This bill is from the 41st Parliament, 2nd session, which ended in August 2015.
This bill has received Royal Assent and is now law.
This is from the published bill. The Library of Parliament has also written a full legislative summary of the bill.
This enactment amends the Personal Information Protection and Electronic Documents Act to, among other things,
(a) specify the elements of valid consent for the collection, use or disclosure of personal information;
(b) permit the disclosure of personal information without the knowledge or consent of an individual for the purposes of
(i) identifying an injured, ill or deceased individual and communicating with their next of kin,
(ii) preventing, detecting or suppressing fraud, or
(iii) protecting victims of financial abuse;
(c) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of an individual, personal information
(i) contained in witness statements related to insurance claims, or
(ii) produced by the individual in the course of their employment, business or profession;
(d) permit organizations, for certain purposes, to use and disclose, without the knowledge or consent of an individual, personal information related to prospective or completed business transactions;
(e) permit federal works, undertakings and businesses to collect, use and disclose personal information, without the knowledge or consent of an individual, to establish, manage or terminate their employment relationships with the individual;
(f) require organizations to notify certain individuals and organizations of certain breaches of security safeguards that create a real risk of significant harm and to report them to the Privacy Commissioner;
(g) require organizations to keep and maintain a record of every breach of security safeguards involving personal information under their control;
(h) create offences in relation to the contravention of certain obligations respecting breaches of security safeguards;
(i) extend the period within which a complainant may apply to the Federal Court for a hearing on matters related to their complaint;
(j) provide that the Privacy Commissioner may, in certain circumstances, enter into a compliance agreement with an organization to ensure compliance with Part 1 of the Act; and
(k) modify the information that the Privacy Commissioner may make public if he or she considers that it is in the public interest to do so.
All sorts of information on this bill is available at LEGISinfo, an excellent resource from Parliament. You can also read the full text of the bill.
Bill numbers are reused for different bills each new session. Perhaps you were looking for one of these other S-4s:
Charmaine Borg NDP Terrebonne—Blainville, QC
Mr. Speaker, according to the Privacy Commissioner, 97% of companies collect personal information about their clients. In the digital age, that information can be shared or stolen more easily than ever. Bill S-4 contains some important measures, but also some ill-conceived measures that will allow companies to share information without a warrant and without notifying their clients.
Will the government agree to amend this bill in order to correct these dangerous measures?
James Moore ConservativeMinister of Industry
Mr. Speaker, that is simply not the case. We are talking about Bill S-4.
Again, if my colleague is opposed to the bill, she ought to tell her colleague who is responsible for telecommunications policy, her colleague from Terrebonne—Blainville, who said, “We have been pushing for these measures and I am happy to see them introduced.... Overall, these are good first steps.”
That was the NDP position when we tabled the bill, because the digital privacy act does exactly, in substance, what the NDP asks for us to do rhetorically, which is to protect the privacy of Canadians online and protect their transactions, so that when their information is violated or if their information has been stolen, they are immediately notified, and if they are not, there is punishment. The Privacy Commissioner is empowered.
Bill S-4 goes a great way to protect Canadians online, and the NDP should know that.
James Moore ConservativeMinister of Industry
Mr. Speaker, we have empowered the Privacy Commissioner and the Privacy Commissioner's office. As I said, we have gone further in Bill S-4.
The ethic behind the member's question is frankly a sound one. That is why we have acted as a government and moved forward both in the Copyright Modernization Act and in this Parliament with Bill S-4.
The Privacy Commissioner has welcomed these changes. Because we recognize that as Canadians are migrating their businesses and their personal lives online, we want to ensure that Canadians are protected online and that the Privacy Commissioner's office is empowered to investigate abuses of Canadian citizens online. That is why we are taking action.
James Moore ConservativeMinister of Industry
Mr. Speaker, my colleague knows very well that Bill S-4, which is before Parliament, protects the interests of Canadians online.
I know my colleague has seen the bill because the member herself said about Bill S-4, “I welcome the proposals in this bill. This bill contains very positive developments for the privacy rights of Canadians.”
Bill S-4, the digital privacy act, was supported by Privacy Commissioner Chantal Bernier. It is supported by Canadians all across the country who recognize the need to protect Canadians' privacy rights online. The member herself spoke favourably of the bill. I am disappointed to see her change of heart.
Opposition Motion--Safeguarding of Personal InformationBusiness of SupplyGovernment Orders
NDP
Françoise Boivin NDP Gatineau, QC
Mr. Speaker, I am pleased to conclude the debate on the opposition motion.
I will read the motion, because after hearing such garbage today, I was beginning to think that I was not talking about the right one. This is what the motion, moved by the hon. member for Terrebonne—Blainville, is asking of the House:
That, in the opinion of the House, the government should follow the advice of the Privacy Commissioner and make public the number of warrantless disclosures made by telecommunications companies at the request of federal departments and agencies; and immediately close the loophole that has allowed the indiscriminate disclosure of the personal information of law-abiding Canadians without a warrant.
I cannot believe that today, May 5, 2014, the Conservatives are going to vote against this motion. It is absolutely incredible. We heard all sorts of drama from the Conservatives about extremely important security issues. They shifted the debate from the opposition motion, which simply calls on the government to grant the Privacy Commissioner's request and make certain information public. It seems quite reasonable to me.
