In the aftermath of the Supreme Court of Canada’s Spencer decision, several leading Canadian ISPs have publicly announced that they have changed their practices on the disclosure of subscriber information (including basic subscriber information such as name and address) to law enforcement. For example, Rogers announced that it will now require a warrant or court order prior to disclosing information to law enforcement except in emergency situations. Telus advised that it has adopted a similar practice and TekSavvy indicated that that has long been its approach. SaskTel says that it will release name, address, and phone number.
Unlike its competitors, Bell has remained largely silent in recent weeks. In media reports, the company says little more than that it follows the law. In fact, the Toronto Star’s Alex Boutilier tweets that the company is now declining to respond to journalist inquiries about the issue. In the past, the company was a clear supporter of disclosing “pre-warrant” information in some circumstances to law enforcement. As detailed in this Canadian Bar Association article:
Read more ›
Canadian Internet and telecom providers have, for many years, disclosed basic subscriber information, including identifiers such as name, address, and IP address, to law enforcement without a warrant. The government has not only supported the practice, but actively encouraged it with legislative proposals designed to grant full civil and criminal immunity for voluntary disclosures of personal information.
Last month, the Supreme Court of Canada struck a blow against warrantless disclosure of subscriber information, ruling that there is a reasonable expectation of privacy in that information and that voluntary disclosures therefore amount to illegal searches.
My weekly technology law column (Toronto Star version, homepage version) notes the decision left little doubt that Internet and telecom providers would need to change their disclosure policies. Last week, Rogers, the country’s largest cable provider, publicly altered its procedures for responding to law enforcement requests by announcing that it will now require a court order or warrant for the disclosure of basic subscriber information to law enforcement in all instances except for life threatening emergencies (warrantless disclosures may still occur where legislation provides the lawful authority to do so). Telus advised that it has adopted a similar approach.
Read more ›
Rogers has updated its approach to responding to law enforcement requests for subscriber information to reflect last month’s Supreme Court of Canada Spencer decision. The company will now require a warrant for access to basic subscriber information (with the exception of life threatening emergencies), a policy that effectively kills the government’s Bill C-13 voluntary disclosure provisions. The government wants to provide full immunity for voluntary disclosure of personal information, but Canadian Internet providers and telecom companies are unlikely to provide such information without a court order given the recent decision. The Rogers update:
After hearing your concerns and reviewing the Supreme Court ruling from last month, we’ve decided that from now on we will require a court order/warrant to provide basic customer information to law enforcement agencies, except in life threatening emergencies. We believe this move is better for our customers and that law enforcement agencies will still be able to protect the public.
Read more ›
The Supreme Court of Canada’s Spencer decision is still only a few days old, but it has become clear that the ruling has left the government’s privacy and lawful access strategy in tatters. I’ve posted earlier on how the decision – which held that Canadians have reasonable expectation of privacy in their subscriber information and that voluntary disclosure of such information to the police constitutes an unlawful search – blows away the government’s plans for Bills C-13 and S-4 by contradicting longstanding government policy positions.
While there are options for the government to establish reforms that are consistent with the court ruling and that would grant police the access they say they need, government ministers have instead adopted a rather bizarre response of saying anything, no matter how inconsistent with prior positions, the court’s analysis, or public comments from authorities such as the Privacy Commissioner of Canada. There is admittedly a track record for this: Conservatives have dismissed privacy concerns from Carole Todd, the Boys and Girls Club of Canada, the Privacy Commissioner of Canada, and many more. Further, the Conservative leader in the Senate claims Spencer has “no impact whatsoever” on Bill S-4.
Read more ›
Having had the benefit of a few days to consider the implications of the Supreme Court of Canada decision in Spencer, the Senate last night proceeded to ignore the court and pass Bill S-4, the Digital Privacy Act, unchanged. The bill extends the ability to disclose subscriber information without a warrant from law enforcement to any private sector organizations by including a provision that allows organizations to disclose personal information without consent (and without a court order) to any organization that is investigating a contractual breach or possible violation of any law. Given the Spencer decision, it seems unlikely that organizations will voluntarily disclose such information as they would face the prospect of complaints for violations of PIPEDA.
Despite a strong ruling from the Supreme Court of Canada that explicitly rejected the very foundation of the government’s arguments for voluntary warrantless disclosure, the government’s response is “the decision has no effect whatsoever on Bill S-4.”
Read more ›