Wiertz Sebastien - Privacy by Sebastien Wiertz (CC BY 2.0) https://flic.kr/p/ahk6nh

Privacy

The Expansion of Personal Information Disclosure Without Consent: Unpacking the Government’s Weak Response to Digital Privacy Act Concerns

Bill S-4, the government’s Digital Privacy Act, was sent for review to the Industry Committee yesterday. The committee review, which comes before second reading, represents what is likely to be the last opportunity to fix a bill that was supposed to be a good news story for the government but has caused serious concern within the Canadian privacy community. While there are several concerns (I raised them in my appearance before the Senate committee that first studied the bill), the chief one involves the potential expansion of voluntary disclosure of personal information without consent or court oversight. Bill S-4 proposes that:

“an organization may disclose personal information without the knowledge or consent of the individual… if the disclosure is made to another organization and is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada or a province that has been, is being or is about to be committed and it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the investigation;

Translate the legalese and you find that organizations will be permitted to disclose personal information without consent (and without a court order) to any organization that is investigating a contractual breach or possible violation of any law. This applies both past breaches or violations as well as potential future violations. Moreover, the disclosure occurs in secret without the knowledge of the affected person (who therefore cannot challenge the disclosure since they are not aware it is happening).

The government is clearly aware that this is a major concern as it attempted to answer the critics during debate over Bill S-4 in the House of Commons yesterday. Unfortunately, the responses were incredibly weak. I’ve identified at least six responses from government sources below.

October 21, 2014 — 3 comments — News

System Security Breach by Jeff Keyzer (CC BY-SA 2.0) https://flic.kr/p/bucTzM

Government Opens Door to Major Changes to Digital Privacy Bill

While it was overshadowed by the headlines over potential copyright reform, Peter Van Loan, the government’s House leader, disclosed last week that the government is planning to send Bill S-4, the Digital Privacy Act, to the Industry Committee for review prior to second reading. The bill, which has proven controversial due to a provision that expands the possibility of voluntary disclosure of subscriber information and relatively weak security breach disclosure rules, will be open to more significant reforms that previously thought possible (my remarks before the Senate committee can be found here). Under Parliamentary rules, referring a bill before second reading allows the committee to alter the scope of the bill.

October 15, 2014 — 5 comments — News

Bury your head in the sand... by Sander van der Wel (CC BY-SA 2.0) https://flic.kr/p/af6AGY

Government Goes for the “Head in the Sand” Approach on Voluntary Warrantless Disclosures

In the aftermath of the Supreme Court of Canada’s Spencer decision, I argued that the decision upholding the reasonable expectation of privacy in subscriber information contradicted the government’s claims supporting Bills C-13 and S-4, leaving the government’s lawful access strategy in tatters. I noted that it faced a choice:

The Canadian government could adopt the “bury our heads in the sand approach” by leaving the provision unchanged, knowing that it will be unused or subject to challenge. That would run counter to the spirit of the Supreme Court ruling, however, and do nothing to assist law enforcement.

Yesterday, the government did just that, as Bill C-13 passed another legislative hurdle with the reported committee version of the bill was approved by the House. During the debate, the government insisted that the legislation is consistent with the Spencer decision. While it is true that the voluntary warrantless disclosure provision does not directly contradict the Spencer decision, the reality is that it has been rendered largely moot. In other words, the government is touting a legislative solution to assist law enforcement that the police will not use and that telecom companies will ignore.

October 2, 2014 — 1 comment — News

Sign on public phone booth by Ian Kennedy (CC BY-NC 2.0) https://flic.kr/p/54TY1m

An Inconsistent Mess: Government Documents Reveal Ineffective and Inconsistent Policies Amid Widespread Demands for Subscriber Information

One day after NDP MP Charmaine Borg received a government response to her request for more data on subscriber requests and disclosures, Liberal MP Irwin Cotler received a response to his request for information. While there is some overlap between the documents, Cotler asked some important specific questions about the number of requests, which providers face requests, and the results of the information disclosed. Departments such as CSIS and CSEC unsurprisingly declined to provide much information, but several other departments were more forthcoming.

The results paint a disturbing picture: massive numbers of requests often with little or no record keeping, evidence to suggest that the disclosures frequently do not lead to charges, requests that extend far beyond telecom providers to include online dating and children’s gaming sites, and inconsistent application of the Supreme Court of Canada’s recent Spencer decision.

September 18, 2014 — 1 comment — News

"We know you're mobile. Now we are too." by Neal Jennings (CC BY-NC-SA 2.0) https://flic.kr/p/dfFCeQ

Warrantless Subscriber Disclosures and the CBSA: Digging into the Details

Earlier this year, reports indicated that the Canadian Border Services Agency had requested subscriber information over 18,000 times in a single year, with the vast majority of the requests and disclosures occuring without a warrant. The information came to light through NDP MP Charmaine Borg’s efforts to obtain information on government agencies requests for subscriber data. Borg followed up the initial request with a more detailed list of questions and earlier this week she receive the government’s response.

The latest response confirms the earlier numbers and sheds more light on CBSA practices. First, the CBSA confirms that requests for subscriber information are conducted without a court order by relying upon Section 43 of the Customs Act. It provides:

September 17, 2014 — 2 comments — News