Today is the best possible day to be in the House. This morning, we debated Bill C-567, which was introduced by my colleague from Winnipeg Centre and is all about access to information. This motion is completely justified in light of the context, but they are saying all kinds of things.
I would like to comment on a question that my colleague from Timmins—James Bay asked the last Conservative member who spoke. That member laughed in his face even though the question was completely relevant. It was about peace officers, not as the local paper defines them, but as the Criminal Code defines them.
I would like to give my colleagues opposite a little lesson about the Criminal Code. It is important to define the notion of “peace officer” accurately, because Bill C-13, the government's supposed cyberbullying bill, refers to that notion. That bill is about much more than cyberbullying and the distribution of intimate images.
According to section 2 of the Criminal Code, a peace officer includes:
(a) a mayor, warden, reeve, sheriff, deputy sheriff, sheriff’s officer and justice of the peace,
(b) a member of the Correctional Service of Canada who is designated as a peace officer pursuant to Part I of the Corrections and Conditional Release Act, and a warden, deputy warden, instructor, keeper, jailer, guard and any other officer or permanent employee of a prison other than a penitentiary as defined in Part I of the Corrections and Conditional Release Act,
(c) a police officer, police constable, bailiff, constable, or other person employed for the preservation and maintenance of the public peace or for the service or execution of civil process,
(c.1) a designated officer as defined in section 2 of the Integrated Cross-border Law Enforcement Operations Act, when
(i) participating in an integrated cross-border operation, as defined in section 2 of that Act, or
(ii) engaging in an activity incidental to such an operation, including travel for the purpose of participating in the operation and appearances in court arising from the operation,
(d) an officer within the meaning of the Customs Act [or] the Excise Act...or a person having the powers of such an officer...
I could keep reading this definition until 6:15 p.m. It is not so far-fetched for my colleague from Timmins—James Bay to suggest that Mayor Ford could request certain information.
What is more, the NDP has been heavily criticized today for some of its requests. However, in La Presse this morning, there was an article by Joël-Denis Bellavance on the information we are looking for with the official opposition motion moved by my colleague from Terrebonne—Blainville. Mr. Bellavance reported that the Privy Council Office also made a request of all its departments. The PCO wanted to know who these people were who made 1.2 million requests for information about Canadians. There are 1.2 million Canadians who are allegedly affected by these requests.
All day, the Conservatives have been telling us that this is terrible, that what we are asking for is scary and that the NDP does not know what it is talking about.
I even heard one of the ministers of state, a junior minister over there, say the times have changed.
I think we all know that. Information circulates quickly, I agree. Regardless of the fact that times have changed, there are still laws that apply in this country.
We all know that this Conservative government likes to intrude on Canadian taxpayers' privacy and could not care less about almost every law around. When this government gets caught, it takes a holier than thou stance or it suddenly takes a few strategic steps backward and comes back with what I like to call the Trojan Horse tactic. In other words, it disguises its approach in another way.
Everyone in the House remembers Bill C-30, introduced by my favourite minister, the former minister of public safety. I was going to say something unkind, but I will be careful. Thank God the public woke up and made a concerted effort to ensure that the government backed down. This goes to show that ridicule never killed anyone. However, sometimes it kills political careers, even though politicians will often end up becoming a judge somewhere. Everyone kept telling the former public safety minister what he was in the process of doing. They ridiculed his bill. Sometimes that is what it takes with this government.
Their concerns were heard. The Conservatives withdrew the bill and suddenly we had Bill S-4 and Bill C-13, which deals with cyberbullying. Who in the House would not want to protect victims? Who would not want to say at some point that we passed legislation after a number of young people committed suicide as a result of bullying? That is rather disgusting, although there are other unparliamentary words that could be used. It is problematic to rise in the House and say that, on the contrary, we are in favour of cyberbullying. However, once again, the Conservatives introduced five or six pages of text that were more or less accurate and then combined them with tons of provisions that amend all sorts of legislation.
Fortunately, the Minister of Justice told me that he would give the Standing Committee on Justice and Human Rights the time needed to examine those provisions. Perhaps we, the members of that committee, are not the best people to examine those provisions. Fortunately, we will be hearing from many experts.
I still believe that the motion that I moved at the beginning of the debate on Bill C-13 made complete sense. I proposed dividing the bill in two so that that we could do what we do best: examine the provisions of the Criminal Code and make sure that the new provisions regarding the distribution of intimate images fall within the parameters and meet the test of the Criminal Code.
Instead, we are going to be spending a lot of our time looking at the aspects of the bill dealing with privacy and how certain telecommunications providers will be able to disclose information without a warrant, or with a warrant but with a lighter burden of proof, and so on.
Unfortunately, since the beginning, this government has shown us that it has no credibility. Every week, there is a new drama featuring one of the people sitting in the front benches. At the end of last week—and it has continued into this week—it was the Prime Minister and his serious insinuations. Sometimes, not saying enough is the same as saying too much. He attacked the Chief Justice of the Supreme Court of Canada.
Members on the Conservative benches are wondering why we do not trust them. Why are we suspicious when we get bills like Bill S-4 or Bill C-13? We are wondering what is behind those bills.
