Subscribe Now

* You will receive the latest news and updates on the Canadian IT marketplace.

Trending News

Blog Post

Sweeping up
SECURITY SHELF

Sweeping up 

Bill C-13, the so-called Protecting Canadians from Online Crime Act, creates two new offences intended to combat cyber-bulling. However, the vast majority of the Act has little to do with protecting Canadians and instead focuses on expanding the powers of a wide variety of government agencies.

In his November 19, 2014 submission to the Standing Senate Committee on Legal and Constitutional Affairs, Daniel Therrien, Privacy Commissioner of Canada, cautioned that “the bulk of the new powers may be used where investigators have a mere suspicion of wrongdoing, as opposed to a higher threshold of reasonable belief that the search will provide evidence of a specific crime. The difference between these two thresholds represents a marked difference in privacy protection.”

The Privacy Commissioner also observed, “A second aspect of the Bill that merits serious scrutiny is the wide range of governmental authorities and governmental bodies –well beyond police – that will be able to use the new investigative powers. A very broad range of actors – at all levels of government – will be able to avail themselves of the new investigative powers including demanding the preservation of data, seeking production of personal records or private communications, or requesting warrants to collect tracking data associated with vehicles, transactions or individuals.”He recommended the “Use of the proposed search powers should be limited to traditional ‘peace officers’ engaged in criminal investigations. Alternatively, the open-ended category of public officers should be replaced by a closed list of designated public officers who would be afforded these new powers in respect of specific legislative duties.”

He also addressed the issue of voluntary disclosure in light of the recent Supreme Court of Canada (SCC) ruling in R. v. Spencer that essentially held police require a warrant to obtain personal information from Internet Service Providers:

“A final concern of our Office relates to the Bill’s proposed new section 487.0195 of the Criminal Code. This immunity provision would protect from legal liability those persons who voluntarily disclose personal information in response to government requests without a warrant. Where the state seeks access to personal information held by organizations, including Internet service providers, R. v. Spencer clearly limited warrantless searches to situations where there are exigent circumstances, a reasonable law, or where the information does not attract a reasonable expectation of privacy.

As a result, Canadians remain in the dark as to what may happen to their personal information. The government claims that nothing in Bill C-13 needs to be changed as a result of R. v. Spencer, leaving Canadians to wonder what impact the ruling has, if any.”

I asked Professor Michael Geist, Canada Research Chair in Internet and E-commerce Law,University of Ottawa, “I understand that SCC has ruled that police require a court order to obtain subscriber information from ISPs, but 487.0195 specifically allows voluntary disclosure and provides indemnity. Does the new legislation open the door again, or will the SCC precedent prevail?”

Professor Geist replied, “Great question. I suspect the SCC will prevail until the government amends the law. With the SCC decision, I think law enforcement will be reluctant to seek voluntary disclosure since it may taint whatever they obtain. Obtaining a warrant will be a safer approach. Similarly, ISPs are far less likely to voluntary disclose information as most will now require a warrant.”

Geist said CIOs should be “thinking about the broader environment around subscriber information. This is one piece of a larger puzzle involving several legislative initiatives, voluntary disclosure, and revelations about the extent to which law enforcement has been seeking subscriber data.”

To help Canadians understand how the new preservation and production orders contained in C-13 may impact businesses I asked Rogers, Bell, and Telus.

A spokesperson from Rogers replied, “The changes won’t affect our policy of not providing customer info without a warrant/court order (or equivalent). We will comply with the new orders when they come into effect in March, but we don’t expect a significant change in the requests we get from police.” Bell and Telus did not reply.

Overall, it appears that Bill C-13 will have little impact on Canadian Internet providers and that the majority of the effect will be felt by consumers. In the words of the Privacy Commissioner, “these new investigative tools would sweep up vast amounts of potentially sensitive personal information by an open-ended group of authorities for a wide range of purposes, without any public reporting requirements.”

Related posts