Justice Committee on May 6th, 2014

[David Fraser]

I tend to disagree with the interpretation of the statute that says lawful authority is anybody with a badge. Let me tell you what is routinely disclosed without a warrant in these sorts of cases. Many of these are reported in court cases. You just have to go the legal databases and search for PIPEDA requests.

The investigating officers have an IP address. They're able to obtain an Internet protocol address related to somebody of interest, and that can be because that person is believed to be sharing child pornography. Most of your activities that take place online expose your IP address to any computer that you connect to. So they have that IP address. They don't know who it is. They can determine, through public databases, what is the Internet service provider. They can go to that Internet service provider and say, “We have an IP address. We want to know who it is. We don't have enough information to convince a judge, but we're going to tell you that it relates to a child exploitation investigation or otherwise.”

Some Canadian telcos, if that request is in writing, will hand over that information. Other Canadian telcos will say to come back with a warrant because they're not comfortable that they're allowed to under PIPEDA. That's essentially the nub of it. None of them, to my knowledge, will hand over content. If you say “I want the content of the e-mail inbox of Joe Blow at whatevermail.com”, they're not going to get that without a warrant. We've heard in the debates over Bill C-30 that this is not private information. In fact it is. I believe you have a privacy interest in your activities online, and I think most Canadians would agree. Most of the debate, I think, turns on that particular question.

[Sean Casey, Liberal, Charlottetown, PE]

The minister appeared before committee last week and said this immunity that is contained in this section is not new. It's been there since 2004. It's enshrined in the common law. It's also part of the Criminal Code.

Can you respond to that? Is this something that is new? Is this something that should be of concern to those who value their privacy? Is it a further encroachment above what was there before Bill C-13 comes into place?

[David Fraser]

My first question when I saw it and heard the debate about it is that if this is already the law, why are we putting it in the law? It really does beg the question. It must be doing something.

When you pull it apart and look at all of its different pieces, it says that you will have no liability for doing something that you're not prohibited from doing; it doesn't say you'll have no liability for something that you're lawfully able to do.

Words matter in legislation. I don't need to tell anybody in this room that's the case. But in fact that difference in words actually has a significant impact. It allows the person requesting the information to say to the telco that nothing'll happen to you if you hand it over; just hand it over.

In privacy you're talking about matters of degrees, and you're talking about expectations and things like that. So in theory, to follow the logic of the other arguments, a law enforcement agency could ask a telecommunications company, please give me the names, addresses, phone numbers, IP addresses, and e-mail addresses of every single one of your customers. We can lawfully ask that. Under that extreme reading of PIPEDA, they could hand that over. I would say they would be civilly liable for intrusion upon seclusion under the law for doing that. They're not prevented from it or prohibited from it according to that reading of PIPEDA.

So that would allow them to do that, and I'm not sure we want to encourage that sort of behaviour. If you can convince a judge that you're entitled to that for a lawful purpose, then absolutely, fill your boots, you're entitled to it. But that sort of behind the scenes, in the shadows, with no accountability causes me great concern.

[Sean Casey, Liberal, Charlottetown, PE]

Let's come back to the accountability aspect. So I, as a customer of a telephone company, have no opportunity to provide consent to the release of my private information upon request by anyone. I also have no right to know that my information has been disclosed to anyone.

I asked the minister about that, and he said, well, that's a contractual matter as between the telephone company and its customer.

What are your views on that?

[David Fraser]

That would be a misreading of PIPEDA. If law enforcement or anybody asked for information, and it's provided under paragraph 7(3)(c.1) of PIPEDA, and the customer then says “Did you hand over my information?”, the telco, the service provider, has to go to the law enforcement agency and ask them for permission to hand over the information. It has nothing to do with the terms of service with the customer. It's the legislation that imposes the gag order in that particular case.

There are thousands of requests for customer information. We heard the number of 1.2 million last week. In the vast majority of those cases, unless charges are laid and the information is part of the crown disclosure, the individual never finds out. They have no idea. So all of this happens in the shadows, and I think accountability to the person who it concerns is of prime importance.

[The Chair, Conservative, Mike Wallace]

You have a few seconds left.

[Sean Casey, Liberal, Charlottetown, PE]

Isn't it true that there actually aren't individual requests? What actually happens is the telephone companies and Internet service providers set up a separate file that they give law enforcement the authority to access. So there actually aren't individual requests. They've made their own protocol as to what they can have at.

Is that not the way it actually plays out?

[David Fraser]

My understanding is that of that number of 1.2 million, a large portion of them relate to a special law enforcement database that is essentially the same as Canada 411, where it's non-private information. It's stuff that would already be in the phone book, but it's just immediately up to date and it's accessible.

