Briefing note

Appearance before the Standing Senate Committee on Legal and Constitutional Affairs on Bill S-203 Protecting Young Persons from Exposure to Pornography Act

PURPOSE:

1. For information.

ISSUE:

2. The Standing Senate Committee on Legal and Constitutional Affairs (LCJC) has called us to appear on Senate Public Bill S-203.^{Footnote 1} The Bill is narrowly focused on restricting children’s access to sexually explicit material available online for commercial purposes with a view to reducing the harmful effect on their health.^{Footnote 2}
3. The privacy issues that have been raised with respect to the Bill relate to the age verification scheme and its technical elements, so as to ensure that companies verify a person’s age while collecting as little private information about them as possible.
4. Excerpts from the debate at second reading and the first meeting are appended as Annex A.

BACKGROUND:

5. The Bill has two main parts. The first part makes it an offence to make sexually explicit material available to young persons on the Internet. The second part enables the Minister of Public Safety and Emergency Preparedness to require that steps be taken by Internet service providers (ISPs) to prevent sexually explicit material from being made available to young persons on the Internet.^{Footnote 3}

Offence provision

6. The first part of Bill S-203 creates an offense provision with associated fines for any individual or any corporation who, for commercial purposes, makes available sexually explicit material on the Internet to a young person.^{Footnote 4} In the case of an individual, fines would not exceed $10,000 for a first offence, and for a second or subsequent offence they may be liable for a fine of not more than $20,000, imprisonment not exceeding six months, or both. In the case of a corporation, a fine for a first offence may be up to $250,000 and for a second or subsequent offence may be $500,000. The Bill also creates liability for a director, officer or agent of a corporation.
7. Bill S-203 specifies that “sexually explicit material” means sexually explicit material as defined for the purpose of subsection 171.1(1) of the Criminal Code. Section 171.1( (1) of the Criminal Code, provides that:

   Making sexually explicit material available to a child

   171.1 (1) Every person commits an offence who transmits, makes available, distributes or sells sexually explicit material to:

   (a) a person who is, or who the accused believes is, under the age of 18 years, for the purpose of facilitating the commission of an offence with respect to that person under subsection 153(1), section 155, 163.1, 170, 171 or 279.011 or subsection 279.02(2), 279.03(2), 286.1(2), 286.2(2) or 286.3(2);

   (b) a person who is, or who the accused believes is, under the age of 16 years, for the purpose of facilitating the commission of an offence under section 151 or 152, subsection 160(3) or 173(2) or section 271, 272, 273 or 280 with respect to that person; or

   (c) a person who is, or who the accused believes is, under the age of 14 years, for the purpose of facilitating the commission of an offence under section 281 with respect to that person.

8. Subsection 171.1(5) of the Criminal Code provides a definition of sexually explicit material for the purposes of the above, specifying that it means material that is not child pornography and provides additional details about its characteristics.

Age-verification

9. The preamble includes the following with respect to age-verification and privacy: “whereas online age-verification technology is increasingly sophisticated and can now effectively ascertain the age of users without breaching their privacy rights.”
10. The Bill essentially creates an incentive for implementing more sophisticated age-verification techniques that will be further prescribed by Regulation. It does this by specifying that an accused may not rely on a defense based on their belief that the young person was at least 18 years of age unless the accused had implemented an age-verification method as prescribed by the Regulations to limit access.

Responsibilities of ISPs

11. The second part of the Bill sets out a process for the Minister to provide notice to ISPs when the Minister has reasonable grounds to believe an offence has been committed.
12. The notice must identify, in a manner that the Minister deems appropriate, the non-complying person, and must “require the Internet service provider to take any steps specified in the notice,” specify the time by which the ISP must have complied with any requirement imposed by the notice, and provide any relevant information that may assist the ISP in complying with the requirements imposed by the notice.
13. The intent of this provision is, in part, to address the problem of porn sites that are hosted in other jurisdictions who do not comply with the Bill’s provisions. Rather than trying to issue fines to companies abroad, the approach would instead remove their access to the Canadian market.^{Footnote 5}
14. An ISP’s non-compliance with any requirement set out in the notice constitutes a violation, and would be liable to a penalty of an amount to be determined in accordance regulations made under paragraph 11(c).

Similar measures taken in other jurisdictions

15. During the debates at second reading state, the Bill’s sponsor Senator Miville-Dechêne pointed to a number of other jurisdictions that have implemented, or considered comparable measures.
    • France: France’s age-verification system for pornography was included as an amendment to a broader law on domestic violence, adopted unanimously in the Senate in July 2020. The French audiovisual regulator CSA is responsible for enforcing the law, and can audit and will have the power to sanction companies that do not comply, including blocking access to the websites in France with a court order.^{Footnote 6} The choice of age-verification mechanisms will be left up to the platforms.
    • Germany: Germany intends to make it mandatory for ISPs to block access to the most popular foreign-based porn sites if those sites continue to refuse to implement an effective age-verification system.^{Footnote 7}
    • UK: A regime for mandatory age-verification for access to online pornography in the United Kingdom was set out in part 3 of the UK Digital Economy Act 2017 (DEA).^{Footnote 8} The DEA allows porn sites to work out how to implement age-verification. However, in October 2019, the UK Government announced that it would not commence age-verification under the DEA, but rather would address these issues more comprehensively through wider online harms proposals. Privacy advocates in the UK had raised privacy concerns related to age-verification in the DEA, specifically the Open Rights Group, who had spoken out against the potential abuses of this type of verification since privacy protection mechanisms were not mandatory, and raised concerns that Britain was heading for an inventory of citizens’ porn preferences.^{Footnote 9}
      
