Bill S-4 (Historical)

Digital Privacy Act

An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act

This enactment amends the Personal Information Protection and Electronic Documents Act to, among other things,
(a) specify the elements of valid consent for the collection, use or disclosure of personal information;
(b) permit the disclosure of personal information without the knowledge or consent of an individual for the purposes of
(i) identifying an injured, ill or deceased individual and communicating with their next of kin,
(ii) preventing, detecting or suppressing fraud, or
(iii) protecting victims of financial abuse;
(c) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of an individual, personal information
(i) contained in witness statements related to insurance claims, or
(ii) produced by the individual in the course of their employment, business or profession;
(d) permit organizations, for certain purposes, to use and disclose, without the knowledge or consent of an individual, personal information related to prospective or completed business transactions;
(e) permit federal works, undertakings and businesses to collect, use and disclose personal information, without the knowledge or consent of an individual, to establish, manage or terminate their employment relationships with the individual;
(f) require organizations to notify certain individuals and organizations of certain breaches of security safeguards that create a real risk of significant harm and to report them to the Privacy Commissioner;
(g) require organizations to keep and maintain a record of every breach of security safeguards involving personal information under their control;
(h) create offences in relation to the contravention of certain obligations respecting breaches of security safeguards;
(i) extend the period within which a complainant may apply to the Federal Court for a hearing on matters related to their complaint;
(j) provide that the Privacy Commissioner may, in certain circumstances, enter into a compliance agreement with an organization to ensure compliance with Part 1 of the Act; and
(k) modify the information that the Privacy Commissioner may make public if he or she considers that it is in the public interest to do so.

[Michael Spratt, Member and Criminal Defence Counsel, Criminal Lawyers' Association]

Thank you. It's always a pleasure to be here.

As you may know, the Criminal Lawyers' Association is a not-for-profit organization comprising more than 1,100 criminal defence counsel from across Canada. One of our objectives is to educate not only our membership but also the public on issues relating to criminal and constitutional law. The CLA has routinely been consulted and invited by various parliamentary committees to share its views on proposed legislation pertaining to these issues. The CLA supports legislation that is fair, modest, constitutional, and supported by the evidence.

To cut to the chase, the CLA is simply unable to support Bill C-13. Quite simply, Bill C-13 is not only overly broad but is also likely unconstitutional.

Bill C-13 purports to be concerned with tackling cyberbullying by stopping the spread of intimate images that are disseminated without the subject's consent. The real tragedy of Bill C-13 is that those provisions are necessary, laudable, and should be proceeded with; however, in reality that aspect takes up only a small percentage of the bill. Bill C-13, in the balance, sacrifices privacy in favour of expanded police powers and liberal disclosure standards.

Bill C-13, along with Bill S-4 and Bill C-31, represents a dangerous and in our opinion unconstitutional pattern of erosion of privacy.

Let me speak of the cyberbullying provisions. They are important, are laudable, should be proceeded with, and are indeed necessary in the modern world that we live in. Largely, I don't have any objection to the small percentage of the bill that deals with those provisions.

Having said that, I would add that there is a legitimate argument that those provisions in and of themselves may be overly broad, in that the standard imposed for the mens rea is “recklessness”. That standard of recklessness may go too far, in that it may make individuals potentially liable who don't know or could not have found out the circumstances to which the images that are the subject of that provision relate. To that extent, the problem with the cyberbullying provision is not necessarily its aim but rather its execution in that one small regard.

The bill's aim is to punish those who transmit intimate photos sent to them, when the person who took those images has an expectation of privacy. That is likely to have significant public support, as it should; however, the scope of the provision is potentially overly broad, because it expands the mens rea element. By making “recklessness” one of the potential mens rea standards for that offence, the provision may catch not only the individual who was the original recipient of the image but also those down the line—the second-hand recipients of that image—who may have no knowledge of the circumstances in which that picture was taken or made.

Some caution comes from Don Stuart, a pre-eminent expert in the field of criminal law. As he points out in Canadian Criminal Law, the fifth edition, there is a risk that the recklessness standard can devolve into a far broader conception of fault than is desirable, and a more nuanced approach would involve defining recklessness as knowledge both of the risk and that that risk was likely.

That provision can be seen in other aspects of the code; for example, in item (a)(ii) of section 229, which deals with murder.

A modified recklessness standard in the cyberbullying provision would target the so-called “revenge porn” conduct, without drawing to the net those who simply pass on the photos without context and may not necessarily be as morally culpable.

If the provision is allowed to remain there without a clearer definition of recklessness, the section may attract some charter scrutiny. At that point, the issue would become one of over-breadth: does that section capture individuals who may not be morally blameworthy, but may nonetheless be captured under the recklessness standard? As I said, this is a minor issue with that aspect of the bill.

More troubling is the “lawful disclosure” aspect of Bill C-13. The bill announces itself as being about cyberbullying and protecting Canadians from online crime, but certainly it far exceeds those parameters.

I will start by saying that of course the most controversial aspects of Bill C-30 have been removed—the mandatory warrantless disclosure of basic subscriber information. However, there are still some serious concerns. I'll deal with two issues.

The first is that there is simply insufficient judicial oversight in obtaining those orders.

Now, the Supreme Court of Canada has recently considered the standard for reasonable suspicion, which is the standard we're dealing with in the legislation, in the case R. v. Chehil. The court made it crystal clear that the standard of reasonable suspicion falls well below the normal requirement of reasonable and probable grounds. That's the normal standard we usually deal with. Specifically, the Supreme Court said that the state's interest in detecting and preventing crime begins to prevail over the individual's interest in being left alone at the point where credible-based probability replaces suspicion.

The data, which is the subject matter of the searches contemplated in Bill C-13, contains a great deal of personal information. It's a misnomer to simply call it metadata. That dilutes the importance and impact of that data.

I understand that a pre-eminent expert in this area, Dr. Michael Geist, will be testifying at this committee later this week, and I think he will agree that metadata is deserving of an increased level of protection. And indeed he's not alone in that view. When we look at reports in 2013 from the Information and Privacy Commissioner of Ontario and the Office of the Privacy Commissioner of Canada, both reports reveal the heightened expectation and the intimate information that can be revealed through metadata. I would commend you to read those reports. It's quite shocking what can be discerned about an individual's communications and basic information about the individual through simply an IP address or some of the other metadata that's discussed.

Metadata as a starting point has a heightened expectation of privacy, and that is something that has been echoed by the Supreme Court, which agrees seemingly with Dr. Geist and with the privacy commissioners. In the recent case of Vu, which dealt with metadata found on a personal computer, the Supreme Court of Canada adopted the Criminal Lawyers' Association's submissions—we intervened in that case—finding that ordinarily this information, metadata, can help a user retrace his or her cybernetic steps. In the context of a criminal investigation, however, it can also enable investigators to access intimate details about a user's interests, habits, identities, drawing on a record that the user created unwittingly. Of course, in modern times there's a capacity to store, catalogue, and cross reference this information, revealing more and more.

The Supreme Court's comments about the heightened privacy inherent in this type of data is simply incompatible with the proposed reasonable suspicion standard that's found in Bill C-13. That incongruity exposes this proposed legislation to charter scrutiny, and in my opinion supports a conclusion that there's not only charter scrutiny here but indeed charter infirmity. There's simply no principled and justifiable reason that the new warrant provisions contained in Bill C-13 should not be based on the traditionally and judicially approved standard of reasonable and probably grounds.

