet been delivered by the Banking Group to DataTreasury. Ms. Thériault further deposes that if the productions of the Banking Group are sent to the United States, the Banking Group would be obliged to go through costly procedures in obtaining consents from existing clients to the disclosure of personal information and that this would create a public perception that personal information might be shipped to the United States solely for the sake of DataTreasury’s convenience which may further prompt complaints to the Privacy Commissioner of Canada and cause serious harm to the Banking Group’s goodwill. Ms. Thériault further bolsters her argument by reference to PIPEDA case summaries and press clippings relating to DataTreasury and its activities gleaned from a Google search.
[8] Ms. Thériault also deposes that the Banking Group have a strict privacy policy regarding the collection, use and disclosure of the personal information of its clients. One example is provided by Ms. Thériault relating to the National Bank’s privacy policy. That policy provides that personal client information does not include voluntary communication or remittance of such information to an adverse party in the context of litigation. The National Bank policy does however provide that the disclosure and remittance of personal information may be made pursuant to a Court order.
[9] All of this, the Banking group allege, necessitates the inclusion of the Canada Only Clause set out above. It is to be noted that the Canada Only Clause creates a protocol for documents which may be sent outside of Canada. The onus is on a Producing Party to engage the protocol by requesting that the documents not be sent outside of Canada. If the recipient of the document refuses the request then the Producing Party has the obligation to serve and file a notice of motion with respect to such documentary disclosure. If no motion is brought then the recipient is free to forward the documentation outside of Canada.
[10] There is no doubt that the concern of the Banking Group is legitimate. Once documents are sent beyond the borders of Canada to the United States they may be subject to production in ways not anticipated and which may be beyond the control of DataTreasury. There is no suggestion in the materials that DataTreasury or its counsel or advisers would in any way voluntarily divulge the information to third parties or breach their obligation to ensure that the documents and information disclosed pursuant to discovery obligations in this proceeding are impressed with the implied undertaking that the documents and information would not be used for purposes other than those of these actions. While the Canada Only Clause is a laudable attempt at responding to these concerns, in the circumstances of this case and the vast volume of documents which the parties anticipate will be produced, such a protocol may very well result in endless motions and mire these proceedings in endless squabbling and interlocutory proceedings over which documents may be sent to the United States.
[11] In its reply, DataTreasury makes three points: first, they argue that the Banking Group have not established the legal or factual basis for a Canada Only Clause; second, they say that geographic restrictions and productions and/or mechanisms contemplating such restrictions would be highly prejudicial to DataTreasury; and, third, mechanisms contemplating geographic restrictions would be premature and, in any event, are redundant as mechanisms already exist to seek that remedy (i.e. the case-management process or by motion).
[12] With respect to the latter point, it is to be noted that these proceedings have been case managed virtually from the outset and that any issues arising can be brought to the Court through the convening of a case conference. Further, notwithstanding the provisions of any protective order this Court has the inherent power to control its own process. In a case management regime parties are free to come to Court via case conference to seek guidance on any issues that may arise in the course of the proceedings and to raise a specific documentary production issue relating to a specific document if such issue arises. In these circumstances, a specific “comeback” clause should be included in the protective order so that there can be no doubt of the parties’ rights to seek Court intervention if it is warranted.
[13] With respect to their first point, DataTreasury note the weaknesses in the affidavit evidence of Ms. Thériault. They point out that Ms. Thériault’s affidavit is to a large extent speculative and hypothesizes regarding the personal information that “might” or “could” be sent to the United States. They also attack the fact that only one of the Banking Group have filed affidavit evidence and that none of the other members of the Banking Group have done so. However, I do not accept that argument as the Banking Group as a whole worked together to put their position to the Court through one affiant. It is to be noted that Ms. Thériault speaks to the banking industry as a whole and her experience as outlined in her affidavit gives her the credibility to do so. I therefore read nothing into the fact that none of the other members of the Banking Group have put forward any evidence and accept Ms. Thériault’s evidence on behalf of all of the Banking Group.
[14] While there are other attacks on Ms. Thériault’s affidavit, one compelling point that is made by DataTreasury is with reference to PIPEDA’s Case Summary No. 313 attached as an exhibit to Ms. Thériault’s affidavit. This PIPEDA case summary deals with “Banks Notification to Customers Triggers PATRIOTS Act Concerns”. This PIPEDA case involved CIBC, a member of the Banking Group involved in theses proceedings. In this PIPEDA case, CIBC acknowledged sending personal customer information to the United States for outsourced processing and storage. The decision in that case held that Privacy Complaints arising from this outsourcing practice were not well founded.
