The government’s plan for warrantless disclosure of Internet subscriber information is rightly attracting increasing attention as sneaking lawful access provisions into a border bill raises significant privacy concerns. As I pointed out last week, Bill C-2’s new “information demand” power – which can be used by a wide range of enforcement agencies over literally any potential offence of any Act of Parliament – is certain to spark a legal challenge given the Supreme Court of Canada’s previous decisions in Spencer and Bykovets. While the government has tried to paint the information at stake as “phone book” information with little privacy value, the reality is far different. The information demand includes whether the provider provides or has provided services to a particular subscriber or client, or to any account or identifier, whether there is transmission data on hand (who was the person communicating with and what apps were they using) as well as where and when the service was provided. The information demand can also cover when service began, when it ended, and what other communications services are used by the subscriber. The specific content would require a warrant, but all of this data, which can be very revealing, would be available without judicial oversight. Further, providers would be prohibited from disclosing the disclosure for a year and would receive legal immunity if they voluntarily provide the information without even requiring an information demand request.

While this alone should raise serious privacy concerns, an underrated aspect of the new information demand power is how widely used it is likely to be with the potential to result in millions of disclosure demands each year. This not idle speculation since we have data from the pre-Spencer era. In the years before the Spencer ruling, most (though not all) of the major telecom companies maintained an informal, fee-based system in which law enforcement could request basic subscriber information without warrant. The telecom companies typically charged $1-3 per request. Most of this took place outside of the public eye, but some information requests yielded stunning data on the warrantless disclosures.

For example, in 2011, the Canadian Wireless Telecommunications Association responded to a request from the Privacy Commissioner of Canada seeking lawful access data. The CWTA chose to respond by aggregating the data from its member providers rather than breaking them down individually. The data from just nine providers indicated that in the prior year there were 1,193,630 requests covering 784,756 subscribers. There were 27.3 million wireless subscribers in 2011. That number has grown by 40% to 38.3 million today. Assuming requests grow at a similar rate, there would suggest over 1.5 million request per year from telecom and wireless providers alone.

In 2014, then NDP MP Charmaine Borg tried to obtain data from those initiating requests, filing an inquiry with several government departments on their requests for subscriber information. The results were shocking: several departments, notably including the RCMP, did not even maintain any records of their requests. Among those that did, Canada Border Services Agency reported over 18,000 requests for basic subscriber information in one year alone (2013) and said that it had no data for any other year.

All of this came to an end with Spencer decision. But Bill C-2 threatens to re-open the floodgates to subscriber information without a warrant. Given the growth of Internet and wireless usage, it seems likely that the requests will exceed those in 2011. Moreover, this only covers telecom and Internet providers. When the large Internet platforms such as Google and Meta are factored into the equation, the numbers will presumably grow into the millions, creating what could become the largest single source of personal information for law enforcement, all accessible without court oversight.