Next, moving to the issue of the incentives for non-judicially supervised disclosure, Bill C-13 will also likely lead to an increased request for a telecommunications company to disclose information without court oversight and the corresponding protections. Privacy in this regard should be strengthened and not abandoned. Falling back on section 25 in the current Criminal Code is no answer to this problem. If you read section 25 carefully, you will see that section 25 requires reasonable grounds, and no comfort can be found in the appeal legislation as it offers no protection.

Of course as we see with that existing provision in Bill C-13, it broadens the scope of disclosure. No longer will the requesting organization be under an obligation to actually be enforcing or administering an act. The room for those requests is greatly increased. And indeed we see codification of the civil and criminal immunity which isn't in section 25, and as I said, section 25 requires reasonable grounds, which is completely absent in this section.

The real concern is that the expansion of police power and limiting liability for the party agreeing to disclose will result in increased police fishing expeditions, and of course we have seen from some reports some very alarming information about current practices in that regard.

Indeed, it would have been preferable to have discrete legislation on both the cyberbullying and on the lawful access legislation. However, given the current formulation of Bill C-13, the CLA recommends that the standards for obtaining those warrants be strengthened and brought in line with what the current Supreme Court case law would suggest is appropriate. No one wants to see evidence excluded. No one wants to get it wrong at the outset, and years later find out that the constitutionally suspect legislation was passed, evidence was excluded, and prosecutions were jeopardized because things weren't done right the first time. The provisions respecting the voluntary disclosure should be reconsidered to ensure both fairness, respect of privacy, and ultimately, constitutionality.

[James Moore, Conservative, Minister of Industry]

Thank you, Mr. Chairman.

Thank you, Mr. Chair.

Thank you for the opportunity to make this presentation before the committee today. I am joined by my Deputy Minister, John Knubley, as well as other individuals whose names you just mentioned.

I'm pleased to be able to speak to you today about much of the important work that our government is doing, and how we have delivered on what we've said was the top priority for Canadians in this session of Parliament, which of course is creating jobs and economic growth. This work begins building the groundwork for our economic future, which I believe is a digital future for Canada.

Last month, in Waterloo, I was pleased to launch Digital Canada 150, an ambitious plan for Canadians to take full advantage of the opportunities in the digital age. It's a plan that sets clear goals for a connected and competitive Canada by the time we celebrate our 150th birthday in 2017. Digital Canada 150 is based on submissions that were received by thousands of Canadians during consultations that were held all across the country. There are five pillars, 39 new initiatives, and one national plan for 35 million Canadians. It's a broad-based plan that will guide Canada's digital future, and I'll give you one example.

In Digital Canada 150, we connect over 280,000 households with access to high-speed Internet at five megabytes per second. That's fast enough to stream high-definition video, enable e-commerce, and connect Canadians with educational and career opportunities in all parts of this country. It's a bold plan when you consider that Canada is the second-largest country in the world in size, but 37th largest in population. To be able to tie us altogether with that digital infrastructure is something that I think we should all be very proud of.

Our plan is also based on and has been praised for its vision. Google Canada called Digital Canada 150 a plan that “will accelerate digital adoption and technological innovation among Canadian businesses, which is essential if we are to remain a global economic power.”

The Federation of Canadian Municipalities published the following statement:The rural businesses, communities and residents need sufficient bandwidth to participate in today's global economy and today's announcement is good news for Canadians in those regions.

Finally, OpenText, Canada's largest software company, called Digital Canada 150 “the foundation for a connected and competitive Canada”.

Of course, connecting Canadians also involves making the right decisions to ensure access to wireless spectrum. Canadian consumers increasingly rely on their iPhones, their iPads, their smart phones, tablets, and BlackBerrys, to stay connected with loved ones, to work, to organize their businesses, to organize their studies, and to use it for every aspect of everyday life.

In March, I announced the results of a 700-megahertz spectrum auction, which is the highest quality spectrum ever auctioned in Canada. A 700-megahertz spectrum travels longer distances, it requires fewer cell towers, penetrates building walls, elevators, and even through underground parking lots, which of course means better connectivity, fewer dropped calls, and more effective use of technology.

As you will no double remember, consumers were of course the big winners following the auction results. Ten Canadian companies, in over 100 rounds of bidding that lasted five weeks resulted in a total of 97 licences being awarded to eight Canadian companies. Quality wireless spectrum was acquired by Rogers, Telus, and Bell, with a fourth wireless player obtaining spectrum capacity in every region of Canada. The total revenue generated from this auction was $5.27 billion, proving the critics wrong and earning the greatest return ever for a wireless auction in Canada.

That was one of the many strategic decisions made by our government in the wireless sector in order to achieve a very clear objective—that of delivering more choice, lower prices and better service for Canadian consumers.

In pursuit of this goal to offer consumers more choice, lower prices, and better services, we have taken deliberate action on a number of fronts in the wireless sector.

First, we will not approve any spectrum transfer request that decreases competition in our wireless sector.

Second, we liberalized foreign investment rules in our telecommunications sector.

Third, we also believe that communities need to have more say in how cell tower locations are identified and how they move forward. That's why we introduced new rules to require wireless companies to share cell towers whenever they can, so that fewer towers are needed in our communities. We, of course, also mandated community consultation on all cell tower construction to ensure communities have a voice in how new cell towers are offered and introduced into their communities. The Federation of Canadian Municipalities welcomed this and joined me at my announcement. These changes are already making a real difference in communities all across the country.

We've also capped wholesale wireless roaming rates to promote greater competition. We've also empowered the CRTC to impose financial penalties on wireless carriers that don't play by the rules. In 2015, we will also be holding the 2,500-megahertz spectrum auction with rules specifically designed to benefit consumers, particularly those Canadians who live in rural communities.

Simply put, we are connecting Canadians like never before both with our broadband strategy and with our wireless policies. Of course, Canada's information and communications technology sector is one of Canada's key economic drivers, generating $155 billion in revenue each year, contributing over $67 billion to Canada's economy, and creating over 570,000 well-paying jobs all across this country.

To sustain these considerable contributions, our government is committed to ensuring our employees, students, researchers, and businesses all have the skills and opportunities that are necessary to succeed in our global economy.

Digital Canada 150 will invest $200 million to help small and medium-sized businesses adopt digital technologies. An additional $300 million will be invested in venture capital for digital companies.

Forty million dollars will be allocated to support 3,000 internships in high-demand fields. An additional $100 million will be provided in funding for the Canada Accelerator and Incubator Program. In total, $36 million will be earmarked for the Computers for Schools program, so that public libraries, not-for-profit organizations and aboriginal communities can be provided with the equipment students need to access the digital world.

Recently, I travelled to Silicon Valley, just south of San Jose and San Francisco, to discuss Canada's digital advantage with some of the world's leading technology companies, including Google, Twitter, Microsoft, and Facebook. There I hosted a digital innovation forum where I partnered with Canadian entrepreneurs to sell Canada as the Silicon Valley of the north. I was told first-hand how Canadian companies across Canada are leading digital technology innovation and positioning Canada as a top investment destination.

Mark Barrenechea, who's the CEO of OpenText, Canada's largest software company, put it this way. He said that they choose Canada because of the highly educated workforce, Canada's strong university partnerships, and our robust and innovative start-up communities. “The digital economy is the engine that will drive [Canada's] growth and prosperity. Technology and innovation is the fuel that will power this engine”.