People have been debating this motion all day in the House. I repeat that it does not get any simpler than this motion, which calls on the government to follow the advice of the Privacy Commissioner. Who does not want to follow that advice? Who is against making public the number of disclosures, when even the Prime Minister's Office is quietly checking into this matter? The Conservatives are simply afraid of doing things. They want public information on our constituents, on Canadian taxpayers, but they do not want anyone other than themselves to have access to that information.
That is why the government does so much behind closed doors. The representatives of the people, here in the House, certainly have a right to know. We are getting questions as well. I hear from people, and I am sure that my colleagues in the House, even on the Conservative side, are hearing from people. I am shocked to see that many of these people, from the Reform Party of Canada and the Canadian Alliance, who made a point of calling themselves the voice of the people, are now the biggest puppets, sitting in their seats, terrified to rise and say that this makes absolutely no sense.
At some point we need to wake up and go back to our ridings to talk to our constituents, who are asking what is going on with their information, who has access to this information, when and why. Are there 1.2 million criminals somewhere in Canada? Is it because we have relaxed our rules so much that everyone—ISPs, telecommunications companies and others—feels justified in passing on information? The companies know that they will go unpunished if they freely share information on anything. That is dangerous.
Some people here in the House say that times have changed. That is true. I can do research. In fact, I do not claim to know all the sections of the Criminal Code, and I was able to find the section on the concept of peace officer right away, in two seconds. It was actually quicker than that as I think it took me one-tenth of a second to find the definition in the Criminal Code. Sometimes I tell young people or future lawyers that they are lucky because, in my day—I do not like to say this because it dates me, but it is a fact—when I did my research, I had to go to the law faculty library and open maybe 18 books before formulating an idea. Now, we just click on a button.
However, just because information travels at astronomical speeds, it does not mean that the privacy guarantees and protections granted to all Canadians under the Charter of Rights and Freedoms must be trampled by a government that does not care about protecting its citizens.
Opposition Motion--Safeguarding of Personal InformationBusiness of SupplyGovernment Orders
Oshawa Ontario
Conservative
Colin Carrie ConservativeParliamentary Secretary to the Minister of the Environment
Mr. Speaker, our government is committed to promoting the interests of Canadian consumers and the protection of their private information.
In an increasingly digital world, it is important that we have strong privacy protections in place to ensure organizations are treating the private information of Canadians appropriately. Many of these protections are already found in the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA.
However, a lot has changed in the more than 13 years since PIPEDA came into effect. Our government is taking important steps to ensure organizations are accountable for how they handle the personal information of their clients and customers in today's digital world.
That is why on April 8, we tabled Bill S-4, the digital privacy act. The bill introduces new measures to update our private sector privacy legislation, which sets out specific rules that businesses and organizations must follow whenever Canadians' personal information is lost or stolen.
Recently, we have seen a disturbing example of this problem south of the border with Target Corporation. Just before Christmas last year, Target learned that malicious software had been installed on the company's computer systems, allowing the personal information of some 70 million customers to be stolen, including 40 million payment card records.
It is because of situations like these that we must continue to ensure Canadians' personal information is safe. Data breaches can happen in many different ways and to any type of organization, large or small. Data breaches can result from improper disposal, for example, of paper documents sent for recycling instead of shredding or computers resold without scrubbing hard drives clean, or it can be stolen through sophisticated cyberattacks like those experienced by Target.
Unfortunately, this is a growing problem. Last year saw an all-time high for the number of data records lost or stolen worldwide. The Verizon data breach investigations report estimated that in 2012 between 575 million and 822 million records were compromised in data breaches.
We know that cybercrime is a growing problem in Canada. Last October a study reported that cybercrime cost Canadians some $3 billion over 12 months, up from $1.4 billion the previous year.
That is why our government has already put a number of significant measures in place to combat cybercrime and protect our digital infrastructure, such as Canada's cyber security strategy. In addition to this, Canada's anti-spam law will begin to come into force July 1, later this year. This law will help Canadians deal with unwanted commercial emails, and will also protect Canadians from cyberthreats, like malware and fraudulent websites that seek to steal their personal information.
These measures are significant, but more is needed. We must ensure organizations have strong incentives in place to implement strong data security. Currently in PIPEDA there is no obligation for businesses and organizations to inform customers and clients when their personal information has been lost or stolen. This means if a company loses people's credit card information, that company is not obligated to tell them. With the digital privacy act, our government is proposing to correct this.
Stolen data can be used to create false identities that are used in criminal activities. They can be used to hack onto online banking services. In the wrong hands, lost or stolen health information, employee records, even criminal records can create countless problems to those who have had their personal information compromised.
I also want to state, Mr. Speaker, that I will be splitting my time with the member for Desnethé—Missinippi—Churchill River.
We believe it is up to all organizations to put in place the safeguards to protect the personal data they have collected from their clients and customers. This is a responsibility that most take very seriously. However, with the changes we have proposed, if a company has its computer systems hacked and believes personal information has been stolen or if that information has been lost inadvertently, the company will need to take a number of steps.
If the company determines that the breach poses a risk or harm to individuals, it will need to notify the Canadians affected and make a report to the Privacy Commissioner of Canada. Organizations will also be required to document and keep a record of the event, including the result of its risk assessment. This would be required for every breach, even if the company did not think the breach was harmful. The organization would have to provide these records to the commissioner upon request, providing oversight and holding organizations accountable.
