Scott McNealy, the former CEO of Sun Microsystems, has achieved considerable notoriety for having warned Internet users ten years ago that "you have no privacy, get over it." Recent headlines suggest that the Ontario courts have adopted those sentiments, as two recent decisions involving the disclosure of subscriber information by Internet service providers confirmed that revealing personal information to law enforcement without a warrant is permitted under Canadian privacy law.
While some view these cases as providing conclusive evidence that Canadians enjoy little privacy in identifying data such as customer name and address information, my weekly technology law column (Toronto Star version, homepage version) argues that a closer look at the decisions and industry practices reveal that the issue is not entirely settled.
Both recent decisions involved disclosures of customer name and address information in suspected child pornography cases. In one case, R. v. Wilson, the court ruled that the data was not particularly sensitive and that the customer had no reasonable expectation of privacy. Moreover, the customer had agreed to Bell Canada’s Privacy Policy that permits the disclosure of personal information in certain circumstances.
In the second case, R. v. Vasic, the court arrived at a different conclusion on the sensitivity of the data. It ruled that combining customer name and address information with IP address data could render the information sensitive. Nevertheless, it upheld the disclosure of the information without a warrant, since the customer had consented to the Rogers Acceptable Use Policy, which warns of possible disclosure to law enforcement without a court order.
These decisions place the spotlight on the fact that customer privacy on the Internet is not guaranteed by national privacy law. Rather, the law actually leaves the disclosure decision in the hands of the organization that has collected the information, which can choose whether to turn over personal information in certain circumstances without a warrant.
Moreover, most Internet-focused organizations such as ISPs have drafted user agreements in which their customers have consented to such disclosure policies. These cases confirm that courts will typically enforce user agreements regardless of whether subscribers have taken the time to read them.
While most companies are reluctant to publicize their disclosure practices, according to government documents recently obtained under the Access to Information Act, the RCMP estimates that 30 percent of Canadian organizations do not reveal personal information to law enforcement without a warrant.
The RCMP estimates did not include specific data on ISPs, but their estimates are borne out by current practices. Bell and Rogers chose to reveal customer information in the Wilson and Vasic cases, however, not all Canadian ISPs would have followed suit. For example, in Atlantic Canada, Bell Aliant requires law enforcement to obtain a warrant in an all non-emergency situations.
The disclosure issue is not limited to ISPs. Similar questions arose last year when the Canadian Internet Registration Authority crafted its whois policy, which governs public access to domain name registrant information. CIRA initially adopted a position that would have required a warrant for all access to such personal information, but intense pressure from the RCMP and Industry Canada led to an exception for law enforcement access without court oversight.
Few Canadians will have any sympathy for the privacy rights of those facing child pornography allegations. Yet these cases provide an important reminder about the limits of Canadian privacy law, which invariably leaves privacy subject to policies that subscribers rarely bother to read.
Natural Right
It is important to distinguish between the natural right to privacy (that individuals may protect their private domains against intrusion, invasion, or violation) and the unnatural privilege of being able to constrain another’s speech (copyright).
It is also important to distinguish between the ethics of regulations that may bind corporations without limit, but may not bind individuals any further than is needed to protect all individuals’ rights equally – certainly not to derogate any of their rights for some ‘greater good’.
Unfortunately, corporations’ use of copyright and invidious contracts (NDA) in the often successful attempt to constrain individuals’ speech has led people to believe that individuals may also constrain each other’s speech in pursuit of preventing further disclosure of their ‘sensitive’ information.
There is no such natural power in an individual to prevent a confidant from disclosing or publishing their confidences. This is fundamentally a matter of trust (confidence), and not a right to be enforced by law – as that would then lead to the ridiculous situation of individuals being legally able to bind each other by speech (as we see when unscrupulous lawyers threaten to sue for copyright infringement if their letters of harassment are published).
Be careful what you wish for. Privacy is not the privilege of gagging others.
We’ve been talking about this for years now, right? Stockwell Day even promised that this exact thing would NOT happen. Where’s the accountability? Why isn’t the Privacy Commissioner standing up for our rights?