Of course, our government understands that a strong digital economy requires strong protections for Canadians when they surf the web or shop online. In this Parliament, we've tabled the digital privacy act. Our digital privacy act will require organizations to inform consumers when their personal information has been lost or stolen. Companies that fail to do so, or deliberately break the rules, will face fines of up to $100,000.

The new measures also establish stronger rules to ensure that vulnerable Canadians, particularly children, fully understand the potential consequences of companies collecting and using their personal information.

The Digital Privacy Act will also vest in the privacy commissioner improved powers to take the necessary enforcement action and hold offenders accountable.

Before the bill was introduced, I met with the acting Privacy Commissioner, Chantal Bernier. I want to thank her for supporting the measures our government has implemented.

Here's what the Privacy Commissioner said about the digital privacy act. She said that “there are some very positive developments for the privacy rights of Canadians”, that she is “pleased” that the government has addressed issues such as breach notification, and that she welcomes the proposals in this bill. Of course, this committee will have an opportunity to study that legislation and offer suggestions on how the bill might be improved as we go forward.

On science, we are working on a renewed science and technology and innovation strategy, a long-term plan to position Canada as a globally recognized leader in research and business innovation. We're making record investments, as a country, in these areas to push the boundaries of knowledge, increase prosperity, and improve the quality of life of Canadians.

As a result, Canada leads the G-7 in research and development investments at universities, colleges, and in research institutions, and has one of the most educated populations in all the world. Canadians who witnessed the extraordinary success of Commander Chris Hadfield as commander of the International Space Station and his mission will know that Canada has an extremely proud history of accomplishment in space. We were the third country in the world to put our own research satellite into orbit and the first to have our own communications satellite.

Earlier this year I announced a new space policy for Canada, a framework that will guide our future in space. I was very pleased to have the support, I must say, of not only Commander Hadfield, and current and past astronauts, but also Marc Garneau, a colleague of ours in the House of Commons to whom we reached out prior to tabling this, who offered his support for our policy as well.

As we approach our 150th birthday in 2017, we want to ensure a strong and commercially competitive space industry that will continue to inspire Canadians for years to come, and of course, all the associated sciences.

Canada has a dynamic aerospace and space industry, which provides more than 170,000 individuals with highly paid positions, and it contributes over $27 billion a year to the Canadian economy.

The Aerospace Industries Association of Canada applauded our plan, saying that we have recognized the important role Canadian innovation and our proud heritage play in the space sector.

Chris Hadfield himself said, he's “glad to see the new Canadian government support for the space industry”, which will contribute to new jobs in the space economy.

On the auto sector, Mr. Chair, the auto industry is, of course, one of the cornerstones of the manufacturing sector of the Canadian economy. It contributes $16.1 billion annually to our economy, which represents about 10% of Canada's total manufacturing GDP. Our budget this year nearly tripled our investment in Canada's manufacturing sector, with an additional $500 million in support to Canada's automotive industry through the automotive innovation fund.

I'll give you an example of how this has worked thus far. Last year I announced a $72 million loan to transform Ford's Oakville assembly plant. Today that plant has the flexibility to produce 11 of Ford's high-volume, mid-sized vehicles, including the newly redesigned Ford Edge and the Lincoln MKX on one platform. This will make this plant one of only five Ford facilities capable of doing this work worldwide.

Sales have increased and are now 20% higher than they were during the recession. A recent report shows that our government is on the right track, with the Canadian manufacturing sector's revenue reaching almost $51 billion in the month of March—the highest it has been since 2008.

In conclusion, Mr. Chair, our government has promised Canadians that we would return to a balanced budget by 2015, and our government is working diligently to move forward with these measures and others to stand up for our consumers, to strengthen Canada's digital economy, and to boost our financial position through innovation and research. By focusing on these priorities that I've outlined here today, our government is delivering the results for Canadians, for which we asked the mandate to deliver on.

I would now be happy to answer any questions the committee members may have.

Thank you very much for your time.

I am looking forward to answering your questions.

[Peter MacKay, Conservative, Central Nova, NS]

My position is the consistent one, which is that I can only speak to legislation for which I have responsibility, particularly a bill like Bill S-4 that has not passed into law. But is there an interaction? Is there a causal connection? By all means.

[Sean Casey, Liberal, Charlottetown, PE]

The last time you came before committee, we were talking about Bill C-13. You and your officials were either reluctant or outright refused to talk about the interaction between Bill C-13 and Bill S-4. I trust that you've had an opportunity to review the testimony of a fellow Nova Scotian, David Fraser, on this topic.

Is it still your position, Mr. Minister, that there is no relationship between the bill that's presently before the Senate with respect to online privacy and Bill C-13, the so-called cyberbullying legislation?

[David Fraser]

The legislation is intimately connected. The three-quarters of this bill that we have in front of us relates to, in most cases, telecommunication service providers handing over information to the police and the circumstances under which the police can request it and demand it, and then this immunity that actually bestows on those telecommunication providers rights.

That's one-half of a coin, where the other half is regulated by PIPEDA, the Personal Information Protection and Electronic Documents Act. So you have two forces at play, and they are in fact intertwined. So hopefully, when Bill S-4 is being reviewed, they will, in fact.... Although, from what I understand, the minister and the justice officials were not willing to talk about that.

At every part of the PIPEDA review process, which Bill S-4 is the culmination of, Department of Justice lawyers were there acting on behalf of public safety and acting on behalf of others, particularly when it came to the provisions in subsection 7(3), and I would really hate.... Because they interlock together, if you look at this gear in isolation from that gear, you're not going to see how they actually play together, and that needs to be subject to some thorough discussion.

[Sean Casey, Liberal, Charlottetown, PE]

Thank you, Mr. Chair.

I want to go back to you, Mr. Fraser. On Thursday we had the minister and some officials come before the committee. They were either reticent or outright refused to talk about the relationship between Bill S-4 and Bill C-13.

Why should the minister, why should his officials, and why should we care about the relationship between Bill S-4 and Bill C-13?

[Paul Calandra, Conservative, Oak Ridges—Markham, ON]

I think it was the Privacy Commissioner who might have been in front of the Senate on Bill S-4.

I had a chance to look at her testimony, so I'm wondering if the analysts could maybe just forward a copy or a link to her testimony so we could review that.

If it's amenable to the committee, then, not right now, but we'll expand our witness list on identity theft and perhaps increase the study; I would even suggest more than four meetings.

So perhaps that is acceptable.

[David Fraser]

Thank you very much, and thanks for asking me those two particular questions.

In our Canadian criminal law, there are a number of circumstances where law enforcement agents can go to a justice of the peace or a judge and they have to satisfy whatever that burden of proof is in order to get some sort of compulsory instrument, which can be a wiretap order, or it could be a search warrant or a production order.

There are different thresholds for those. It generally depends upon the intrusiveness of the measure. Something like a search warrant to enter your house—for law enforcement agents to be authorized to, for example, break down your door—they have to have a very high standard of understanding. They're doing this on good information, very reliable information that they have reasonable grounds to believe—not just suspect, not just think—that a crime has been, is being, or will be committed and that the order is necessary in order to get that information.

In other sorts of compulsory processes, the standard is going to be lower on the understanding that the nature of the information being obtained is less intrusive. There's a difference between going into somebody's bedroom and going into their safety deposit box at a bank, for example. It recognizes that discretion.