Let me provide an example. Say that an organization determines that a laptop containing customer personal information has been lost. It will be required to make a record of this loss. If the breach involves unencrypted sensitive personal information such as credit card numbers, other financial or health information, for example, it would pose a real risk and potential significant harm to those involved. As a result, the organization would be required by law to notify the customers who were impacted.
The company would be not only required to tell customers when it lost information, it would also be required to report the loss to the Privacy Commissioner. The commissioner may then request a copy of the company's records to see if there is a history of similar losses that would be a cause for concern. The Privacy Commissioner would then have the option of opening an investigation into the matter.
It should be clear to all members in the House that implementing a requirement for mandatory data breach notification is a significant improvement to our private sector privacy laws. Our government believes there needs to be serious consequences for any organization that deliberately breaks the rules and intentionally attempts to cover up data breach. The changes that our government has proposed will also make covering up a data breach an offence. In cases of deliberate wrongdoing, an organization could face fines of up to $100,000. To be clear, it will be a separate offence for every person and organization that is deliberately not notified of a potential harmful data breach and each offence will be subject to a maximum $100,000 fine.
The digital privacy act would address the concerns posed by data breaches and has received good reception so far. In fact, the Privacy Commissioner commented that she welcomed the proposals in this bill. She said that it contained very positive developments for the privacy rights of Canadians. Even the member opposite for Terrebonne—Blainville said, “We have been pushing for these measures and I'm happy to see them introduced. Overall, these are good...steps”.
Our government has taken a balanced approach to the responsibilities placed on businesses and organizations, while protecting Canadian consumers by giving individuals the information they need to protect themselves when their information has been lost or stolen. The digital privacy act demonstrates our government's commitment to providing Canadians with the confidence that their privacy and personal information are protected.
Opposition Motion--Safeguarding of Personal InformationBusiness of SupplyGovernment Orders
NDP
Charlie Angus NDP Timmins—James Bay, ON
Mr. Speaker, I listened with great interest to my hon. colleague.
It has been fascinating listening to the Conservatives, because in their upside-down world, they are opening the door to widespread snooping and spying on Canadians but are somehow protecting their privacy.
I ask my hon. colleague about what we are reading in the National Post about the government's supposed fix, Bill C-13. We have been hearing from their tough-on-crime guys. It is all about the police investigation and the importance of investigation. We need to be able to investigate and go after the crooks, the perverts, and the crazy terrorists. However, under Bill C-13, the Conservatives' fix would take out the provision, the caveat, that enforcement agencies would actually have to be doing an investigation. It would no longer be for investigating crime but for anything that would help in “administering any law in Canada”.
It is the ultimate free ride for fishing expeditions, not just for law enforcement but for corporations. Under Bill S-4, corporations could demand information on our Internet use, as could public officers, which include, if we look up the definition, reeves, mayors, and even people who work for the Department of Fisheries, fisheries officers.
I would like to ask my hon. colleague why he thinks the government is so intent on changing the law to allow widespread snooping. Is it possibly because this is what the standard practice has become under the Conservatives' watch?
Opposition Motion--Safeguarding of Personal InformationBusiness of SupplyGovernment Orders
NDP
Matthew Kellway NDP Beaches—East York, ON
Mr. Speaker, I am very pleased to stand in the House this afternoon in support of the motion by my colleague, the MP for Terrebonne—Blainville, on this great opposition day.
It is a day in the House to be talking about privacy issues. This morning I had the privilege of speaking in support of Bill C-567, an act to amend the Access to Information Act (transparency and duty to document), put forward by my colleague from Winnipeg Centre.
This morning's bill and this afternoon's motion complement each other very well. Together they demonstrate to Canadians our NDP desire that it be the citizens of this country, not the government of this country, who are able to conduct their lives with a reasonable expectation of privacy and that it be the government of this country, not its citizens, that has the obligation to operate in a manner that is transparent, open, and accountable.
If there is a simple conclusion to draw from the sum of the whole day, it is that the current Conservative government has it backwards, upside down, and twisted all around. The Conservatives stand in support of government privacy, of, in fact, the necessity to operate free from the scrutiny of the citizenry of Canada and those they elect to hold the government accountable.
How, the Conservatives ask in response to Bill C-567, can they operate at once openly and honestly? If they are to tell the truth, it must be behind the curtain, they argue, in the dark, out of earshot, and away from the gaze of the public and opposition members of this place. On the other hand, they demonstrate no mere disregard of the privacy rights of Canadian citizens. They demonstrate an appetite, a voracious, seemingly insatiable appetite, for the private information of Canadians.
Much is made of the fact that we live in new and different times, with new forms of information and new means of accessing that information. There is truth, of course, to this, undeniably. I think all of us are alive to the ease with which information we consider private is accessible to those who want to put some effort, and not much is required, into accessing it. Our expectation of privacy is diminished as a result, simply because we know the ease with which we are vulnerable. Therefore, we see the narrative here being one of the need to modernize our laws to take these new circumstances into account. That does not account for the conduct of the current government.
The problem before us is not simply one of a government that has not come up to speed, that has failed to respond in a timely way to these new circumstances, and that has left exposed loopholes in the formulation of the laws of this country. That would paint a picture of an incompetent or slow, but certainly benign, government. No, the current Conservative government is anything but benign.