[15] In addition to this PIPEDA case, DataTreasury filed Mr. Lane’s affidavit in reply which provided evidence that other members of the Banking Group also engage in outsourcing practices which includes the transfer of personal information to the United States. Indeed in their Sur-Reply, the Banking Group acknowledges that “they currently send customer-related information to service providers in the United States for processing”. They also note that the PIPEDA cases referred to in the materials referred to specific activities that were permissible in light of “commercial realities” and because the bank in question had already given notice to customers that this may happen. While commercial realities of their business may allow them to ship customer information to the United States, in these proceedings they are required “by law” to produce those documents which are relevant. The documents are to be listed in an affidavit of documents. A party may obtain from an opposing party a copy of any document referred to in the affidavit of documents. The party receiving the document is governed by the implied undertaking rule. There is nothing in the Federal Courts Rules which prevents the copy of the document from being sent outside Canada.
[16] The Banking Group also describes the receipt of the documents by DataTreasury at its central litigation office in Texas as being only a “convenience”. However, the evidence is that DataTreasury has a central site where it analyzes and reviews the documents. This is not merely a “convenience” when massive numbers of documents may be produced. Further, the Canada Only Clause to some extent is a limitation on the right of counsel located in Canada of showing relevant documentation to its client located in the United States and to receiving instructions (see, for example, Molson Breweries v. Labatt Brewing, 43 C.P.R. (3d) 61 (F.C.A.)).
[17] DataTreasury argues that there are no concrete examples of documents of concern that the Banking Group has identified other than the general spectre of personal information of customers being exported to the United States with the potential that such information may in some fashion be used outside the confines of these proceedings or compelled to be disclosed to United States authorities. On this point they are correct as Ms. Thériault’s affidavit surmises that the effect of sending documents to the United States may compromise the Canadian banking system. There is no concrete example. In any event, DataTreasury have acknowledged that they have no interest in the personal information of the Banking Group’s customers. These cases focus on the electronic processing of financial instruments not on the individual customers who use it.
[18] Further, DataTreasury points out that as an individual’s personal information is not relevant in this litigation and need not be produced it can be redacted. Therefore, there is no concern that personal information would somehow be made public or be used for some other purpose than these proceedings in the U. S. Thus, any concerns of the Banking Group that they will be off-side PIPEDA are significally undermined.
[19] With respect to the Banking Group’s position that they may be obliged to go through the costly process of obtaining consent to the disclosure of personal information from existing clients the simple answer is that because specific personal information is not relevant and need not be produced, there is no costly process which the Banking Group would incur save and except the redacting of documents.
[20] It is also to be noted that s. 7(3) of PIPEDA permits an organization to disclose personal information without the knowledge or consent of the individual if the disclosure is:
. . .required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel production of information, or to comply with rules of Court relating to the production of records;
…or (i) that it is required by a law.
[21] From the evidence, at least National Bank advises its customers of this provision and possibility. Here, the documents that are being produced are required to be produced “by law” and to comply with the Federal Courts Rules relating to production of documents.
[22] Quite apart from the Canada Only Clause, the Banking Group’s interests are protected by several other restrictions in the draft protective order regarding access to documents: there are rules limiting who may access the documents; there are levels of confidential designation created; and, there are requirements that signed undertakings be obtained from individuals having access to documents. The Banking Group does not point to any specific provision in the PATRIOT Act or otherwise which would permit the United States Government to seize documents from DataTreasury. It is raised, in reality, as a possibility not an absolute reality. As noted above, several members of the Banking Group already engage in outsourcing activities which permit personal information of customers to be sent to the United States.
[23] As DataTreasury is a party before this Court, this Court has sanctions available to it to ensure that DataTreasury, its counsel and advisory comply with the implied undertaking obligations and ensure that any documents received through the production process are not misused.
[24] Indeed, this is an appropriate case where the implied undertaking rule should be specifically set out in the protective order to bring home to any person unfamiliar with the rules of our Court the seriousness of the implied undertaking rule. This was a solution which Master Dash of the Ontario Superior Court of Justice imposed where there was concern that a party subject to the implied undertaking to control the use and access to discovery evidence might be compromised because information and documentary evidence would flow to the United States (see, Halstones Products Limited v. Canada (Customs and Revenue Agency), [2005] OJ 5296). Master Dash specifically noted that “an order of a Canadian Court may have more significance to a U.S. Court than an implied undertaking”.