What I was suggesting with respect to this transmission data recorder is to recognize that if it's fine, and the courts have upheld reasonable grounds to suspect, for telephony metadata, telephony signalling data, I don't think, because of the different nature of the information, that this reasonable grounds to suspect is appropriate.

As well, it might not actually survive court scrutiny because of the nature of the information that's being disclosed. It's never, in these sorts of circumstances, simply a matter of black and white. You end up in shades of grey.

The second question that you asked and I'm grateful for was the question related to immunity, and particularly you flagged the issue with respect to the charter. It takes two to tango in this sort of circumstance where the law enforcement officer would go to the telecommunications service provider and ask for the information. Under the Criminal Code, it's fine. Police can ask for anything; whether they're lawfully entitled to compel it, they can ask for anything from anybody. They're asking for the telecommunications service provider to voluntarily hand over that information.

The telecommunications service provider really doesn't care about the charter in terms of informing their decision-making. The charter applies to the police officers. It applies to whether or not the evidence that's gathered will be admissible in court, but the telecommunications company isn't involved.

So they're going to ask themselves a couple of questions. Am I legally able to hand this over? Am I legally prohibited from handing this over? And is there any civil liability that I could incur?

So one of the challenges we have is this. We don't have it in front of us, but Bill S-4 is going to amend PIPEDA, the Personal Information Protection and Electronic Documents Act, and in particular paragraph 7(3)(c.1), which is currently being reviewed by the Supreme Court of Canada with respect to whether or not, and under what circumstances, Internet service providers can hand over customer information on a non-warranted, non-judicially authorized request.

I understand that certain Canadian telecommunications companies do hand over that sort of information without a warrant. Their decision-making has been guided by the reading of an extremely ambiguous portion of that act, which allows a company—because we know the police can ask anything—to disclose information without consent to a law enforcement agency if they say—it's not under oath, it's not verified—that it relates to an investigation of a contravention of the laws of Canada or province, or a breach of an agreement, and they've identified their lawful authority to obtain the information.

So what the Supreme Court of Canada is considering is this question of lawful authority. Some telcos and police agencies take the view that simply policing duties is lawful authority to obtain the information. Others take the view that it's not sufficient. Lawful authority needs to be something else, something that is compulsory.

Some telcos err on the side of caution. Some err on the side of handing over information to the police agencies. But when they're asking themselves whether or not they should do that, in the background is also whether or not they could be sued for it. Handing over information where they're legally not compelled to, but there's a privacy law and a privacy interest at stake, could amount to something called an intrusion upon seclusion, which the Ontario Court of Appeal said you're entitled to damages for if that happens.

So I think what's happening here is that this provision has been put in here in order to make sure, in order to take that out of the equation—

[David Fraser, Partner, McInnes Cooper, As an Individual]

Thank you very much.

Thank you very much for providing me with the opportunity to speak with you and the committee today.

For the purposes of introduction, my name is David Fraser. I'm a partner with the Atlantic Canadian law firm McInnes Cooper, but I do need to emphasize that I'm here speaking as an individual. My comments and opinions shouldn't be attributed to my firm or its clients or other organizations with which I'm associated.

I've been practising Internet and privacy law for over a dozen years now. I've represented a range of clients over the years, including victims of cyberbullying, victims whose intimate images have been posted online, and I have represented and advised service providers.

Most notably, I was part of a team at my firm that took the case of a 15-year-old girl, a victim of cyberbullying, to the Supreme Court of Canada. This was the first time that the court had the opportunity to consider the phenomenon of cyberbullying, and the unanimous court came out very strongly to protect the interests of this victim of sexualized cyberbullying. But I've also advised people who have been accused of cyberbullying, and I hope that this experience from a number of different perspectives will provide this committee with some assistance in its very important task of considering Bill C-13.

First, looking at the bill as a whole, I'm disappointed that Bill C-13 combines two very different but related matters: the dissemination of intimate images on one hand, and law enforcement powers more generally on the other hand. Both aspects raise very important issues that merit close scrutiny, but we're seeing the debate about police powers as overshadowing the discussion about cyberbullying. That said, we do have one bill in front of us and I'm pleased to provide you with my thoughts.

It has been suggested that Bill C-13, if it had been enforced, could have saved Amanda Todd and Rehtaeh Parsons and other young people. That makes a good sound bite, but the world is much more complicated than that. The creation, possession, and dissemination of child pornography is and was a crime. So is the creation, possession, and dissemination of voyeurism images. So is extortion. So is criminal harassment. So is sexual assault. But that said, there is a gap that we should fill, which is the malicious dissemination of intimate images without the consent of the person depicted in them, regardless of the age of the person depicted in the image.

We need to be very careful about how we craft this offence, however. The current reality is that young people and adults, whether we like it not, take photos of themselves and voluntarily share them with intimate partners. Those digital images can easily be spread around without the consent of the person depicted. We want to criminalize the boyfriend who posts pictures of his ex-girlfriend online without her consent, the so-called revenge porn. We want to criminalize the actions of the person who forwards around images of current or former intimate partners. In each of those cases, the individual would know, or ought to have known, whether they had the consent of the person depicted in those images.

But we need to be cautious. We shouldn't inadvertently criminalize behaviour that's not blameworthy. Someone finds a picture online of someone naked—I understand there are pictures of naked people on the Internet—and forwards it to a friend. That person knows nothing about the circumstances in which the photo was taken. It could be a professional model. The photo could have been posted by the person in the photo herself. There's no way to tell whether consent was obtained, whether there was any expectation of privacy at the time that the image was created, and the individual, in this case the accused, would have no way of determining this, would have no way of contacting the person in the image to find out. So the real challenge arises when addressing third parties who do not know the person depicted in the image, nor do they have knowledge of those circumstances in order to figure it out.

The provisions in the bill use a recklessness standard, which in my view is too low. Recklessness applies where a person should have looked into it but decided to be wilfully blind. However, given the huge number of images online, it's not possible to look into it. This is especially important for online service providers, who have no way of knowing and no way of finding out the circumstances under which an image was taken or uploaded. We need to be especially attentive to crafting the law so that it will survive a challenge in the courts, and recklessness poses a risk of having a law struck down or making criminals out of people who are not truly blameworthy.

Turning now to the part of the bill related to police powers, the first one that I'd like to speak about is transmission data. Bill C-13 creates a production order for transmission data and warrants for transmission data recorders. It has been said that the purpose of the transmission data provisions of the bill is to extend the current police powers—which are coupled with judicial oversight, I'm very pleased to see—related to telephone information and move that over to the Internet age, the idea being without significantly altering the status quo, simply altering or modernizing what's already an existing police power.

While this may be a very reasonable objective, this must be done also very carefully, because transmission data in the Internet age is very different from transmission data in the traditional plain old telephone system. With conventional telephony, transmission data refers to the number called from, the number called to, whether the call was connected, and how long that call lasted.

In the Internet context, the amount of information that's included in the kind of out-of-band signalling information and what it reveals is dramatically different. It would include the IP address of the originating computer, the destination computer, information about the browser that's being used, information about the computer that's being used, information about the URL, the address being accessed, which can actually disclose content, even though the definition of transmission data is intended to exclude that.

It will also tell you what kind of communications are being done. Is it an e-mail communication? Is it an instant message? Is it peer-to-peer file sharing or otherwise? So it provides much more insight into actually what is going on than just phone number information.