Confronted with a loophole for accessing the private information of Canadians, a benign government may simply fail to close that loophole. The current government lets through that loophole, fully, completely, and head first, with great enthusiasm and an obvious lust for what it might find on the other side. What we have before us is evidence of this lust.
Very recently, the Privacy Commissioner of Canada, Chantal Bernier, revealed that Canadian telecom companies disclosed massive volumes of information to government agencies, including the Royal Canadian Mounted Police, the Canadian Security Intelligence Service, Canada Border Services Agency, and provincial and municipal authorities.
Telecom companies disclosed personal data to the Canadian government 1.2 million times in a single year. We can of course concede that a balance is to be found between privacy rights, public security, and other concerns, including immediate danger to life. However, this can be nothing other than an indiscriminate fishing expedition of monumental proportions that the Privacy Commissioner has revealed to us.
These volumes equate to information requests with respect to one in every 34 or so Canadians. The vast majority of these requests are made without warrants. These volumes equate to a request for personal data, by the federal government to a telecom company, once every 27 seconds.
So great is the volume of information requests that one telecom company has advised that it has installed what it calls “a mirror” on its network so that it can send raw data traffic directly to federal authorities. Michael Geist, a digital law professor at the University of Ottawa, says this of what is happening:
This is happening on a massive scale and rather than the government taking a step back and asking is this appropriate...we instead have a government going in exactly the opposite direction—in a sense doubling down on these disclosures
It is easy to find further evidence of this doubling down, of this appetite for private information. One cannot help but note that Bill C-13, which is purportedly about cyberbullying, is more about lowering the bar on government access to information. The “reason to believe” standard is being replaced with a “reason to suspect” standard, opening up much greater warrantless access to electronic information. Moreover, Bill C-13 would allow a broader and lower range of government officials to have access to the private information of Canadians.
Bill S-4 will also be coming before this House, we suspect. That bill would permit non-governmental organizations and corporations to have access to information from telecom companies. FATCA, the Foreign Account Tax Compliance Act, buried deep in the budget bill, would expose the financial information of about one million Canadians to the U.S. government, and so on.
In light of all of this, one could argue that there is a kind of naiveté to the motion I speak in support of today. Certainly the first part of the motion is easy enough. It is, in fact, all the Privacy Commissioner has requested. She has said:
I'm not disputing that there are times when there is no time to get a warrant—life is in danger....
What we would like is for those warrantless disclosures to simply be represented in statistics so that Canadians have an idea of the scope of the phenomenon.
...It would give a form of oversight by empowering citizens to see what the scope of the phenomenon is.
It is a modest enough proposal: at least let me see what it is the federal government is doing here.
However, we are also asking the government to close the loophole that has allowed the indiscriminate disclosure of the personal information of law-abiding Canadians without warrants. In so doing, we must recognize that we are asking the predator to restrain itself, to bind itself, to limit its own appetite for our private information, to guard itself. It has no such impulse, no such sense of constraint, as is obvious from the 1.2 million requests, by Bill C-13, by Bill S-4, and by FATCA.
Here is the very saddest part of this. As we engage with each other through the technologies of this modern world, we do so with some trepidation about how exposed we are to the prying eyes and interests of others, and part of what we need to be concerned about now, we find out, are the prying eyes and interests of our own government. Rather than being able to rely on our own government to support us and to protect our privacy in this modern world, it appears that our government is itself a cause for concern.
Opposition Motion--Safeguarding of Personal InformationBusiness of SupplyGovernment Orders
NDP
Don Davies NDP Vancouver Kingsway, BC
Mr. Speaker, it is a pleasure to stand in support of the official opposition New Democratic motion introduced by our superb colleague, the member for Terrebonne—Blainville. I should point out that I will be sharing my time with my hon. colleague, the equally commendable member for Beaches—East York.
The motion before the House today reads as follows:
That, in the opinion of the House, the government should follow the advice of the Privacy Commissioner and make public the number of warrantless disclosures made by telecommunications companies at the request of federal departments and agencies; and immediately close the loophole that has allowed the indiscriminate disclosure of the personal information of law-abiding Canadians without a warrant.
If we think about those words, and I know Canadians will think about the text of the motion, who could possibly not support this? Who could possibly oppose a motion of the House of Commons in Canada that the government should simply tell the public how many warrantless disclosures are made by telecommunications companies at the federal government's request and close a loophole that allows the indiscriminate disclosure, meaning the improper disclosure, of personal information of law-abiding Canadians without a warrant?
I would have thought that every member of the House would stand in support of such a motion, a motion that preserves and protects the very elementary privacy rights and expectations of Canadians everywhere, but that is not the case, because Conservatives in the House do not support the motion.
I am going to talk about how the motion came to be.
In summary, the motion addresses what we now have learned are rampant requests to telecommunications companies in Canada by various government agencies for Canadians' private information, often—in fact, normally and mostly—without a warrant.
We are calling on the government to listen to the Privacy Commissioner, an independent officer of the House, to make public the number of requests disclosed by these companies, and to tighten the rules that allow it to happen.
This came out of an access to information request that determined that at least one Canadian telecom was giving the government unrestricted access to communications on its network, according to documents from Canada's Privacy Commissioner. The documents were obtained by University of Ottawa digital law Professor Michael Geist. He cited at that time an unnamed telecom firm as saying that it had allowed the government to essentially copy the communications data moving on its networks.
