The introduction of Bill C-13 – the “cyberbullying bill” with extensive lawful access provisions – has generated considerable discussion on its privacy implications. While many have noted that Justice Minister Peter MacKay took less than a year to retreat from the government’s commitment that “any attempts that we will continue to have to modernize the Criminal Code will not contain the measures contained in C-30”, the question will soon focus on whether the new bill contains any privacy threats in need of reform.
It is certainly true that the government has removed two of the most controversial C-30 provisions by excluding warrantless mandatory disclosure of basic subscriber information and the requirement for telecommunications service providers to build intercept capability within their systems. However, several provisions still featured in the bill are cause for concern. This post focuses on the new safe harbour protections for voluntary disclosure of personal information without a warrant. Posts to follow later this week will examine the lower thresholds for access to metadata and location information.
The Criminal Code currently states the following on the ability for law enforcement to request voluntary assistance without court oversight:
For greater certainty, no production order is necessary for a peace officer or public officer enforcing or administering this or any other Act of Parliament to ask a person to voluntarily provide to the officer documents, data or information that the person is not prohibited by law from disclosing.
Note that the provision is limited to enforcing or administering the Criminal Code or any other federal law. Now consider Bill C-13:
For greater certainty, no preservation demand, preservation order or production order is necessary for a peace officer or public officer to ask a person to voluntarily preserve data that the person is not prohibited by law from preserving or to voluntarily provide a document to the officer that the person is not prohibited by law from disclosing.
There is no limitation on the request being about the enforcement or administration of the Criminal Code or any other Act of Parliament. It simply opens the door to requests for voluntary assistance for any reason whatsoever.
The second part of the provision creates the incentive for the intermediary to disclose. It states:
A person who preserves data or provides a document in those circumstances does not incur any criminal or civil liability for doing so
For Internet providers and telecom companies, this amounts to powerful immunity. Those that preserve personal information or disclose it without a warrant, are immune from any criminal or civil liability (including class action lawsuits). This represents significant legal protection for intermediaries that is likely to lead to increased disclosures without court oversight. Yet even when there is court oversight for access to metadata or tracking information, the threshold is lower than for other conventional warrants as will be examined in an upcoming post.