An interception of transmission data would tell law enforcement agencies whether the target of surveillance was visiting a search engine, an encyclopedia site, a poker site, or a medical site. Furthermore, the data would provide greater insight into the likely physical location of the surveillance target. This is a dramatic expansion of the information that's provided and available, compared to traditional telephone communications.

As anybody in this room knows, I expect, the way we use computers today is dramatically different from the way we used telephones 15 years ago. We use them as spellcheckers. We use them to find out facts. We use them for a much wider range of activities. With the disclosure of greater information through these transmission data orders, you're revealing much more about an individual. Even though the definition excludes content, just the transmission data tells you a lot more about really what's going on.

I would suggest this can be fixed by either raising the standard from reasonable grounds to suspect to reasonable grounds to believe with respect to this data, or re-crafting the definition of transmission data, so we're sure that we are, in fact, paralleling what is intended, which is to take the telephony tool and move that into the modern Internet age.

I would also note that in all of these orders—again, I'm pleased that they're subject to judicial oversight and judicial approval—there is no mechanism in these for notifying the individual after the fact that their information has been accessed, which I think is something that happens with respect to wiretap orders. Certainly it happens with respect to search warrants. I believe that should be extended into this environment as well for these sorts of production orders.

Finally, I would touch very briefly on the issue of service provider immunity that's touched on within this statute. I find this to be gravely problematic. I think it's a very cleverly crafted provision. We're told that this is simply for greater certainty, but it goes beyond that. Everything we know suggests otherwise.

It says that you will not be liable for handing over any data that you're not prohibited by law from handing over, and if you do so you're civilly immune. Now, only the criminal law and other regulations create prohibitions against handing over information, but you can hand over information when you're not legally prohibited and still incur civil liability. Civil liability is there for a reason. I may not be legally prohibited from accidentally driving my car into yours, but if I do that, you're entitled to damages from that. I should be paying for the harm that is caused.

If there were an immunity provision that said you could not sue me if I did something that was not legally prohibited, that would be squelched. That would go away. So this provision, I believe, should be removed. It can't be fixed and will only encourage overreaching by law enforcement.

In conclusion, while we don't have Bill S-4, the digital privacy act, in front of us, that fits together with the immunity provisions. I'm concerned that the two taken together will extend the amount of information not only available to law enforcement but will extend the information available to other civil litigants and others. Although I understand it's not within the jurisdiction of this committee, I flag the fact that Bill C-13 and Bill S-4 do, in fact, fit together, and somebody should look at that interrelationship.

Thank you very much for this opportunity to speak with you today. The cyberbullying provisions are an important step forward and will, if properly tweaked, address this very serious problem. The rest of the bill needs to be very closely examined to ensure that it does what it is supposed to do and nothing more. It should be about providing the police with appropriate tools, with adequate thresholds and accountability, and judicial oversight, but not redrawing the line with respect to personal privacy.

I very much look forward to discussing this issue with you further. Thank you.

Safeguarding of Personal Information

[Françoise Boivin, NDP, Gatineau, QC]

Mr. Speaker, I am pleased to conclude the debate on the opposition motion.

I will read the motion, because after hearing such garbage today, I was beginning to think that I was not talking about the right one. This is what the motion, moved by the hon. member for Terrebonne—Blainville, is asking of the House:

That, in the opinion of the House, the government should follow the advice of the Privacy Commissioner and make public the number of warrantless disclosures made by telecommunications companies at the request of federal departments and agencies; and immediately close the loophole that has allowed the indiscriminate disclosure of the personal information of law-abiding Canadians without a warrant.

I cannot believe that today, May 5, 2014, the Conservatives are going to vote against this motion. It is absolutely incredible. We heard all sorts of drama from the Conservatives about extremely important security issues. They shifted the debate from the opposition motion, which simply calls on the government to grant the Privacy Commissioner's request and make certain information public. It seems quite reasonable to me.

Today is the best possible day to be in the House. This morning, we debated Bill C-567, which was introduced by my colleague from Winnipeg Centre and is all about access to information. This motion is completely justified in light of the context, but they are saying all kinds of things.

I would like to comment on a question that my colleague from Timmins—James Bay asked the last Conservative member who spoke. That member laughed in his face even though the question was completely relevant. It was about peace officers, not as the local paper defines them, but as the Criminal Code defines them.

I would like to give my colleagues opposite a little lesson about the Criminal Code. It is important to define the notion of “peace officer” accurately, because Bill C-13, the government's supposed cyberbullying bill, refers to that notion. That bill is about much more than cyberbullying and the distribution of intimate images.

According to section 2 of the Criminal Code, a peace officer includes:

(a) a mayor, warden, reeve, sheriff, deputy sheriff, sheriff’s officer and justice of the peace,

(b) a member of the Correctional Service of Canada who is designated as a peace officer pursuant to Part I of the Corrections and Conditional Release Act, and a warden, deputy warden, instructor, keeper, jailer, guard and any other officer or permanent employee of a prison other than a penitentiary as defined in Part I of the Corrections and Conditional Release Act,

(c) a police officer, police constable, bailiff, constable, or other person employed for the preservation and maintenance of the public peace or for the service or execution of civil process,

(c.1) a designated officer as defined in section 2 of the Integrated Cross-border Law Enforcement Operations Act, when

(i) participating in an integrated cross-border operation, as defined in section 2 of that Act, or

(ii) engaging in an activity incidental to such an operation, including travel for the purpose of participating in the operation and appearances in court arising from the operation,

(d) an officer within the meaning of the Customs Act [or] the Excise Act...or a person having the powers of such an officer...

I could keep reading this definition until 6:15 p.m. It is not so far-fetched for my colleague from Timmins—James Bay to suggest that Mayor Ford could request certain information.

What is more, the NDP has been heavily criticized today for some of its requests. However, in La Presse this morning, there was an article by Joël-Denis Bellavance on the information we are looking for with the official opposition motion moved by my colleague from Terrebonne—Blainville. Mr. Bellavance reported that the Privy Council Office also made a request of all its departments. The PCO wanted to know who these people were who made 1.2 million requests for information about Canadians. There are 1.2 million Canadians who are allegedly affected by these requests.

All day, the Conservatives have been telling us that this is terrible, that what we are asking for is scary and that the NDP does not know what it is talking about.

I even heard one of the ministers of state, a junior minister over there, say the times have changed.

I think we all know that. Information circulates quickly, I agree. Regardless of the fact that times have changed, there are still laws that apply in this country.

We all know that this Conservative government likes to intrude on Canadian taxpayers' privacy and could not care less about almost every law around. When this government gets caught, it takes a holier than thou stance or it suddenly takes a few strategic steps backward and comes back with what I like to call the Trojan Horse tactic. In other words, it disguises its approach in another way.

Everyone in the House remembers Bill C-30, introduced by my favourite minister, the former minister of public safety. I was going to say something unkind, but I will be careful. Thank God the public woke up and made a concerted effort to ensure that the government backed down. This goes to show that ridicule never killed anyone. However, sometimes it kills political careers, even though politicians will often end up becoming a judge somewhere. Everyone kept telling the former public safety minister what he was in the process of doing. They ridiculed his bill. Sometimes that is what it takes with this government.

