Industry Committee on April 17th, 2024

[Mark Schaan]

I think it provides greater clarity as to the uses of personal information by law enforcement. I think it's important, though, that, as Ms. Angus noted, the Spencer test is not a cumulative one. Law enforcement does not need to meet all three aspects of the test. Law enforcement needs only to meet any of the three aspects of the test. I think that's something to consider with respect to how the amendment is currently drafted, because it reads as cumulative.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

In the recent Supreme Court case, did they meet any of the tests?

[Mark Schaan]

In the IP case, they could not rely on any of the three, as I understand it, which is why it was seen to be personal information, because it was not understood to be foreseeable that.... It was that an individual has a reasonable expectation of privacy when it comes to their IP address.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

That's okay for now for me.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Turnbull, the floor is yours.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you.

It's a great conversation so far.

I want to balance this out with.... This amendment potentially adds a new test for “lawful authority” that may not be something that the private sector marketplace is normally subject to.

Mr. Schaan, would you agree with that? Could you provide a bit more detail?

[Mark Schaan]

I'll turn to Ms. Angus.

[Runa Angus]

The private sector is quite familiar with the Spencer test. That is the test they use to disclose information to law enforcement. CPC-3 does not quite mirror that test. When I look at the submission of the Privacy Commissioner for Bill C-11, I see that it more closely mirrors the Spencer test in that it has three criteria and those criteria are not cumulative. The way that I read the Privacy Commissioner's submission, there's a clear “or” in there, which is not there in CPC-3. Therefore, this would be a significantly narrower test for organizations.

[Ryan Turnbull, Liberal, Whitby, ON]

If I'm to understand you correctly, there are three parts to this test that are being combined together as a test that includes three conditions. All three would be required, so they are cumulative—which is the word I think Mr. Schaan used—rather than independent criteria, and only one would need to be sought in order to apply.

I'm trying to understand how a private sector company meets this high bar for the test that CPC-3 seems to impose, and if that is realistic for the current marketplace, given the fact that it may not be how they're operating currently and it may not even be entirely consistent with the Supreme Court ruling that is being referenced. Can you add detail there?

[Runa Angus]

Sure. Our understanding is that the private sector is already quite conservative when it comes to disclosure of information. They will typically want to see judicial authorization before they disclose, unless, obviously, law enforcement can meet the test in Spencer to show that it's “exigent”, that it is under “a reasonable law” or that there is a “common law authority” for them to collect that information.

They're quite parsimonious in the information they disclose. More often than not, they will not disclose. The other thing to remember is that proposed section 44 of the CPPA and its equivalent in PIPEDA are permissive. They don't compel disclosure. They say that a company “may disclose”. Typically, companies, on balance, don't disclose unless they are convinced that the Spencer test is met.

This test is a significantly narrower test than Spencer and would probably mean that the private sector would not disclose any information, which, of course, can disrupt law enforcement activities at all levels: national security, child exploitation and many other instances where law enforcement needs this kind of information.

[Ryan Turnbull, Liberal, Whitby, ON]

If I'm understanding you.... Maybe what would be helpful is to use a case or an example to illustrate where, potentially, this bar.... Essentially, we're saying that an organization would have to determine exigent circumstances, which may be slightly difficult, and would have to assess that without necessarily having government institutions disclose all of the facts and information. We're also saying that the reasonable expectation of privacy may be slightly difficult. Then, if you're adding those two together, as well as a test that excludes common-law authorities....

What I'm trying to understand is how.... Maybe a solution is to have the definition of a lawful authority and have it mirror more the Spencer ruling that has been referenced multiple times. What would that potentially look like?

[Mark Schaan]

We need to make it clearer that the Spencer test has exigent circumstances or reasonable law or information that would not attract a reasonable expectation of privacy. If it actually ensured that it recognized that those were three mechanisms that law enforcement had to access information, it would be consistent with the current jurisprudence, which is the test that the Privacy Commissioner thought was useful.