I quote Mr. Geist:
Interception of communications over data networks is accomplished by sending what is essentially a mirror image of the packet data as it transits to network of data nodes.
Then the Privacy Commissioner's document states:
This packet data is then sent directly to the agency who has obtained lawful access to the information. Deep packet inspection is then performed by the law enforcement agency for their purposes.
“Deep packet inspection” is a method of analyzing Internet traffic to determine the exact type of content. It can distinguish between emails, file-sharing and other types of internet communication, and can be used to build statistics about an internet user.
This statement appears in the document prepared by the law firm Gowling Lafleur Henderson for the Privacy Commissioner. It summarizes nine telecom firms' responses to questions about law enforcement access posed by the commissioner.
Mr. Geist called this “an incredible admission”.
He asks:
Are there legal grounds for these disclosures? Who is doing this?
He goes on to say later:
Given the uncertainty of the enormous privacy implications, the Privacy Commissioner of Canada is surely entitled to investigate this admission using her current powers under PIPEDA.
Documents subsequently released by the interim Privacy Commissioner, Chantal Bernier, revealed that the government made about 1.2 million requests for subscriber data about Canadians from Canadian telecoms in 2011 alone. Mr. Geist calculates that it works out to one request every 27 seconds, and the Privacy Commissioner's report showed that telecom firms complied with the requests at least 784,000 times.
This issue engages one of the most important values that mark our nation. It is a value that marks our democracy. It is cherished by Canadians, valued by Canadians, and expected by Canadians. That is the value of privacy.
The government exists to protect its citizens. It exists to safeguard our rights, our interests, and our opportunities, so when the government is actually found to be the source of secret requests to private firms to try to get private information about Canadians without their knowledge and without ever appearing before a judge in a court to demonstrate that the government has any lawful interest in that information, in my view that is a violation of the most fundamental precept and obligation of the government. That is what is happening under the watch of the Conservative government.
I want to go through a few facts here. Canadian telecommunications providers collect massive amounts of data about their subscribers. These are the firms that have been asked by the government's agencies to disclose that information to law enforcement agencies. In 2011, providers responded to almost 1.2 million requests, but the actual total is likely even greater, since only three of nine telecom companies told the commissioner's office how many times they granted the government's request for customer data.
In 2010, RCMP data showed that 94% of requests involving customer name and address information was provided voluntarily, without a warrant. The Canada Border Services Agency obtained customer data from telecom companies 19,000 times in one year, and it obtained a warrant in fewer than 200 of those cases. Significantly, one Canadian company has told officials that it has installed “what is essentially a mirror” on its network so that it can send raw data traffic directly to “federal authorities”.
The Privacy Act, which is meant to protect Canadians' privacy and keep the government accountable, has not been updated since 1983, before the Internet, Google, email, Facebook, and Twitter were even invented. PIPEDA, which protects Canadians' privacy in the private sector, has not been updated since 2000. Once again, that is before Facebook, Twitter, and social media had really taken off in our country.
I would think that if the government is really concerned about the values of privacy and protecting Canadians' rights, it would spend time in this place modernizing those acts and doing so in a way that is consistent with Canadians' expectations. Instead, it is doing the opposite. It has introduced Bill C-13, a bill that is expressed to be aimed at attacking cyberbullying, but which is expected to expand warrantless disclosures of Internet or cellular subscriber information to law enforcement.
Bill S-4, the digital privacy act, has been introduced in the Senate. It would also extend the authority to disclose subscriber information without a warrant to private organizations, and not just law enforcement agencies. It would also allow telecom companies to disclose the personal information of consumers without their consent and without a court order to any organization investigating a contractual breach or possible violation of a law.
There are many validators of the New Democratic position. New Democrats think privacy laws should be modernized and strengthened to better protect Canadians' personal information, not weakened. New Democrats believe that we can and should aggressively pursue criminals and punish them to the full extent of the law without treating law-abiding Canadians like criminals and violating their rights.
Privacy is something that must be judiciously and carefully guarded by every generation. We have people as diverse as Benjamin Franklin, who said that those who would give up liberty for a little security deserve neither. We have organizations as diverse as the Council of Canadians and the Canadian Taxpayers Federation, who are joining together in their concern about the issue of violations of privacy and surveillance of Canadians' private interests on the Internet by the government.
I say that what Canadians want of their federal government is for it to protect their privacy interests, not be complicit in violating them.
For the Conservative government to allow 1.2 million requests to go to telecoms for Canadians' personal information without their consent, without their knowledge, and without a court order is something that every Canadian in this land would disapprove of.
I ask all of my colleagues in the House to vote for this well-thought-out motion.
Opposition Motion--Safeguarding of Personal InformationBusiness of SupplyGovernment Orders
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
Mr. Speaker, I would like to point out one thing. We are not debating Bill S-4 right now. We are debating the opposition motion moved by the NDP, which specifically calls for transparency measures when it comes to the 1.2 million instances of disclosure of personal information. We are also asking that the government close the loophole in the legislation.
This really has nothing to do with Bill S-4. I am certain that we will have the opportunity to debate the bill and I will be pleased to participate in that debate, but now is not the time to do that.