Their concerns were heard. The Conservatives withdrew the bill and suddenly we had Bill S-4 and Bill C-13, which deals with cyberbullying. Who in the House would not want to protect victims? Who would not want to say at some point that we passed legislation after a number of young people committed suicide as a result of bullying? That is rather disgusting, although there are other unparliamentary words that could be used. It is problematic to rise in the House and say that, on the contrary, we are in favour of cyberbullying. However, once again, the Conservatives introduced five or six pages of text that were more or less accurate and then combined them with tons of provisions that amend all sorts of legislation.

Fortunately, the Minister of Justice told me that he would give the Standing Committee on Justice and Human Rights the time needed to examine those provisions. Perhaps we, the members of that committee, are not the best people to examine those provisions. Fortunately, we will be hearing from many experts.

I still believe that the motion that I moved at the beginning of the debate on Bill C-13 made complete sense. I proposed dividing the bill in two so that that we could do what we do best: examine the provisions of the Criminal Code and make sure that the new provisions regarding the distribution of intimate images fall within the parameters and meet the test of the Criminal Code.

Instead, we are going to be spending a lot of our time looking at the aspects of the bill dealing with privacy and how certain telecommunications providers will be able to disclose information without a warrant, or with a warrant but with a lighter burden of proof, and so on.

Unfortunately, since the beginning, this government has shown us that it has no credibility. Every week, there is a new drama featuring one of the people sitting in the front benches. At the end of last week—and it has continued into this week—it was the Prime Minister and his serious insinuations. Sometimes, not saying enough is the same as saying too much. He attacked the Chief Justice of the Supreme Court of Canada.

Members on the Conservative benches are wondering why we do not trust them. Why are we suspicious when we get bills like Bill S-4 or Bill C-13? We are wondering what is behind those bills.

People have been debating this motion all day in the House. I repeat that it does not get any simpler than this motion, which calls on the government to follow the advice of the Privacy Commissioner. Who does not want to follow that advice? Who is against making public the number of disclosures, when even the Prime Minister's Office is quietly checking into this matter? The Conservatives are simply afraid of doing things. They want public information on our constituents, on Canadian taxpayers, but they do not want anyone other than themselves to have access to that information.

That is why the government does so much behind closed doors. The representatives of the people, here in the House, certainly have a right to know. We are getting questions as well. I hear from people, and I am sure that my colleagues in the House, even on the Conservative side, are hearing from people. I am shocked to see that many of these people, from the Reform Party of Canada and the Canadian Alliance, who made a point of calling themselves the voice of the people, are now the biggest puppets, sitting in their seats, terrified to rise and say that this makes absolutely no sense.

At some point we need to wake up and go back to our ridings to talk to our constituents, who are asking what is going on with their information, who has access to this information, when and why. Are there 1.2 million criminals somewhere in Canada? Is it because we have relaxed our rules so much that everyone—ISPs, telecommunications companies and others—feels justified in passing on information? The companies know that they will go unpunished if they freely share information on anything. That is dangerous.

Some people here in the House say that times have changed. That is true. I can do research. In fact, I do not claim to know all the sections of the Criminal Code, and I was able to find the section on the concept of peace officer right away, in two seconds. It was actually quicker than that as I think it took me one-tenth of a second to find the definition in the Criminal Code. Sometimes I tell young people or future lawyers that they are lucky because, in my day—I do not like to say this because it dates me, but it is a fact—when I did my research, I had to go to the law faculty library and open maybe 18 books before formulating an idea. Now, we just click on a button.

However, just because information travels at astronomical speeds, it does not mean that the privacy guarantees and protections granted to all Canadians under the Charter of Rights and Freedoms must be trampled by a government that does not care about protecting its citizens.

[Colin Carrie, Conservative, Parliamentary Secretary to the Minister of the Environment]

Mr. Speaker, our government is committed to promoting the interests of Canadian consumers and the protection of their private information.

In an increasingly digital world, it is important that we have strong privacy protections in place to ensure organizations are treating the private information of Canadians appropriately. Many of these protections are already found in the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA.

However, a lot has changed in the more than 13 years since PIPEDA came into effect. Our government is taking important steps to ensure organizations are accountable for how they handle the personal information of their clients and customers in today's digital world.

That is why on April 8, we tabled Bill S-4, the digital privacy act. The bill introduces new measures to update our private sector privacy legislation, which sets out specific rules that businesses and organizations must follow whenever Canadians' personal information is lost or stolen.

Recently, we have seen a disturbing example of this problem south of the border with Target Corporation. Just before Christmas last year, Target learned that malicious software had been installed on the company's computer systems, allowing the personal information of some 70 million customers to be stolen, including 40 million payment card records.

It is because of situations like these that we must continue to ensure Canadians' personal information is safe. Data breaches can happen in many different ways and to any type of organization, large or small. Data breaches can result from improper disposal, for example, of paper documents sent for recycling instead of shredding or computers resold without scrubbing hard drives clean, or it can be stolen through sophisticated cyber attacks like those experienced by Target.

Unfortunately, this is a growing problem. Last year saw an all-time high for the number of data records lost or stolen worldwide. The Verizon data breach investigations report estimated that in 2012 between 575 million and 822 million records were compromised in data breaches.

We know that cybercrime is a growing problem in Canada. Last October a study reported that cybercrime cost Canadians some $3 billion over 12 months, up from $1.4 billion the previous year.

That is why our government has already put a number of significant measures in place to combat cybercrime and protect our digital infrastructure, such as Canada's cyber security strategy. In addition to this, Canada's anti-spam law will begin to come into force July 1, later this year. This law will help Canadians deal with unwanted commercial emails, and will also protect Canadians from cyber threats, like malware and fraudulent websites that seek to steal their personal information.

These measures are significant, but more is needed. We must ensure organizations have strong incentives in place to implement strong data security. Currently in PIPEDA there is no obligation for businesses and organizations to inform customers and clients when their personal information has been lost or stolen. This means if a company loses people's credit card information, that company is not obligated to tell them. With the digital privacy act, our government is proposing to correct this.

Stolen data can be used to create false identities that are used in criminal activities. They can be used to hack onto online banking services. In the wrong hands, lost or stolen health information, employee records, even criminal records can create countless problems to those who have had their personal information compromised.

I also want to state, Mr. Speaker, that I will be splitting my time with the member for Desnethé—Missinippi—Churchill River.

We believe it is up to all organizations to put in place the safeguards to protect the personal data they have collected from their clients and customers. This is a responsibility that most take very seriously. However, with the changes we have proposed, if a company has its computer systems hacked and believes personal information has been stolen or if that information has been lost inadvertently, the company will need to take a number of steps.

If the company determines that the breach poses a risk or harm to individuals, it will need to notify the Canadians affected and make a report to the Privacy Commissioner of Canada. Organizations will also be required to document and keep a record of the event, including the result of its risk assessment. This would be required for every breach, even if the company did not think the breach was harmful. The organization would have to provide these records to the commissioner upon request, providing oversight and holding organizations accountable.

Let me provide an example. Say that an organization determines that a laptop containing customer personal information has been lost. It will be required to make a record of this loss. If the breach involves unencrypted sensitive personal information such as credit card numbers, other financial or health information, for example, it would pose a real risk and potential significant harm to those involved. As a result, the organization would be required by law to notify the customers who were impacted.

The company would be not only required to tell customers when it lost information, it would also be required to report the loss to the Privacy Commissioner. The commissioner may then request a copy of the company's records to see if there is a history of similar losses that would be a cause for concern. The Privacy Commissioner would then have the option of opening an investigation into the matter.

