ARCHIVED - Compliance and Enforcement Commission Letter addressed to Royal Bank of Canada

Ottawa, 4 April 2016

File number: 9102-2015-00417-004

Re: Decision pursuant to Canada’s Anti-Spam Legislation – Application for review of a notice to produce

Application

1. On 27 August 2015, pursuant to An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act (the Act), a designated person, for the purpose of section 17 of the Act, served a notice to produce (NTP) on the Royal Bank of Canada (RBC).
2. Pursuant to subsection 18(1) of the Act, RBC filed an application, received on 18 September 2015, in which the company requested that the Commission review the NTP and not require the production of any of the requested documents at that time.
3. Part 1 of the NTP required RBC to produce copies of documents or data relating to a specific account number associated with an Ontario numbered corporation (the numbered company) from 1 May 2015 to the date of the NTP, including customer information and monthly account statements. Part 1 of the NTP also required RBC to produce a list of all other products or services held by the account holders associated with the numbered company, and a list of any other entities for which those account holders were authorized to act as signing officers. Part 4 of the NTP imposed conditions of non-disclosure, pursuant to section 17(4) of the Act, requiring that RBC keep confidential the existence and content of the NTP.
4. RBC argued that its application should be approved because
   • the NTP was not issued for a purpose permitted by section 17(2) of the Act;
   • the NTP is inconsistent with the Privacy Act, which restricts what information the Commission can collect, and with the Personal Information Protection and Electronic Documents Act (PIPEDA), which restricts what information RBC can disclose without consent;
   • RBC has both common law and contractual duties of confidentiality with its clients;
   • the NTP is overbroad and places a disproportionate burden on RBC, since information could be more appropriately obtained directly from the numbered company; and
   • the conditions of non-disclosure would prevent RBC from obtaining the consent necessary from the numbered company and its account holders to produce the requested documents in light of the above arguments.
5. The designated person filed representations in response to the application, pursuant to section 18(3) of the Act. In these representations, the designated person argued that
   • the NTP was issued for, and each of its requirements relates to, a permitted purpose;
   • there is no conflict with (i) the privacy laws applicable to either the Commission or RBC, or (ii) RBC’s duties of confidentiality;
   • the burden the NTP places on RBC is not overbroad or disproportionate; and
   • the conditions of non-disclosure are reasonable in the circumstances.

Commission’s analysis and determinations

Purpose of the NTP

6. Many of the arguments made by RBC are premised on its underlying position that the NTP was issued for an improper purpose. Specifically, RBC argued that personal and financial information about the numbered company and its account holders is irrelevant to determining whether the numbered company has complied with the Act or contravened any of sections 6 through 9 of the Act.
7. As clarified by the designated person, a determination on whether there has been a contravention of sections 6 through 9 of the Act includes a determination on which person(s) may be responsible for that contravention. The investigation in question, conducted pursuant to sections 7 and 8 of the Act, relates to a program identified by the designated person as malware redirecting Internet traffic to addresses registered by the numbered company and associated with the account number specified in the NTP.
8. The NTP seeks information about the account number linked to the numbered company and to the malware and associated redirection of Internet traffic under investigation. Information about this account and any transactions made during the period under investigation may demonstrate the numbered company’s involvement. In particular, whether or not money associated with the activity remains with the numbered company or flows through it to other entities may establish whether and to what degree the numbered company or other persons benefit from – and by association, may be involved with or responsible for – that activity.
9. The NTP also seeks information about the account holders associated with the numbered company, and other entities on behalf of whom the numbered company may be authorized to act with RBC. This information may identify any additional persons who may be involved with or responsible for the activity. In this regard, section 31 of the Act provides for the potential liability of officers, directors, agents, or mandatories of a corporation. The information requested could also establish links between the numbered company and other entities associated with the activity, and clarify the nature of any such links.
10. Accordingly, the Commission finds that the NTP was issued for a permitted purpose – to aid in the investigation of whether contraventions of the Act have occurred and, if so, who is responsible for them

Application of privacy legislation

11. Section 4 of the Privacy Act prohibits a government institution from collecting personal information unless it relates directly to an operating program or an activity of the institution. RBC argued, based on its position that the NTP was not issued for a permitted purpose, that the information sought does not meet this standard, and that its collection was therefore prohibited.
12. PIPEDA restricts the circumstances in which an organization such as RBC may disclose personal information without consent, subject to certain exceptions set out in subsection 7(3), including in cases where disclosure is required by law or is made to a government institution which has made a request pursuant to an identified lawful authority. RBC argued, based on its position that the NTP was not issued for a permitted purpose, that these exceptions did not apply.
13. The Commission has found that the NTP was issued for a permitted purpose under subsection 17(2) of the Act. Since the personal information sought relates directly to a Commission activity, i.e. the investigation of contraventions of the Act, the seeking of this information is not prohibited by the Privacy Act. As well, since the NTP constitutes a request from a government institution under lawful authority, the production of the requested information is not prohibited by PIPEDA.