[Ryan Turnbull, Liberal, Whitby, ON]

I took enhanced logic at university. It's an exclusive disjunction versus an inclusive disjunction. It's not a set of things all of which you need to comply with. It's either this or this or this. They're independent criteria.

That's what I would propose. I'm going to propose a subamendment that more clearly aligns with the OPC, but also with the Supreme Court ruling that the Conservatives have referenced. It's a slight variation on what you've suggested, which is significant and important. It's a set of criteria, but it's either one or the other. It's not all three things you've outlined.

I'll send that around and read it into the record, if you'd like.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Please do.

[Ryan Turnbull, Liberal, Whitby, ON]

It would read, “lawful authority means authority exercised by a government institution or part of a government institution where one or more of the following criteria are met: (a) there are exigent circumstances, (b) it is pursuant to a reasonable law (other than section 44) or (c) it is pursuant to common law authority where personal information would not attract a reasonable expectation of privacy.”

I've sent that around to the clerk and other members.

I don't think I have a paper copy, but we can get one.

[The Chair, Liberal, Joël Lightbound]

I just discussed that with the legislative clerks. Procedurally, it would be a little more elegant if this amendment was defeated and then another one was proposed, instead of subamending, because this is basically rewriting CPC-3 entirely.

I think it's good, Mr. Turnbull, that you put it on the record and that it is being circulated, so that MPs know what alternative you're proposing. It would still, to some extent, respond to some of the concerns that are brought forward by CPC-3. However, procedurally, I don't think we could subamend it the way you're proposing, Mr. Turnbull. I would rather you moved a distinct amendment with what you've proposed.

Go ahead, Mr. Perkins.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

I have a procedural question.

Can we ask our officials about both of these together, since they're not on the floor?

[The Chair, Liberal, Joël Lightbound]

Given that they're related and they're dealing with the same issue, yes, you can ask about the difference.

I believe the clerk has circulated Mr. Turnbull's proposed subamendment. You have it now in your mailbox. We can continue debate on CPC-3 with the knowledge that Mr. Turnbull has proposed an alternative.

The next speaker on my list is Mr. Garon.

Mr. Turnbull, are you done?

[Ryan Turnbull, Liberal, Whitby, ON]

I made the case for amending the definition of “lawful authority”, including the Spencer Supreme Court decision and ruling as guiding that definition. It includes many of the things that the Conservatives intended, and there is a subtle difference. We believe it's more consistent with the OPC and the Supreme Court ruling, and therefore would be an improvement and a compromise, working constructively here. Please consider it, and let's debate it if we need to.

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Turnbull.

I now give the floor to Mr. Garon. The next speakers will be Mr. Masse, Mr. Williams and Mr. Vis.

[Jean-Denis Garon, Bloc, Mirabel, QC]

I don't want to take up too much time, but I do want to say that our questions are exactly the same.

First, it's important to have a definition that's authoritative and legitimate. We don't have one, and we need one.

Second, we've been wondering about the Emergencies Act and police investigations, in particular. I think our questions have been answered.

However, I have another question. You mentioned the legal test stated in the Spencer decision. I need to read the new definition more carefully, but offhand I think it's more appropriate. It adopts exactly the same test as is used in Spencer. So it's already in the case law.

So what's the difference between introducing that test into the law as is and not including a definition?

[Mark Schaan]

I think the case law is now what guides organizations in how they use personal information. However, adding this kind of definition to the act would, in a way, further confirm the test set forth in Spencer.

[Jean-Denis Garon, Bloc, Mirabel, QC]

I'm going to go back to the definition proposed by our Conservative colleagues.

What would be the legal consequence of having in the act a definition that would be consistent with a certain logic and that would be more restrictive than the legal test?

Would that limit the scope of the amendment in a court case?

[Mark Schaan]

As Ms. Angus said, the addition of a new definition that includes, in a single sentence, the three criteria of the test established in Spencer, without stating that they are three separate parts but only one has to be satisfied, creates a new, more restrictive test for organizations.

As a result of this new test, law enforcement agencies would be unable to obtain certain personal information requested from organizations, whereas that information would have been legally obtained under current case law.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Thank you.