It should be clear to all members in the House that implementing a requirement for mandatory data breach notification is a significant improvement to our private sector privacy laws. Our government believes there needs to be serious consequences for any organization that deliberately breaks the rules and intentionally attempts to cover up data breach. The changes that our government has proposed will also make covering up a data breach an offence. In cases of deliberate wrongdoing, an organization could face fines of up to $100,000. To be clear, it will be a separate offence for every person and organization that is deliberately not notified of a potential harmful data breach and each offence will be subject to a maximum $100,000 fine.

The digital privacy act would address the concerns posed by data breaches and has received good reception so far. In fact, the Privacy Commissioner commented that she welcomed the proposals in this bill. She said that it contained very positive developments for the privacy rights of Canadians. Even the member opposite for Terrebonne—Blainville said, “We have been pushing for these measures and I'm happy to see them introduced. Overall, these are good...steps”.

Our government has taken a balanced approach to the responsibilities placed on businesses and organizations, while protecting Canadian consumers by giving individuals the information they need to protect themselves when their information has been lost or stolen. The digital privacy act demonstrates our government's commitment to providing Canadians with the confidence that their privacy and personal information are protected.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, I listened with great interest to my hon. colleague.

It has been fascinating listening to the Conservatives, because in their upside-down world, they are opening the door to widespread snooping and spying on Canadians but are somehow protecting their privacy.

I ask my hon. colleague about what we are reading in the National Post about the government's supposed fix, Bill C-13. We have been hearing from their tough-on-crime guys. It is all about the police investigation and the importance of investigation. We need to be able to investigate and go after the crooks, the perverts, and the crazy terrorists. However, under Bill C-13, the Conservatives' fix would take out the provision, the caveat, that enforcement agencies would actually have to be doing an investigation. It would no longer be for investigating crime but for anything that would help in “administering any law in Canada”.

It is the ultimate free ride for fishing expeditions, not just for law enforcement but for corporations. Under Bill S-4, corporations could demand information on our Internet use, as could public officers, which include, if we look up the definition, reeves, mayors, and even people who work for the Department of Fisheries, fisheries officers.

I would like to ask my hon. colleague why he thinks the government is so intent on changing the law to allow widespread snooping. Is it possibly because this is what the standard practice has become under the Conservatives' watch?

[Matthew Kellway, NDP, Beaches—East York, ON]

Mr. Speaker, I am very pleased to stand in the House this afternoon in support of the motion by my colleague, the MP for Terrebonne—Blainville, on this great opposition day.

It is a day in the House to be talking about privacy issues. This morning I had the privilege of speaking in support of Bill C-567, an act to amend the Access to Information Act (transparency and duty to document), put forward by my colleague from Winnipeg Centre.

This morning's bill and this afternoon's motion complement each other very well. Together they demonstrate to Canadians our NDP desire that it be the citizens of this country, not the government of this country, who are able to conduct their lives with a reasonable expectation of privacy and that it be the government of this country, not its citizens, that has the obligation to operate in a manner that is transparent, open, and accountable.

If there is a simple conclusion to draw from the sum of the whole day, it is that the current Conservative government has it backwards, upside down, and twisted all around. The Conservatives stand in support of government privacy, of, in fact, the necessity to operate free from the scrutiny of the citizenry of Canada and those they elect to hold the government accountable.

How, the Conservatives ask in response to Bill C-567, can they operate at once openly and honestly? If they are to tell the truth, it must be behind the curtain, they argue, in the dark, out of earshot, and away from the gaze of the public and opposition members of this place. On the other hand, they demonstrate no mere disregard of the privacy rights of Canadian citizens. They demonstrate an appetite, a voracious, seemingly insatiable appetite, for the private information of Canadians.

Much is made of the fact that we live in new and different times, with new forms of information and new means of accessing that information. There is truth, of course, to this, undeniably. I think all of us are alive to the ease with which information we consider private is accessible to those who want to put some effort, and not much is required, into accessing it. Our expectation of privacy is diminished as a result, simply because we know the ease with which we are vulnerable. Therefore, we see the narrative here being one of the need to modernize our laws to take these new circumstances into account. That does not account for the conduct of the current government.

The problem before us is not simply one of a government that has not come up to speed, that has failed to respond in a timely way to these new circumstances, and that has left exposed loopholes in the formulation of the laws of this country. That would paint a picture of an incompetent or slow, but certainly benign, government. No, the current Conservative government is anything but benign.

Confronted with a loophole for accessing the private information of Canadians, a benign government may simply fail to close that loophole. The current government lets through that loophole, fully, completely, and head first, with great enthusiasm and an obvious lust for what it might find on the other side. What we have before us is evidence of this lust.

Very recently, the Privacy Commissioner of Canada, Chantal Bernier, revealed that Canadian telecom companies disclosed massive volumes of information to government agencies, including the Royal Canadian Mounted Police, the Canadian Security Intelligence Service, Canada Border Services Agency, and provincial and municipal authorities.

Telecom companies disclosed personal data to the Canadian government 1.2 million times in a single year. We can of course concede that a balance is to be found between privacy rights, public security, and other concerns, including immediate danger to life. However, this can be nothing other than an indiscriminate fishing expedition of monumental proportions that the Privacy Commissioner has revealed to us.

These volumes equate to information requests with respect to one in every 34 or so Canadians. The vast majority of these requests are made without warrants. These volumes equate to a request for personal data, by the federal government to a telecom company, once every 27 seconds.

So great is the volume of information requests that one telecom company has advised that it has installed what it calls “a mirror” on its network so that it can send raw data traffic directly to federal authorities. Michael Geist, a digital law professor at the University of Ottawa, says this of what is happening:

This is happening on a massive scale and rather than the government taking a step back and asking is this appropriate...we instead have a government going in exactly the opposite direction—in a sense doubling down on these disclosures

It is easy to find further evidence of this doubling down, of this appetite for private information. One cannot help but note that Bill C-13, which is purportedly about cyberbullying, is more about lowering the bar on government access to information. The “reason to believe” standard is being replaced with a “reason to suspect” standard, opening up much greater warrantless access to electronic information. Moreover, Bill C-13 would allow a broader and lower range of government officials to have access to the private information of Canadians.

Bill S-4 will also be coming before this House, we suspect. That bill would permit non-governmental organizations and corporations to have access to information from telecom companies. FATCA, the Foreign Account Tax Compliance Act, buried deep in the budget bill, would expose the financial information of about one million Canadians to the U.S. government, and so on.

In light of all of this, one could argue that there is a kind of naiveté to the motion I speak in support of today. Certainly the first part of the motion is easy enough. It is, in fact, all the Privacy Commissioner has requested. She has said:

I'm not disputing that there are times when there is no time to get a warrant—life is in danger....

What we would like is for those warrantless disclosures to simply be represented in statistics so that Canadians have an idea of the scope of the phenomenon.

...It would give a form of oversight by empowering citizens to see what the scope of the phenomenon is.

It is a modest enough proposal: at least let me see what it is the federal government is doing here.

However, we are also asking the government to close the loophole that has allowed the indiscriminate disclosure of the personal information of law-abiding Canadians without warrants. In so doing, we must recognize that we are asking the predator to restrain itself, to bind itself, to limit its own appetite for our private information, to guard itself. It has no such impulse, no such sense of constraint, as is obvious from the 1.2 million requests, by Bill C-13, by Bill S-4, and by FATCA.