Opposition Motion--Safeguarding of Personal InformationBusiness of SupplyGovernment Orders
Conservative
David Wilks Conservative Kootenay—Columbia, BC
Mr. Speaker, It is a pleasure to rise today and highlight the measures our government is taking to protect the privacy of Canadians.
As members of this House are aware, the Personal Information Protection and Electronic Documents Act, PIPEDA, has been in force since 2001. I would like to focus my comments on one area in particular, and that is the role of the Privacy Commissioner of Canada in promoting compliance with PIPEDA and increasing accountability among organizations that collect, use, or disclose personal information.
First, let me begin with a bit of an explanation of how the act works when it comes to compliance. Under PIPEDA, the Privacy Commissioner serves as an ombudsperson. Individuals who feel their personal information has been improperly handled by an organization have the right to complain to her office.
The commissioner has the power to investigate, enter premises, compel evidence, mediate a settlement, make recommendations, and publish the names of those who contravene PIPEDA. In short, the privacy commissioner investigates complaints and works with companies to make sure they comply with the act for the protection of all Canadians. The commissioner has a range of powers, but as an ombudsperson, takes a co-operative and conciliatory approach wherever possible. This encourages the resolution of complaints through negotiation and persuasion.
At the conclusion of an investigation, the commissioner releases a report of findings that outlines whether or not the organization in question has contravened the act and whether or not the complaint was resolved. This report also includes notice of any action taken or proposed to be taken by the organization. It may also include reasons why no action was taken.
Under PIPEDA as it now stands, the commissioner or individuals can apply to the Federal Court for a hearing on any matter related to the original complaint within 45 days of the commissioner's report. The court has the authority to order the organization to change its practices. The Federal Court can also award damages to Canadians when their privacy has been violated and they have suffered from some form of harm as a result. That is how compliance currently works.
However, as technology has evolved, we as members of this House must ensure the commissioner is able to hold organizations more accountable for their handling of personal information for the protection of Canadians and their privacy. It is for that reason that our government has proposed increased power to enable the Privacy Commissioner to better do her job. It is clear from the remarks from the Privacy Commissioner of Canada that our government is on the right track.
Before our government tabled Bill S-4, she said, “I welcome proposals...” in this bill. This bill contains “...very positive developments for the privacy rights of Canadians”.
We work with the Privacy Commissioner of Canada, we protect the best interests of everyday Canadians and we make sure that we move forward to modernize our digital privacy laws. This is why we are proposing this bill, which includes three important changes to keep companies accountable when dealing with Canadians' personal information.
First, we want the commissioner to have the authority to negotiate compliance agreements.
Second, we want to extend the length of time the commissioner or individuals have to bring matters before the court. Instead of the very limited time of 45 days, we would extend that timeframe to one year.
Third, we want to give the commissioner greater power to name and shame organizations that are breaking the rules.
Let me describe each of these changes in a bit more detail.
Going to court to resolve a dispute can be costly both for the organizations implicated and the Office of the Privacy Commissioner.
A compliance agreement is a powerful tool that provides an alternative to taking an organization to court. These are voluntary but binding agreements between the commissioner and the organizations that recognize they need to take action to improve their privacy practices.
These agreements benefit both sides. They can provide an organization with certainty and clarity about what specific steps they need to take, and a specific timeline to ensure they are compliant with the rules. These binding agreements also give the organization the certainty that it will not face court action by the commissioner—
Opposition Motion--Safeguarding of Personal InformationBusiness of SupplyGovernment Orders
Conservative
Mike Wallace Conservative Burlington, ON
Mr. Speaker, I want to first of all thank the Parliamentary Secretary to the Minister of Public Safety and Emergency Preparedness for sharing her time today. She gave an excellent speech on this topic and it is an honour for me to speak to this issue. I appreciate the New Democratic Party using its supply day that provides opposition parties an opportunity in every session a number of days to put forward any items they would like for discussion.
Frankly, in the past some of the topics that have been brought forward on supply days I thought were very much a waste of important time that the opposition is allotted. However, in this case it is important. It is in the news. It is something that has been happening in terms of information that is out there and it is important for us to have a debate on this and discuss what the facts are in this case and going forward.
There is an important balance required between privacy and the ability of law enforcement, in particular, to be able to do their jobs. The Conservatives have has put in around 30 measures since we have taken office to improve issues with privacy and access to information regarding this and it is always important to have a balance.
There have been a few misconceptions propagated in the press or in the House and connections with what was in the newspaper and Bill S-4 in the Senate that talks about PIPEDA and a number of other areas, but I want to focus on what is in front of us today. The main question is what type of information our law enforcement and intelligence agencies are requesting from telecommunications service providers.
The vast majority of those investigations were agencies requesting voluntary co-operation. Before we go any further, it is voluntary co-operation. They ask and the service providers provide. They are not providing all the content of what an individual may be using or looking at through their IPS or service provider, whether it is a cellphone or the Internet, but they are providing basic address information such as name and address.
A simple example would be this. The police could look in the phone book. They know where I live. I know who is on my street. I have lived there for 16 years. Police might come to my door and ask if so-and-so lives next door. I have to say “yes”. I voluntarily provide that information and that is basically what has been asked for. I do not give the police permission to go into my neighbour's mailbox, open their mail, and read their mail. That is not the permission we are providing and that is being accessed here.