      Critics were in part concerned that MindGeek – the owner of several porn sites including PornHub - was proposing to set up a company called AgeID who would provide various options for verifying a user’s age, including getting local retailers to verify ID’s and issue a “porn pass” or scrape users’ Facebook data and then infer from their activity whether they’re over 18.^{Footnote 10}
      
      While the UK Government has since outlined new plans in an Online Harms Whitepaper, which re-introduces the issue of age-verification and ISP blocking and responsibilities of the regulator, it has yet to table a new Bill to this effect.^{Footnote 11}
    • Australia: In February 2021, an Australian parliamentary committee recommended establishing a third-party age-verification system for accessing online porn and gambling sites in response to widespread community concern. The committee’s report, entitled Protecting the age of innocence,^{Footnote 12} commented that although age-verification is “not a silver bullet,” it would play a major role in preventing young people, especially young children, from being exposed to harmful content. While Australia’s Online Safety Bill 2021,^{Footnote 13} tabled in February 2021, does not propose mandatory age-verification requirements for online pornography sites specifically, it does include provisions on material considered to be R 18+, provisions for establishing “restricted access systems” for certain materials, as well as a related complaints regime.^{Footnote 14}

STRATEGIC CONSIDERATIONS:

16. Privacy concerns raised with the Bill to date relate primarily to the age verification scheme, and its technical elements. While the specific methods for age-verification are not outlined in the Bill, and will subsequently be prescribed by Regulation, there has been some discussion in debates around possible technical solutions for age-verification.
17. Specifically, the Bill’s sponsor Senator Miville-Dechêne suggests that experts agree that verification must be carried out not by porn sites but by third parties specializing in this service, so pornography sites do not have access to personal information of its clients.^{Footnote 15}
18. The Senator also remarks on the merits of encryption and the challenges with the use of facial recognition for age-verification.^{Footnote 16} Senators heard from private companies, specifically a British company called Yoti, which offers encrypted third party age-verification services. During the debates, it was suggested that internet users would receive a certified age token in their browser that contains no identity information other than the fact that the user is 18 or older.^{Footnote 17} According to its website, Yoti also has a facial recognition technology option to provide an estimation of age.^{Footnote 18}
19. Other methods mentioned in the debates included the purchase of a “porn pass” at a store that would check the buyer’s age in person or a digital ID in the form of a smartphone app, which was put forward as an option that would enable users to maintain full control over their data.^{Footnote 19}
20. There is certainly an awareness among Senators that there is a need to find an effective technical solution that can verify a person’s age while collecting as little private information about them as possible, especially given the sensitivities around the content and what it could reveal about the sexual preferences of adults.
21. Key privacy considerations associated with age-verification methods include:
    • Ensuring collection and use of personal information is limited to what is necessary and proportionate for the purposes of verifying age.
    • The importance of protecting children and their personal information, while also protecting the private sexual choices of adults.
    • Technical safeguards.
    • Effectiveness vs privacy intrusiveness.

APPENDICES:

ANNEX A: Excerpts from second reading and first meeting

CONSULTATIONS: V. Thomas (TA), A. Lévesque (Legal)

APPROVAL:

DISTRIBUTION: PRPA, TA, Legal

ANNEX A: Excerpts from Second Reading and First Committee Meeting

Debates at Second Reading Stage

During the debates at second reading stage, Senators made note of the forthcoming bill from the Minister of Canadian Heritage to create a regulatory body to fight against the exploitation of children and hate speech online, as well as the ongoing study by the Standing Committee on Access to Information, Privacy and Ethics (ETHI) on protecting privacy and reputation on platforms such as Pornhub.

Senator Cormier (ISG) also noted that “it will be interesting to see how this bill fits in with other government initiatives, such as Canada’s Digital Charter and Bill C-11, as well as the government’s commitment to introduce new regulations governing social media with respect to the removal of illegal content within 24 hours.”^{Footnote 20}

First Committee Meeting – April 21, 2021^{Footnote 21}

The Committee has only held one meeting to-date on this Bill. During the first meeting, the Committee heard from the Bill’s sponsor Senator Miville-Dechêne, who proposed that the Heritage Minister be in charge of implementation of S-203, given its interactions with Bill C-10 An Act to Amend the Broadcasting Act, and the forthcoming Heritage bill. She also proposes the regulator for enforcing sanctions could either be the CRTC or the proposed new regulator for the Heritage bill.

Some committee members appear convinced that technology (such as encryption) and enforcement will be enough to mitigate privacy risks related to the age-verification scheme. The following are other privacy and related issues mentioned during this meeting:

• One witness noted Canada’s obligation to support the UN Convention on the Rights of the Child.
• Age-verification could be done via government-issued documents or estimation using biometrics, and AI. It was argued that it would be a minor inconvenience, noting that paid porn sites already monitor their clients’ identities through the use of credit cards, and gambling sites already verify age.
• There are benefits even if age verification does not work perfectly. Adolescents may well be able to get around age verification pop-ups if they want to, but this will at least prevent accidental viewing which one witness notes happens quite often based on her experience working with youth.
• Third-party handling of personal information: technology allows ‘specialized companies’ to verify a client’s age in seconds while encrypting their data, give them a digital identity, and only inform the porn site that the person is over 18.
• ISPs restricting sites: S-203 would require ISPs to block certain sites which could raise questions about constitutionality and free speech etc., as seen in discussions related to online harms/content removal legislation.
• Algorithms that target youth: a concern was raised by one witness regarding algorithms ‘gleaned from data traces and inferred data’ that can be used to encourage youth interaction with sexually explicit internet material.