Duties of confidentiality

14. RBC argued that it has a common law duty of confidentiality to its clients. However, this duty can exceptionally be breached in certain circumstances, including if required by law. Based on its submissions with respect to the purpose of the NTP, RBC argued that the exception was not applicable in the present circumstances.
15. The Commission has found that the NTP was issued for a permitted purpose under subsection 17(2) of the Act. Accordingly, the exception applies in the present circumstances, and disclosure of the required information would not breach RBC’s common law duty of confidentiality.
16. Regarding RBC’s contractual duty of confidentiality with its clients, persons engaged in commercial activities regulated by the Act often engage other organizations for financial or other related services. The relationships between persons and these other organizations may be relevant to the investigation of compliance with or the enforcement of the Act, and it is therefore appropriate for the Commission to inquire about these relationships through an NTP. If the Commission were to permit entities under private contractual agreements not to be investigated due to terms of confidentiality, the overall efficacy of the NTP as an investigative tool would be significantly diminished.

Disproportionate burden

17. RBC argued that the NTP was unreasonable and placed a disproportionate burden on it. In support of its position, RBC referred to procedural restrictions on compelling the production of documents from third parties in civil proceedings. RBC also argued that the requested documents were not relevant to ascertaining compliance with the Act, and that the documents would be more appropriately sought from the numbered company itself.
18. The Commission’s assessment of whether a request for production is reasonable is conducted in consideration of both the provision of the Act under which the request was made (in this case, section 17), and the overall purpose of the Act, which is set out in section 3.
19. Section 17 of the Act provides to designated persons investigative powers for the purpose of verifying compliance with or determining contraventions of the Act. These powers are broad and are therefore not limited to inquiring after only the subject(s) of an investigation. Section 3 of the Act makes clear that the Act aims to regulate commercial activities through electronic means with a view to ensuring the maintenance of the conditions considered necessary for the proper functioning and development of the country’s market economy.
20. Accordingly, ascertaining whether a contravention has been committed and, if so, who is responsible for that contravention, requires an evaluation of information, whether financial or of a different nature, the possession of which resides in the control of specific persons. This information will not be known to the designated person unless obtained by way of investigatory mechanisms, such as that set out in section 17 of the Act.
21. As well, the exercise of the authority provided to the designated person for the purpose of section 17 of the Act is not subject to a requirement that he or she has reasonable grounds to believe that the requested documents will provide evidence (i) that a contravention has occurred, or (ii) of those who have committed the contravention.
22. In light of the above, the fact that the NTP requires RBC to produce numerous documents and that some or all of the requested documents could be obtained from a different source does not render the request unreasonable. What makes a request reasonable is informed by a variety of factors, including the breadth of the request, the size of the party, and the extent of the financial impact of the request. In cases where a party is a repeated target of production requests, this cumulative impact may also be relevant
23. In the present case, RBC did not submit evidence of the above-noted factors. The information sought with respect to the identified account number, which has been linked to the activity under investigation, is limited to the time frame of the activity – a period of approximately four months. The information sought with respect to the account holders associated with the identified account number is limited to a list of other products or services, or of other entities for which the account holders are authorized to act. These requirements are therefore not overly broad or unreasonably burdensome.

Conditions to prevent disclosure

24. RBC argued that the conditions of non-disclosure imposed under subsection 17(4) of the Act are unreasonable, because they prevent RBC from obtaining the consent necessary for the disclosure of the requested information.
25. The designated person submitted in reply that in addition to the numbered company, other persons may be implicated in the investigation, and that if the numbered company or other persons were alerted to the existence of the investigation, there would be a risk of evidence becoming lost, damaged, altered, or destroyed before being collected, which would jeopardize the conduct of the investigation.
26. The Commission has found that the NTP was issued for a permitted purpose under subsection 17(2) of the Act. RBC’s arguments with respect to seeking consent before producing the required documents are therefore not applicable. Moreover, alerting subjects of an investigation to its existence by seeking such consent is one of the outcomes that conditions of non-disclosure are intended to prevent, and the designated person’s apprehension of the risk associated with such disclosure and imposition of such conditions are not unreasonable in the circumstances.

Conclusions

27. In light of the above, the Commission denies RBC’s application, and confirms the production requirements set out in the NTP that was served on RBC on 27 August 2015.
28. The required documents must be produced under the following conditions, which replace those described in Part 3 of the NTP:
    • The documents must be produced in writing and include the file number mentioned above. The documents, marked as “Confidential,” are to be sent to the attention of Maxime Brassard, by any of the means authorized by the Commission below:
      1. By mail to the following address:

         Canadian Radio-television and Telecommunications Commission (CRTC)
         Compliance & Enforcement Sector Electronic Commerce Enforcement Division Les Terrasses de la Chaudière
         1 Promenade du Portage Gatineau, Quebec J8X 4B1

      2. By email to the following address:  lcap-casl-inv@crtc.gc.ca
29. The recipient has to receive the documents no later than 25 April 2016 at 16:00 Eastern time.^Footnote1
30. This decision is served on RBC by the receipt of a copy of this decision, in accordance with subsection 18(5) of the Act.
31. The Commission authorizes the following method to serve this decision on RBC:
    • courier with signed postal acknowledgement of receipt
32. Pursuant to subsection 18(5) and section 27 of the Act, RBC has the right to appeal this decision by bringing an appeal in the Federal Court of Appeal within 30 days after having been served with a copy of this decision. An appeal on a question of fact may be brought only with the leave of the Federal Court of Appeal, an application for which must be made within 30 days after having been served this decision.

Secretary General

Date modified:

2016-04-04