The Microsoft case and a new era in access to extraterritorial evidence

A case involving Microsoft that is currently before the US courts has raised important issues between the respective legal regimes in the EU and the US, particularly in relation to the protection of personal data. The case in question has given rise to a degree of legal uncertainty and the outcome could have potentially serious implications for data protection in the EU. By seeking direct access to data held in the EU through the US judicial system, existing legal mechanisms for mutual assistance between jurisdictions may be being effectively bypassed. There are fundamental issues at stake here as regards the protection of personal data that is held within the EU. This is clearly an area where technological advances have taken place in a very rapid fashion. The right to privacy should be afforded maximum protection whilst ensuring that law enforcement agencies have the necessary mechanisms at their disposal to effectively fight serious crime.

I agree with her [the Privacy Commissioner of Canada] that PIPEDA [Personal Information Protection and Electronic Documents Act] gives no indication that Parliament intended to legislate extraterritorially. [...] [However, the] Commissioner does not lose her power to investigate because she can neither subpoena the organization nor enter its premises in Wyoming. ... It would be most regrettable indeed if Parliament gave the Commissioner jurisdiction to investigate foreigners who have Canadian sources of information only if those organizations voluntarily name names. Furthermore, even if an order against a non-resident might be ineffective, the Commissioner could target the Canadian sources of information.

I conclude as a matter of statutory interpretation that the Commissioner had jurisdiction to investigate, and that such an investigation was not contingent upon Parliament having legislated extraterritorially ...