Thank you, Mr. Chair.
Again, my name is Micheal Vonn. I'm the policy director of the British Columbia Civil Liberties Association. We are of course a non-partisan, non-profit society and one of the oldest and most active civil liberties and human rights organizations in the country. Privacy is a key portfolio of our association, so we are very grateful to be asked to speak to you today on Bill S-4 and particularly pleased that we are able to discuss it with you prior to second reading, while the scope of the bill is still open for discussion.
Our association would like to support and echo many of the concerns and recommendations that have already been brought before this committee by civil society and academic witnesses. For example, we strongly support the position of B.C. FIPA that there is an urgent need to bring federal political parties under PIPEDA.
We also endorse the position of the national PIAC that compliance agreements are of limited assistance in protecting Canadians' privacy rights and that it is long overdue for the federal Privacy Commissioner to have order-making powers, like provincial counterparts. We believe lt is unacceptable that statutory privacy rights that courts characterize as quasi-constitutional are regulated federally largely on the basis of moral suasion without effective enforcement. ln our view, Bill S-4 falls far short of addressing this critical and long-standing problem.
However, time being limited, I will devote my prepared remarks primarily to the Supreme Court of Canada's decision in R. v. Spencer and its implications for Bill S-4.
The Spencer decision, as you know well, dealt with the provisions of PIPEDA that allow for disclosure without consent to government institutions when the institution has identified its lawful authority to obtain the information. The issue in the case was whether the police seeking access to subscriber information without a warrant from an Internet service provider had the requisite authority. The answer to that question depends on whether there is a reasonable expectation of privacy in customers' subscriber information.
The Supreme Court of Canada resolved this issue, on which lower courts had been divided, and found that there is a reasonable expectation of privacy in subscriber information and that it is reasonable for Internet service users to expect that a simple request by police would not trigger an obligation to disclose information or defeat PIPEDA's general prohibition on the disclosure of personal information without consent.
For the purposes of our section 8 charter right to be secure against unreasonable search and seizure, a request by a police officer that an Internet service provider voluntarily disclose subscriber information amounts to a search, and a warrantless search is presumptively unreasonable, according to section 8 analysis that you will find in R. v. Collins. The crown bears the burden of rebutting this presumption by showing three things: one, that the search is authorized by law; two, that the law itself is reasonable; and three, that the search is carried out in a reasonable manner.
Now, the question in Spencer was whether or not the provision in PIPEDA ostensibly allowing for disclosures without consent to law authorities was in fact a law authorizing this. The court said it was not. If it were, the court said, in paragraph 70: ...PIPEDA's protections become virtually meaningless in the face of a police request for personal information....
The court said that of course the police have lawful authority to ask questions relating to matters that are not subject to a reasonable expectation of privacy and of course they have lawful authority to conduct warrantless searches where there are exigent circumstances. But “lawful authority”—that language in PIPEDA as it stands—requires more than a bare request. This we know from Spencer.
Thus we say that there is a need in Bill S-4 to amend the provision that is at issue in Spencer, a provision so confusing that we had to go all the way to the Supreme Court of Canada to have it definitively interpreted. And while some very limited and narrow voluntary disclosures may still be viable under this provision post-Spencer, outside of exigent circumstances such disclosures would require legal advice.
lt is patently unreasonable to maintain a provision that cannot be understood on its face and requires a charter analysis to be used appropriately. As we argued in our lawful access report of 2012, the best approach is to remove this provision in its entirety.
Alternatively, we say that the term “lawful authority” could be replaced by the term “statutory authority” for greater clarity, however the constitutionality of said statutory authority will, of course, ultimately still be a question of debate.
The further question of the constitutionality of express statutory authorities for disclosure, in light of the Supreme Court of Canada's decision in Spencer, has led the special committee reviewing PIPA in British Columbia to call for a narrowing of its voluntary disclosure provisions under the act.
We want to caution this committee that there are at least two reasons we cannot look to Alberta and British Columbia's privacy legislation relating to the private sector for assurance that proposed expansions of voluntary disclosures found in Bill S-4 are likely to go well.
One, there is a clear concern that those PIPA provisions may not be constitutional in light of Spencer.
Two, however little historical challenge there has been in relation to those provisions thus far, the same will certainly not be the case in relation to the arenas governed by PIPEDA, which obviously include telecommunications.
I have other things that I could say about this, but I think I'll save it for questions.
Thank you very much.