Has anyone heard a real explanation as to why they can’t just get a warrant if they think a crime is being committed? (In non-emergency cases, of course. I think we’re talking about criminal investigations, not emergency responses.) If it takes more than, say, two days for police to get a warrant once they are sure there’s criminal activity, then that’s the broken process.
You can’t go fishig if you need warrants.
I don’t believe that just because I deal with corporation they should have an option to disclose my information to anybody without a court order. It would be hard for me to live without my Hydro corporation. You can’t do anything without a bank account these days. And even ISPs have become crucial to employment and everyday living. So given that I have no choice but to sing up with some of these corporations and are forced to sign their contracts they should not be allowed to collect, store or disclose any of my information.
Monopoly Problems
The courts following the User Agreements is fair, if we as users have an option as to who to get our Internet from. In my Condo in Richmond Hill, Ontario, Sympatico does not offer Hi-Speed internet, so none of their DSL resellers can either. This means my only choice for Hi-Speed is Rogers. If I do not like their terms of service, there is nothing I can do about it. This needs to be addressed if the courts are going to allow their documents to stand, which they can also update any time they want. With out a choice to leave their service, I can not change if I disagree with a policy or change in the documents.
protest idea
I wonder what would happen if you contacted your ISP and expressly revoked your supposed “consent” to disclosure in these circumstances?
These are non negotiated one sided contracts. The ‘customers’/’clients’ have no ability to alter the contract, it’s only purpose is to protect the corporation who’s lawyers wrote it. The corporations reserve the right (a right they do not have) to alter these agreements whenever they feel like it. I do not think a EULA is (or should be) a legal document.
It’s more insideous than just giving away data without a warrant
Having the warrent system in place would only solve some of the problems. The issue I have with the court accepting the ToS as a binding agreement is that there is no law that prevents a company from changing its ToS unannounced, nor is their any burden of proof on them to produce concrete evidence that a user agreed to it (the “my cat stepped on the keyboard while I was out of the room” defence) nor has there been any movement to force the implementation of a way of saying “I agree, but not to this clause”.
If I sign a written contract, I can cross out sections, both parties notarize it, and that is now an amended legal agreement. Show me how to do that when I have a “check here to agree” or “logoff” as my only two choices.
These agreements CANNOT be allowed to be enforced as legally binding, because of the fact that the end user has a disproportionally small ability to modify the nature of the agreement, or keep the audit trail of that agreement.
I think it’s completely unsurprising that law enforcement AND the courts came to these decisions in cases regarding child porn. “Won’t someone think of the children!” has long been the rallying cry of those who would stifle. Hopefully someone will have the balls to mount an appeal in one or both of these cases regardless of the risk of being labeled a “pedo-friendly” lawyer. Sadly, I doubt it will happen, and these two cases will be freely held up as supporting case law in other decisions going forward.
“Allegations” is a key word.
“Few Canadians will have any sympathy for the privacy rights of those facing child pornography allegations.”
Maybe I’m reading this the wrong way, but Michael Geist seems to misunderstanding the word “allegations”. It doesn’t mean the person is guilty. Why do people seem to lose all sight of the judicial process when the alleged crime involves children?
And I agree with fair_n_hite_451’s post.
charter of rights?
It seems since Harper has come to power the Constitution has gone out the window. Don’t we have a right to privacy in own home with private company?
As a Canadian i am constantly dumbfounded by the government blatant disregard for the our Charter of rights. It’s as though the government is actually against us. As Obama says science not politics.
The Constitution was written, i believe, to avoid such waste of time debating issued like this. Developing countries such as Nepal or South Africa look to western countries to help write their own Constitution. They imagine how great our democracies are because of it. They see how a good charter of right will settle so many issue in the future saving time and a great deal of money.
Canadian have lost all their political chutzpa. They’ve lots sight of easy a country can fall into a dictatorship or become a police state.
Consider the government is snooping in our Internet and one look at a city like Toronto you will soon notice police cruiser every 10 minutes! Can we really claim to be a free democracy? Do we really have a function Charter of rights?
As a final thought, IP’s should simple add a tunnel or encryption feature to every account for a nominal fee, perhaps $4.95 per month.