The debate over Bill C-30, the online surveillance bill, has thus far focused on the mandatory disclosure of subscriber information, including name, address, email address, and IP address. The provision represents a significant change in the law, which currently allows ISPs to disclose such information but does not require them to do so. In response to the criticism, Public Safety Minister Vic Toews has emphasized that the content of emails or web surfing habits would still require a warrant.
Yet Toews has not talked about a provision in Bill C-30 that creates a voluntary warrantless system that would allow police to ask for the content of emails or web surfing habits and allow ISPs to comply with the request without fear of liability. Section 487.0195 states the following:
(1) For greater certainty, no preservation demand, preservation order or production order is necessary for a peace officer or public officer to ask a person to voluntarily preserve data that the person is not prohibited by law from preserving or to voluntarily provide a document to the officer that the person is not prohibited by law from disclosing.
(2) A person who preserves data or provides a document in those circumstances does not incur any criminal or civil liability for doing so.
This provision opens the door to police approaching ISPs and asking them to retain data on specified subscribers or to turn over any subscriber information – including emails or web surfing activities – without a warrant. ISPs can refuse, but this provision is designed to remove any legal concerns the ISP might have in doing so, since it grants full criminal and civil immunity for the disclosures.
While many would hope that ISPs would not hand over personal information without a warrant, revelations that they already provide customer name and address information about 95 percent of the time suggests that police have little to lose in asking for more detailed data preservation and disclosure. Bill C-30 increases the likelihood of “voluntary” warrantless disclosures, creating a legal framework that makes it easy and risk-free from a provider perspective.