Here is the very saddest part of this. As we engage with each other through the technologies of this modern world, we do so with some trepidation about how exposed we are to the prying eyes and interests of others, and part of what we need to be concerned about now, we find out, are the prying eyes and interests of our own government. Rather than being able to rely on our own government to support us and to protect our privacy in this modern world, it appears that our government is itself a cause for concern.

[Don Davies, NDP, Vancouver Kingsway, BC]

Mr. Speaker, it is a pleasure to stand in support of the official opposition New Democratic motion introduced by our superb colleague, the member for Terrebonne—Blainville. I should point out that I will be sharing my time with my hon. colleague, the equally commendable member for Beaches—East York.

The motion before the House today reads as follows:

That, in the opinion of the House, the government should follow the advice of the Privacy Commissioner and make public the number of warrantless disclosures made by telecommunications companies at the request of federal departments and agencies; and immediately close the loophole that has allowed the indiscriminate disclosure of the personal information of law-abiding Canadians without a warrant.

If we think about those words, and I know Canadians will think about the text of the motion, who could possibly not support this? Who could possibly oppose a motion of the House of Commons in Canada that the government should simply tell the public how many warrantless disclosures are made by telecommunications companies at the federal government's request and close a loophole that allows the indiscriminate disclosure, meaning the improper disclosure, of personal information of law-abiding Canadians without a warrant?

I would have thought that every member of the House would stand in support of such a motion, a motion that preserves and protects the very elementary privacy rights and expectations of Canadians everywhere, but that is not the case, because Conservatives in the House do not support the motion.

I am going to talk about how the motion came to be.

In summary, the motion addresses what we now have learned are rampant requests to telecommunications companies in Canada by various government agencies for Canadians' private information, often—in fact, normally and mostly—without a warrant.

We are calling on the government to listen to the Privacy Commissioner, an independent officer of the House, to make public the number of requests disclosed by these companies, and to tighten the rules that allow it to happen.

This came out of an access to information request that determined that at least one Canadian telecom was giving the government unrestricted access to communications on its network, according to documents from Canada's Privacy Commissioner. The documents were obtained by University of Ottawa digital law Professor Michael Geist. He cited at that time an unnamed telecom firm as saying that it had allowed the government to essentially copy the communications data moving on its networks.

I quote Mr. Geist:

Interception of communications over data networks is accomplished by sending what is essentially a mirror image of the packet data as it transits to network of data nodes.

Then the Privacy Commissioner's document states:

This packet data is then sent directly to the agency who has obtained lawful access to the information. Deep packet inspection is then performed by the law enforcement agency for their purposes.

“Deep packet inspection” is a method of analyzing Internet traffic to determine the exact type of content. It can distinguish between emails, file-sharing and other types of internet communication, and can be used to build statistics about an internet user.

This statement appears in the document prepared by the law firm Gowling Lafleur Henderson for the Privacy Commissioner. It summarizes nine telecom firms' responses to questions about law enforcement access posed by the commissioner.

Mr. Geist called this “an incredible admission”.

He asks:

Are there legal grounds for these disclosures? Who is doing this?

He goes on to say later:

Given the uncertainty of the enormous privacy implications, the Privacy Commissioner of Canada is surely entitled to investigate this admission using her current powers under PIPEDA.

Documents subsequently released by the interim Privacy Commissioner, Chantal Bernier, revealed that the government made about 1.2 million requests for subscriber data about Canadians from Canadian telecoms in 2011 alone. Mr. Geist calculates that it works out to one request every 27 seconds, and the Privacy Commissioner's report showed that telecom firms complied with the requests at least 784,000 times.

This issue engages one of the most important values that mark our nation. It is a value that marks our democracy. It is cherished by Canadians, valued by Canadians, and expected by Canadians. That is the value of privacy.

The government exists to protect its citizens. It exists to safeguard our rights, our interests, and our opportunities, so when the government is actually found to be the source of secret requests to private firms to try to get private information about Canadians without their knowledge and without ever appearing before a judge in a court to demonstrate that the government has any lawful interest in that information, in my view that is a violation of the most fundamental precept and obligation of the government. That is what is happening under the watch of the Conservative government.

I want to go through a few facts here. Canadian telecommunications providers collect massive amounts of data about their subscribers. These are the firms that have been asked by the government's agencies to disclose that information to law enforcement agencies. In 2011, providers responded to almost 1.2 million requests, but the actual total is likely even greater, since only three of nine telecom companies told the commissioner's office how many times they granted the government's request for customer data.

In 2010, RCMP data showed that 94% of requests involving customer name and address information was provided voluntarily, without a warrant. The Canada Border Services Agency obtained customer data from telecom companies 19,000 times in one year, and it obtained a warrant in fewer than 200 of those cases. Significantly, one Canadian company has told officials that it has installed “what is essentially a mirror” on its network so that it can send raw data traffic directly to “federal authorities”.

The Privacy Act, which is meant to protect Canadians' privacy and keep the government accountable, has not been updated since 1983, before the Internet, Google, email, Facebook, and Twitter were even invented. PIPEDA, which protects Canadians' privacy in the private sector, has not been updated since 2000. Once again, that is before Facebook, Twitter, and social media had really taken off in our country.

I would think that if the government is really concerned about the values of privacy and protecting Canadians' rights, it would spend time in this place modernizing those acts and doing so in a way that is consistent with Canadians' expectations. Instead, it is doing the opposite. It has introduced Bill C-13, a bill that is expressed to be aimed at attacking cyberbullying, but which is expected to expand warrantless disclosures of Internet or cellular subscriber information to law enforcement.

Bill S-4, the digital privacy act, has been introduced in the Senate. It would also extend the authority to disclose subscriber information without a warrant to private organizations, and not just law enforcement agencies. It would also allow telecom companies to disclose the personal information of consumers without their consent and without a court order to any organization investigating a contractual breach or possible violation of a law.

There are many validators of the New Democratic position. New Democrats think privacy laws should be modernized and strengthened to better protect Canadians' personal information, not weakened. New Democrats believe that we can and should aggressively pursue criminals and punish them to the full extent of the law without treating law-abiding Canadians like criminals and violating their rights.

Privacy is something that must be judiciously and carefully guarded by every generation. We have people as diverse as Benjamin Franklin, who said that those who would give up liberty for a little security deserve neither. We have organizations as diverse as the Council of Canadians and the Canadian Taxpayers Federation, who are joining together in their concern about the issue of violations of privacy and surveillance of Canadians' private interests on the Internet by the government.

I say that what Canadians want of their federal government is for it to protect their privacy interests, not be complicit in violating them.

For the Conservative government to allow 1.2 million requests to go to telecoms for Canadians' personal information without their consent, without their knowledge, and without a court order is something that every Canadian in this land would disapprove of.

I ask all of my colleagues in the House to vote for this well-thought-out motion.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I would like to point out one thing. We are not debating Bill S-4 right now. We are debating the opposition motion moved by the NDP, which specifically calls for transparency measures when it comes to the 1.2 million instances of disclosure of personal information. We are also asking that the government close the loophole in the legislation.

This really has nothing to do with Bill S-4. I am certain that we will have the opportunity to debate the bill and I will be pleased to participate in that debate, but now is not the time to do that.