I would not expect the police or anyone else to be able to go into my mailbox in my house. I am happy for them to come to my door to find me. I think that is information that has been out there for many moons, but they are not entitled to go into my mailbox and read my mail. They can if they get a warrant through the judicial system that allows that to happen. That is exactly what is happening here.
The world is changing. In the late eighties, early nineties, I worked for a company and I had what was called a car phone. It was on a post attached to the floor of my car. At that time, there were few of us who had them, but times have changed. Now 21 million Canadians have access to a cellphone, they are texting and it is a different type of communication. There is no reason why we, as the government or the police force or intelligence agency, should not be able to keep up with the times. How are we going to do our jobs if we do not keep up with the times?
Many of my constituents think that government is always behind the times, and some days here I actually agree with them.
However, it is not about the content of this information that is voluntarily being provided. If a company decides that it does not wish to provide it on a voluntary basis, then the police force, intelligence agency, or whoever is asking for it, is required to go and get a warrant or whatever legal document they need through the legal system to be able to have access to that information. I have no particular issue with this. Does any of this information require a warrant? Not if it is voluntarily provided.
I would say that if there is any further detail about exactly what somebody is accessing through their email, who they are emailing and all of that larger data, even as it is grouped, is not allowed. One needs a warrant for that particular information. Megadata is not covered in the voluntary aspect of those requests and they would still need a warrant.
I think members will find that the information that has been asked for and voluntarily provided is very simple address information. The parliamentary secretary indicated a number of uses for that information, and I think that is appropriate.
I can say that if I had a loved one who was missing or recently found and officials were able to contact me because they were able to find, through who they were dealing with, my phone number so they could let me know that they had found this individual, I would be very happy for the police to do that.
I had my home broken into a number of years ago and we had some property stolen. We voluntarily provided the police information to contact us if they were able to find some of our stolen goods. In fact, the police did. They found it at a pawn shop and they contacted us. They were also able to track down the individual who was in our home and prosecute the individual for the crime against us.
This is the kind of information that is now available and required. It is address information that happens to be in an electronic format. It is not on paper any more. It is not a phone book on paper, but in an electronic format, and officials are able to use that.
The justice committee that I chair is presently looking at a cyberbullying bill, Bill C-13. We are just embarking on that study and as of tomorrow we will hear from victims of cyberbullying. We will also hear from police forces and agencies that protect children. I will be interested to find out how they feel about basic address information being provided to law enforcement organizations to help prevent this kind of abuse and tragedy that happens to our young people throughout the country.
I have great faith and trust in our law enforcement agencies, as I think all of us do in this House. I am confident that our law enforcement agencies are following the law that is on the books presently. They are gathering information that they are entitled to, which is given voluntarily to help them solve crimes. For information that is deeper and more informative that they need, they will get the proper legal documentation, whether that is a warrant or other devices available to them. I have confidence in our system.
I have confidence in our law enforcement agencies. I believe it is important to balance the issues of privacy and protection of the public. I believe our law enforcement and intelligence agencies do an excellent job for Canadians.
Opposition Motion--Safeguarding of Personal InformationBusiness of SupplyGovernment Orders
Conservative
Roxanne James Conservative Scarborough Centre, ON
Mr. Speaker, I have to first address the speaking from the two sides of the mouth. The New Democrats have put this motion forward today, but the very same member who moved the motion said they were pleased with the measures in Bill S-4. Therefore, we need to clarify who is speaking out of both sides of their mouths.
Opposition Motion--Safeguarding of Personal InformationBusiness of SupplyGovernment Orders
NDP
Charlie Angus NDP Timmins—James Bay, ON
Mr. Speaker, I listened to my hon. colleague with interest, and a little surprise. This is a government that seems to be talking out of the both sides of its mouth. It first says it is just basic data that anyone can get in a phone book but that we need to do it immediately to stop all kinds of terrorist threats.
She mentioned ISP numbers and IP addresses and said that is ordinary; it is like looking in a phone book. I would like to quote Ann Cavoukian, Information and Privacy Commissioner of Ontario, who I am sure my hon. colleague would agree is a vigilant defender of Canadians' rights. She said that getting government information on an IP address is not like the digital equivalent of using a phone book. She stated:
...customer name and address information ties us to our entire digital life, unlike a stationary street address. Therefore, “subscriber information” is far from the modern day equivalent of a publicly available “phone book”. Rather, it is the key to a much wider, sensitive subset of information.
I would like to ask my hon. colleague why this large subset of sensitive information would be opened up under Bill C-13 to so-called public officers, which would include reeves, wardens, fisheries officers, and mayors. Under Bill S-4, this information will also be turned over to corporations that ask for it through telecoms. Then the telecoms would be given blanket immunity not to tell Canadians. Why is it that the government is going to expand who has access to this sensitive subset of information on the private lives of Canadians?
Paul Calandra ConservativeParliamentary Secretary to the Prime Minister and for Intergovernmental Affairs
Mr. Speaker, nothing could be further from the truth.
Personal information that is protected by the charter requires a warrant. This is what Rogers had to say when asked about this, “Where there is an immediate danger to life; we will provide information to law enforcement agencies to assist with 911 service, missing persons cases, individuals in distress”.
That is what we are talking about. I wish the opposition would support us. There is a bill before the House, Bill S-4 that will help tighten this even further and make the bill even better.