Virgil Cojocaru is a JD candidate at Osgoode Hall Law School.
The Privacy Commissioner of Canada, Ms. Jennifer Stoddart, in a letter to the Standing Committee on Public Safety and National Security concludes that the Investigative Powers for the 21st Century Act (Bill C-46) and the Technical Assistance for Law Enforcement in the 21st Century Act (Bill C-47) raise privacy concerns that cannot be overlooked.
Jennifer Stoddart argues that the two pieces of proposed legislation contain provisions that would increase access to personal information by law enforcement and intelligence agencies. Stuart Freen’s post on IP Osgoode explains these provisions in detail. For example, Bill C-46 would allow (through Internet Service Providers) the monitoring of frequented sites by a user and information exchanged using instant messaging software. Bill C-47 couples these broad, sweeping powers with the ability to override the judicial system. Under this proposed legislation, law enforcement agencies would have the ability to obtain names, addresses, and email addresses without a Court order. The Privacy Commissioner does not see these provisions as necessary, proportional, or effective.
Jennifer Stoddart’s primary concern lies with the necessity of overriding the current legal regime for judicial authorization to gain access to personal information. There are no examples domestically of why such measures are needed, nor is Canada bound to such standards internationally. One counterargument is that Bill C-46 and C-47 were introduced to bring Canada in line with the European Convention on Cybercrime. However, the proposed legislation goes beyond the powers envisaged in the convention.
Canada’s Privacy Commissioner further argues that the thresholds are not proportional. The new thresholds of evidence needed for obtaining personal information have been lowered from reasonable grounds to believe to reasonable grounds to suspect. This has not been done based on the type and gravity of offence, or limited to a specific urgency. Rather, it seems to apply across the board.
Review mechanisms would not be proportionate to the level of oversight required. Currently, the Courts serve as a vital measure for privacy protection by granting or refusing an order. However, it is the perceived slowness of the Courts that is loathed by law enforcement agencies. Still, removing the courts from the equation would require the establishment of an alternate monitoring mechanism. The Privacy Commissioner notes that Bill C-47 charges her office with this task. However, Ms. Jennifer Stoddart goes on to mention that this would require a significant infusion of resources, to give her department the capability to monitor the work of law enforcement across Canada. Even so, she goes on to say that her office would only be reactive to unlawful privacy breaches. Unlike the Courts today, it would not be in a position to prevent them from taking place.
Lastly, the Privacy Commissioner states that the public reporting for these two pieces of legislation is simply not up to par. For instance, under Bill C-47, reviews would take place internally and would not even be required annually. Given the fact that this is new, untested legislation, with the potential to affect the lives of every Canadian, such relaxed review measures are troubling indeed. Follow up reporting to the Privacy commissioner itself would be discretionary, as opposed to a stated regular requirement.
What is most troubling is the lack of a consultation process to see what Canadians think of Bill C-46 and C-47. Given the broad sweeping powers, disproportionate evidentiary threshold, and lack of effective review by cutting out the judiciary, this is strange. Also working against the passage and implementation of Bill C-46 and C-47 is the technical bottleneck faced by ISPs. Implementing such a monitoring system would require these service providers to have the ability to monitor and store increased amounts of data. Such capabilities would call for a substantial immediate investment. It would be cruel irony if such measures will end up being financed by the same consumers whose privacy rights they will subvert.