Earlier this week, I wrote about how the government’s inclusion of warrantless information demand powers in Bill C-2 may make this the most dangerous lawful access proposal yet, exceeding even the 2010 bill led by Conservative Public Safety Minister Vic Toews. The post emphasized the broad scope of the information demand power. Unlike prior lawful access proposals that targeted telecom and Internet companies, Bill C-2 targets anyone that provides a service to the public. This could include physicians, lawyers, accountants, financial institutions, hotels, car rental companies, libraries, and educational institutions. The list literally never ends. Each of these service providers could be compelled to confirm whether they have provided services to any subscriber, client, account, or identifier. They must also disclose whether they have any information about the subscriber, client, account or identifier as well as advise where and when they provided the service. On top of that, they must advise when they started providing the service and list the names of any other person that may have provided other services. All without a warrant or court oversight.

Department of Justice officials provided a briefing on the provisions yesterday and confirmed this reading of the bill. Officials acknowledged that Bill C-2 extends far beyond just telecom companies to services such as financial institutions, car rental companies, and hotels. When asked about hospitals, physicians, and other health professionals, the officials affirmed that they were covered as well.

This alone is dangerous and makes the bill an obvious target for a constitutional challenge. The Department of Justice has released its Charter statement, which unsurprisingly concludes everything is just fine. But a court is far less likely to be so generous. The Supreme Court of Canada has strongly affirmed the reasonable expectation of privacy of Canadians and the court is unlikely to simply toss away those rights based on an unreasonable law.

But beyond the stunning breadth of the information demand power, there should be serious concern with how the government has crafted a system that is unprecedented in its secrecy and lack of transparency. Simply put, there will be millions of information disclosures every year and Canadians will be kept in the dark on both an individual basis and in terms of the overall scope of warrantless demands.

This lack of transparency is the product of several things. First, the bill itself grants law enforcement the power to mandate that the recipient of the demand not disclose its existence for up to one year:

The peace officer or public officer who makes the demand may impose conditions in the demand prohibiting the disclosure of its existence or some or all of its contents for a period not greater than one year after the day on which the person receives the demand.

Providers will therefore be barred from disclosing the information demand to their subscribers or clients.

Second, the bill creates a safe harbour that encourages providers to disclose information about their subscribers or clients without either a warrant or an information demand. Rather, the bill opens the door to law enforcement simply requesting that the information be disclosed on a “voluntary” basis. Should the provider comply, law enforcement is entitled to use the information and the provider is granted full legal immunity from any liability for having disclosed it. The three relevant provisions:

(1.1) For greater certainty, no information demand made under section 487.‍0121 is necessary for a peace officer or public officer to ask a person to voluntarily provide any information referred to in paragraphs 487.‍0121(1)‍(a) to (f) if the person is lawfully in possession of the information.

(2) A person who preserves data, keeps an account open or active or provides a document in  the circumstances referred to in subsections (1) or who provides information in the circumstances referred to in subsections (1.‍1) does not incur any criminal or civil liability for doing so.

(3) For greater certainty, no production order or warrant, or information demand made under section 487.‍0121, is necessary for a peace officer or public officer to receive any information from a person who is lawfully in possession of it and to act on the information if the person provides it voluntarily or is required by law, including a law of a foreign state, to provide it.

While larger companies (not to mention physicians, lawyers, and other professionals) will presumably refuse to voluntarily disclose information without an information demand or more, the framework is designed to allow law enforcement to encourage quiet cooperation with no risk of liability.

Third, by encompassing all service providers in Canada as potential targets for information demands, Bill C-2 effectively destroys longstanding efforts at encouraging transparency with law enforcement requests. Law enforcement has been notoriously bad at documenting and disclosing their use of disclosure requests. However, the larger telecom and Internet companies release annual transparency reports that disclose lawful access requests. For example, last year Rogers released information involving 160,036 customers pursuant to a court order or warrant. There were a further 98,550 disclosures involving emergency situations (the data raises questions about what problem Bill C-2 is trying solve).

 

 

There is similar data for companies such as Bell and Telus. But with Bill C-2, the scope of targets is virtually unlimited – every hospital, library, school, lawyer, physician, accountant, and more could face information demands. There will be no transparency reporting from these entities, meaning that the use of the warrantless information demand system will be shrouded in secrecy.

After initially de-emphasizing the lawful access provisions in Bill C-2, department officials have started to come clean. What they describe is a system that represents a terrifying assault on the privacy rights of Canadians which is designed to function in a secretive manner that undermines over a decade of transparency efforts. The lawful access provisions are guaranteed to face a constitutional challenge, but it should never get that far as the government should remove the rules in their entirety.