What I'm trying to get at here is that there's clearly a gap in the law, which you're trying to get at by using the term “lawful authority” throughout this version of the new privacy act that's being proposed in CPPA. We've seen how, with the weak wording that was in PIPEDA, which is carried forward here, businesses and organizations often provide information to law enforcement agencies or the agencies that are going after it on fishing expeditions when they don't really have the interest of the privacy of the individual in mind.
When a government organization or a law authority asks a business or an organization for access to something, they clearly, sometimes, without going through the hoops of consulting with all of their inside and outside corporate lawyers, give out access to personal information and data that hurts an individual's privacy.
There was recently a Supreme Court ruling on the issue of IP addresses. That was done in just the last few months, so clearly there's an issue with the current wording of PIPEDA, which this carries forward, which is inadequate to protect the privacy of an individual against the overreach of a law enforcement agency or government that is going after information, however legitimate they may think it is in the particular circumstance. Under law enforcement, you can pretty much justify most intrusions into personal privacy. Certainly, having the speed of this and not having to be burdened with going and getting a warrant or some sort of judicial authority to do this makes life a lot easier for those authorities, but that doesn't make it easier to protect an individual's privacy.
Without this type of further definition in the bill, we're going to continue to end up with these cases of people, with or without their knowledge, having their data shared with these agencies, and then having to fight, after the fact, through the Supreme Court, to try to put the toothpaste back in the tube, to say this was something that should not have happened.
Now, I'm not a lawyer, as I often say here, but this just strikes me as unfair when we have the opportunity right now, in creating a new privacy law, to actually listen to the Privacy Commissioner, who's been dealing with this for quite some time, for at least a decade, and asking for Parliament to put in a simple definition, which can be lifted straight from the presentation of the Privacy Commissioner.
Again, as MP Masse said last time, I trust the Privacy Commissioner on these issues and I have not yet been convinced that putting this in will somehow diminish the bill or harm somebody's privacy. In fact, I think it enhances an individual's privacy.
Does putting this in enhance somebody's privacy, or does it diminish it?