While it was overshadowed by the headlines over potential copyright reform, Peter Van Loan, the government’s House leader, disclosed last week that the government is planning to send Bill S-4, the Digital Privacy Act, to the Industry Committee for review prior to second reading. The bill, which has proven controversial due to a provision that expands the possibility of voluntary disclosure of subscriber information and relatively weak security breach disclosure rules, will be open to more significant reforms that previously thought possible (my remarks before the Senate committee can be found here). Under Parliamentary rules, referring a bill before second reading allows the committee to alter the scope of the bill.
Post Tagged with: "pipeda"
The Canadian Anti-Spam Law Panic: Same As It Ever Was
As the Canadian media reports on the panic associated with the new anti-spam law set to take effect next week, consider the following from Macleans titled “Few Companies Prepared for New Privacy Law“:
The new law..says organizations can only collect personal information for a stated reason – and can use it only for that purpose. Among others things, that means a company that supplies a service can’t sell its list of subscribers to another company’s marketing department. Individuals must be informed, and give their consent, before personal information is collected, used or disclosed..But most firms are unaware of the new law.”
The article continues by noting that “there’s confusion over which organizations might be exempt” and that “there is no grandfather clause – all existing customer information needs to be compliant.” The message is similar in a Globe and Mail article titled “Many small firms not ready for privacy rules“, which also notes the possibility of a constitutional challenge. An IT World Canada reiterates that concern in its coverage:
most Canadian organizations are not aware of the [law]. And very few are prepared to comply.
Government Rejects Supreme Court Privacy Decision: Claims Ruling Has No Effect on Privacy Reform
Having had the benefit of a few days to consider the implications of the Supreme Court of Canada decision in Spencer, the Senate last night proceeded to ignore the court and pass Bill S-4, the Digital Privacy Act, unchanged. The bill extends the ability to disclose subscriber information without a warrant from law enforcement to any private sector organizations by including a provision that allows organizations to disclose personal information without consent (and without a court order) to any organization that is investigating a contractual breach or possible violation of any law. Given the Spencer decision, it seems unlikely that organizations will voluntarily disclose such information as they would face the prospect of complaints for violations of PIPEDA.
Despite a strong ruling from the Supreme Court of Canada that explicitly rejected the very foundation of the government’s arguments for voluntary warrantless disclosure, the government’s response is “the decision has no effect whatsoever on Bill S-4.”
Why Have Canada’s Telcos Failed to Notify Subscribers About Disclosing Their Information?
While much of the attention this week on the massive number of requests for subscriber information has rightly focused on the government and a legal framework that provides insufficient oversight (and is about to expand warrantless disclosure under Bills C-13 and S-4), the telecom and Internet companies also deserve greater scrutiny. One of the key questions in the document on telecom and Internet provider disclosure practices asked simply:
Do you notify your customers, when the law allows, that their information has been requested, thus giving them an opportunity to contest the request in court?
The answer from every provider: No.
The Expansion of Warrantless Disclosure Under S-4: Government’s Response Fails to Reassure
My post and column on the expansion of warrantless disclosure under Bill S-4, the misleadingly named Digital Privacy Act, has attracted some attention and a response from Industry Canada. The department told iPolitics:
“Companies who share personal information are required to comply with the rules to ensure that information is only disclosed for the purpose of conducting an investigation into a contravention of a law or breach of an agreement. For example, self-regulating professional associations, such as a provincial law society, may wish to investigate allegations of malpractice made by a client. When organizations are sharing private information, the Privacy Commissioner can investigate violations and may take legal action against companies who do not follow the rules. This is consistent with privacy laws in British Columbia and Alberta and was recommended by the Standing Committee Access to Information, Privacy and Ethics.”
The response may sound reassuring, but it shouldn’t be.
Recent Posts
The Law Bytes Podcast, Episode 231: Sara Bannerman on How Canadian Political Parties Maximize Voter Data Collection and Minimize Privacy Safeguards 
The Law Bytes Podcast, Episode 230: Aengus Bridgman on the 2025 Federal Election, Social Media Platforms, and Misinformation 
The Law Bytes Podcast, Episode 229: My Digital Access Day Keynote – Assessing the Canadian Digital Policy Record 
Queen’s University Trustees Reject Divestment Efforts Emphasizing the Importance of Institutional Neutrality 
The Law Bytes Podcast, Episode 228: Kumanan Wilson on Why Canadian Health Data Requires Stronger Privacy Protection in the Trump Era
