My first question when I saw it and heard the debate about it is that if this is already the law, why are we putting it in the law? It really does beg the question. It must be doing something.
When you pull it apart and look at all of its different pieces, it says that you will have no liability for doing something that you're not prohibited from doing; it doesn't say you'll have no liability for something that you're lawfully able to do.
Words matter in legislation. I don't need to tell anybody in this room that's the case. But in fact that difference in words actually has a significant impact. It allows the person requesting the information to say to the telco that nothing'll happen to you if you hand it over; just hand it over.
In privacy you're talking about matters of degrees, and you're talking about expectations and things like that. So in theory, to follow the logic of the other arguments, a law enforcement agency could ask a telecommunications company, please give me the names, addresses, phone numbers, IP addresses, and e-mail addresses of every single one of your customers. We can lawfully ask that. Under that extreme reading of PIPEDA, they could hand that over. I would say they would be civilly liable for intrusion upon seclusion under the law for doing that. They're not prevented from it or prohibited from it according to that reading of PIPEDA.
So that would allow them to do that, and I'm not sure we want to encourage that sort of behaviour. If you can convince a judge that you're entitled to that for a lawful purpose, then absolutely, fill your boots, you're entitled to it. But that sort of behind the scenes, in the shadows, with no accountability causes me great concern.