[25] In the end result, although the Banking Group raise a legitimate concern that they wish to protect their position qua their customers and the security of their business, I am not persuaded that the Canada Only Clause should be included. In coming to this conclusion I have endeavoured to strike a balance between the rights of DataTreasury to have copies of the documents and review them at its litigation central office in Texas and the concerns of the Banking Group regarding the impact on its business and goodwill by having its documents sent to the United States In my view the Banking Group’s concerns will be allayed by:
(a) the fact that it is a requirement of the law that they produce relevant documents to DataTreasury;
(b) that any documents so produced are subject to the confidentiality of a protective order;
(c) that s. 7(3) of PIPEDA will be engaged because both the Federal Courts Rules and a Court order that requires that the documents produced be subject to the protective order and that such documents may be reviewed by DataTreasury without any geographical location limitation as to where they may be reviewed;
(d) that the parties, their counsel and advisers are all subject to the requirements of the implied undertaking rule which will be specifically set out in the protective order;
(e) that personal information of customers of the Banking Group need not be produced and may be redacted;
(f) that the protective order will contain a “comeback” clause allowing any party to bring before the Court any specific issue regarding the production of any specific document; and,
(g) that the protective order requires any individual with access to the opposite party’s documents to sign an undertaking acknowledging the confidentiality.
The parties are to provide to the Court a proposed protective order to the Court reflecting these reasons for decision.
ORDER
THIS COURT ORDERS that
1. That the draft protective order attached as Schedule “A” to DataTreasury’s Notice of Motion
shall be amended as follows:
a. to include a provision encompassing the implied undertaking rule applicable to the parties, their counsel and advisers;
b. to include a provision that gives any party a right to come back to Court regarding any specific issue concerning a specific document;
c. to include a provision that personal information of customers of the Banking Group need not be produced and may be redacted; and,
d. to include a provision that documents produced which may be sent to the United States for review is sanctioned by and subject to the protective order of this Court.
2. Costs of this motion in the cause.
"Kevin R. Aalto"
FEDERAL COURT
NAMES OF COUNSEL AND SOLICITORS OF RECORD
DOCKETS: T-1661-07
T-1472-07
STYLE OF CAUSE: DATATREASURY CORPORATION and
ROYAL BANK OF CANADA; BANK OF NOVA SCOTIA; TORONTO-DOMINION BANK; CANADIAN IMPERIAL BANK OF COMMERCE; BANK OF MONTREAL; NATIONAL BANK OF CANADA; SYMCOR INC. and INTRIA ITEMS INC.
and
TORONTO DOMINION BANK, BANK OF MONTREAL, and ROYAL BANK OF CANADA
and DATATREASURY CORPORATION
CONSIDERED AT TORONTO, ONTARIO PURSUANT TO RULE 369
REASONS FOR ORDER
Robert H. C. MacFarlane
Andrew I. McIntosh
John H. Simpson FOR THE DEFENDANTS
Canadian Imperial Bank of Commerce and Intria Items Inc.
John R. Morrissey
Alistair Simpson
Mark G. Biernacki FOR THE DEFENDANT
Symcor Inc.
Ronald E. Dimock FOR THE DEFENDANTS
Jenna L. Wilson Royal Bank of Canada, The Toronto-
Etienne P. deVilliers Dominion Bank and Bank of Montreal
Alan Macek
Francois Grenier
Alexandra Steele FOR THE DEFENDANT
National Bank of Canada
Brian W. Gray
Allyson Whyte Nowak
Christopher Hunter FOR THE DEFENDANT
The Bank of Nova Scotia
Francois Grenier FOR THE DEFENDANT
Alexandra Steele National Bank of Canada
Tim Glibert FOR THE PLAINTIFF
Shonagh McVean
Sara Chesworth
SOLICITORS OF RECORD
BERESKIN & PARRJACKMAN & ASSOCIATES
Toronto, Ontario FOR THE DEFENDANTS
Canadian Imperial Bank of Commerce and Intria Items Inc.
SMART & BIGGAR
Toronto, Ontario FOR THE DEFENDANT
Symcor Inc.
DIMOCK STRATTON LLP
Toronto, Ontario FOR THE DEFENDANTS
Royal Bank of Canada, The Toronto-
Dominion Bank and Bank of Montreal
OGILVY RENAULT LLP
Toronto, Ontario FOR THE DEFENDANT
The Bank of Nova Scotia
LEGER ROBIC RICHARD, LLP
Montreal, QC FOR THE DEFENDANT
National Bank of Canada
GILBERT’S LLP FOR THE PLAINTIFF
Toronto, Ontario
John H. Sims, Q.C.
Deputy Attorney General of Canada FOR THE PLAINTIFF