Appearance before the Senate Standing Committee on Legal and Constitutional Affairs on Bill C-13, the Protecting Canadians from Online Crime Act

November 20, 2014
Ottawa, Ontario

Opening Statement by Daniel Therrien
Privacy Commissioner of Canada

(Check against delivery)

---

Thank you, Mister Chair and other Honourable Members of the Committee for the invitation to comment on Bill C-13, Protecting Canadians from Online Crime Act. 

Joining me today are Patricia Kosseim and Daniel Caron.

My Office has provided this committee with a written submission in which we support the creation of new criminal offences aimed at combating cyberbullying, but identify significant privacy risks associated with the surveillance powers being proposed, namely:

• the lower legal standard applicable to several of the new production orders and warrants;
• the immunity clause protecting those who voluntarily provide information to police following requests for warrantless access;
• the broad range of departments and agencies empowered by the proposed legislation; and,
• the lack of an effective transparency and accountability regime. 

Let me highlight a few of our key points today.

On the issue of thresholds, I recommend that the “reasonable grounds to believe” standard prevail as the appropriate judicial threshold for authorization of the new production orders and warrants.

Courts have upheld the lower reasonable suspicion standard only in limited situations where privacy interests are reduced or where state objectives of public importance are predominant.

The government defends the “reasonable suspicion” thresholds in Bill C-13 partly based on the argument that the information sought is not very sensitive and triggers a lower expectation of privacy.  With respect, I disagree.

As the Supreme Court of Canada recently reminded us in R. v. Spencer, protecting privacy interests requires us to look not only at the specific information being sought – no matter how seemingly innocuous – but also at what the information may further reveal. 

A paper recently published by our Office entitled Metadata and Privacy demonstrates how various forms of transactional and transmission data can indeed reveal very sensitive details about an individual.

The government further justifies the “reasonable suspicion” threshold on grounds that combatting cyberbullying or online child exploitation are important state objectives, which of course they are. 

However, it is important to remember that these new investigative tools would sweep up vast amounts of personal information by an open-ended group of “public officers” for a wide range of much less compelling purposes. 

As the Supreme Court said, privacy interests do not depend on whether privacy shelters legal or illegal activity, or on the legal or illegal nature of the information being sought. 

The issue is therefore not one of concealing illegal use of the Internet for cyberbullying or child pornography, but of protecting the privacy interests people generally have with respect to home computers they use for private purposes. 

While some may argue this reasoning could create a virtual space where crime can flourish, the Court rejected that argument in Spencer, noting investigators had ample evidence to obtain a production order for the information they were seeking. 

Should the Committee support the lower standard of reasonable suspicion, we suggest adding language that would limit the use of information obtained through those powers to the investigation of the alleged crime specified in the court application.

With regard to section 487.0195, this immunity provision would protect from legal liability those who voluntarily disclose personal information in response to government requests without a warrant.

Where the state seeks access to personal information held by organizations, including Internet service providers, R. v. Spencer clearly limited warrantless searches to situations where there are exigent circumstances, a reasonable law, or where the information does not attract a reasonable expectation of privacy.

Carrying out a “reasonable expectation of privacy” analysis is complex and highly contextual.  But how are organizations and individuals expected to do this in a given case? 

Several months after Spencer, Canadians are still in the dark about what may happen to their personal information.  

There appears to be wide variation in how the Spencer decision is being interpreted and responded to. 

I would urge Parliament to put an end to this state of ambiguity and clarify what -- if anything -- remains of the common law policing powers to obtain information without a warrant post-Spencer.

Finally, on the need for transparency and accountability, the Supreme Court of Canada has in the past invited Parliament to decide what accountability and oversight mechanisms would be appropriate to ensure the reasonableness of a law, while recognizing the practical and policy implications. 

I would therefore urge Parliamentarians, while you still have the opportunity, to build into Bill C-13 the necessary reporting mechanisms that would allow Canadians to hold government to account for the use of these significant new powers as well as requests without a warrant.   

Thank you again for the opportunity to comment on this important Bill and I welcome your questions.