I'm not so worried about that lump of requests. I'm much more worried about the other more intrusive ones that are hidden within it that we don't have any transparency into.

[The Chair, Conservative, Mike Wallace]

Thank you very much for those answers.

Our next questioner is from the Conservative Party, Mr. Goguen.

[Robert Goguen, Conservative, Moncton—Riverview—Dieppe, NB]

Thank you, Mr. Chair.

Thank you to all of the witnesses for coming and testifying today, and thank you, Ms. Guthrie, from faraway Toronto.

I want to follow up on Mr. Dechert's question. He didn't get the answer he was looking for, not because you couldn't provide it but because you didn't get the chance. He was giving you the example of, look, somebody witnesses a sexual assault and picks up 911; how does that differentiate from an IP provider voluntarily giving some information? Why would there be liability on one and not on another? I don't see any distinction, really. Is it a question of the reasonable expectation of privacy or....? Guide me here.

[David Fraser]

I'm happy to, but I don't think the two are analogous at all. The reason is that if I as a private citizen see a crime taking place, I don't have a legal duty to, but I certainly can pick up the phone, call 911, and report it.

[Robert Goguen, Conservative, Moncton—Riverview—Dieppe, NB]

But if you suspect it.... I mean—

[David Fraser]

Or even if I suspect: any private citizen can do that. Because I'm not subject to PIPEDA. I'm not an organization subject to privacy legislation, and I don't have a contractual relationship with the people in that room who say, “I will keep your information private.” What you're talking about, on the other hand.... Also, if I call 911, that's at my own volition. That's me deciding to do so, and actually, the law doesn't compel me to; I can perversely stand there and watch it happen. But that's neither here nor there.

When it comes to law enforcement knocking on the door of an organization that's subject to privacy legislation and asking them to hand over information voluntarily, they have to ask themselves: “Can I do this? Can I do this under my terms of agreement with my customer? Can I do this under the telecommunications legislation? Can I do this under privacy legislation?”

If everybody in this room has a problem with privacy legislation and a problem with that scenario, then debate it and deal with it in the privacy legislation, rather than in something that we're being told is just restating the status quo but in fact changes the status quo with these sorts of things.

[Robert Goguen, Conservative, Moncton—Riverview—Dieppe, NB]

As it stands, there's nothing that can compel the provider to provide the information. They can very well say no, that they're not interested in providing that, so please go get your warrant. Correct? There's nothing that engages them to have to provide this, right?

[David Fraser]

The provider can do that and, in my view, the provider should do that, but again, it's an important distinction between who is reporting the crime and who is being asked for the evidence.

[Robert Goguen, Conservative, Moncton—Riverview—Dieppe, NB]

All right. You've clearly set out the difference. That's good.

What about the agreements between the customers and the providers? To your knowledge, are there any agreements that providers use—you seem quite versed in it—that would authorize them to disclose something that might be illegal?

[David Fraser]

Certainly, and again, the distinction is when the police request it rather than at the initiative of the organization.... In a number of the cases that are reported where the police have asked for customer information without a warrant, when it finally goes to trial, it's not the telco that's on trial in these cases—

[Robert Goguen, Conservative, Moncton—Riverview—Dieppe, NB]

Correct.

[David Fraser]

—it's the accused, with respect to whatever their activities were. The crown will point to the terms of use of the Internet service provider if it's to their benefit to do that.

In some cases, some Internet service providers put in black and white in their terms of service that they reserve the right to provide information to law enforcement under certain circumstances and that may be triggered, the idea being not because it has anything to do with the service provider, but that it reduces the expectation of privacy on the part of the individual with respect to their charter rights, with that section 8 of the charter being engaged.

It's a bit of a legal fiction, because I don't know whether anybody in this room has actually read the terms of service they have with their service provider—

[Voices]

Oh, oh!

[Robert Goguen, Conservative, Moncton—Riverview—Dieppe, NB]

That's why I asked.

[David Fraser]

—but certainly it has been pointed to as a basis for diminishing that expectation. I guess it takes three to tango, in that case.

[Robert Goguen, Conservative, Moncton—Riverview—Dieppe, NB]

Yes, and I wonder if that would suffice to exempt them from civil liability. Probably not.

[David Fraser]

It would depend upon the form of liability. Certainly, one can consent, as long as it's informed consent, to what would otherwise be an intrusion upon your seclusion. If you agreed that somebody could do something to you that would otherwise be an invasion of your privacy, it would be very likely that this would be the defence set up with respect to any sort of lawsuit. It wouldn't be immunity per se, but it would be that your case would lose, so it's effectively the same result.

[Robert Goguen, Conservative, Moncton—Riverview—Dieppe, NB]

Maybe because of the contractual provisions the immunity may not even be required, depending on how strong the wording is.