Dataguidance.com quotes Toronto lawyer, Alex Cameron, in an article about the importance of custody and control issues.
Alex Cameron, Partner at Fasken Martineau DuMoulin LLP, outlined, “Organisations receiving such requests should consider whether they have a contractual obligation to forward the request to the third party with control over the records (although doing so may itself raise privacy questions). Additionally, organisations should respond to such requests by explaining that they do not have control and would need to forward the request to the third party with control.”