Thank you very much.
Thank you very much for providing me with the opportunity to speak with you and the committee today.
For the purposes of introduction, my name is David Fraser. I'm a partner with the Atlantic Canadian law firm McInnes Cooper, but I do need to emphasize that I'm here speaking as an individual. My comments and opinions shouldn't be attributed to my firm or its clients or other organizations with which I'm associated.
I've been practising Internet and privacy law for over a dozen years now. I've represented a range of clients over the years, including victims of cyberbullying, victims whose intimate images have been posted online, and I have represented and advised service providers.
Most notably, I was part of a team at my firm that took the case of a 15-year-old girl, a victim of cyberbullying, to the Supreme Court of Canada. This was the first time that the court had the opportunity to consider the phenomenon of cyberbullying, and the unanimous court came out very strongly to protect the interests of this victim of sexualized cyberbullying. But I've also advised people who have been accused of cyberbullying, and I hope that this experience from a number of different perspectives will provide this committee with some assistance in its very important task of considering Bill C-13.
First, looking at the bill as a whole, I'm disappointed that Bill C-13 combines two very different but related matters: the dissemination of intimate images on one hand, and law enforcement powers more generally on the other hand. Both aspects raise very important issues that merit close scrutiny, but we're seeing the debate about police powers as overshadowing the discussion about cyberbullying. That said, we do have one bill in front of us and I'm pleased to provide you with my thoughts.
It has been suggested that Bill C-13, if it had been enforced, could have saved Amanda Todd and Rehtaeh Parsons and other young people. That makes a good sound bite, but the world is much more complicated than that. The creation, possession, and dissemination of child pornography is and was a crime. So is the creation, possession, and dissemination of voyeurism images. So is extortion. So is criminal harassment. So is sexual assault. But that said, there is a gap that we should fill, which is the malicious dissemination of intimate images without the consent of the person depicted in them, regardless of the age of the person depicted in the image.
We need to be very careful about how we craft this offence, however. The current reality is that young people and adults, whether we like it not, take photos of themselves and voluntarily share them with intimate partners. Those digital images can easily be spread around without the consent of the person depicted. We want to criminalize the boyfriend who posts pictures of his ex-girlfriend online without her consent, the so-called revenge porn. We want to criminalize the actions of the person who forwards around images of current or former intimate partners. In each of those cases, the individual would know, or ought to have known, whether they had the consent of the person depicted in those images.
But we need to be cautious. We shouldn't inadvertently criminalize behaviour that's not blameworthy. Someone finds a picture online of someone naked—I understand there are pictures of naked people on the Internet—and forwards it to a friend. That person knows nothing about the circumstances in which the photo was taken. It could be a professional model. The photo could have been posted by the person in the photo herself. There's no way to tell whether consent was obtained, whether there was any expectation of privacy at the time that the image was created, and the individual, in this case the accused, would have no way of determining this, would have no way of contacting the person in the image to find out. So the real challenge arises when addressing third parties who do not know the person depicted in the image, nor do they have knowledge of those circumstances in order to figure it out.
The provisions in the bill use a recklessness standard, which in my view is too low. Recklessness applies where a person should have looked into it but decided to be wilfully blind. However, given the huge number of images online, it's not possible to look into it. This is especially important for online service providers, who have no way of knowing and no way of finding out the circumstances under which an image was taken or uploaded. We need to be especially attentive to crafting the law so that it will survive a challenge in the courts, and recklessness poses a risk of having a law struck down or making criminals out of people who are not truly blameworthy.
Turning now to the part of the bill related to police powers, the first one that I'd like to speak about is transmission data. Bill C-13 creates a production order for transmission data and warrants for transmission data recorders. It has been said that the purpose of the transmission data provisions of the bill is to extend the current police powers—which are coupled with judicial oversight, I'm very pleased to see—related to telephone information and move that over to the Internet age, the idea being without significantly altering the status quo, simply altering or modernizing what's already an existing police power.
While this may be a very reasonable objective, this must be done also very carefully, because transmission data in the Internet age is very different from transmission data in the traditional plain old telephone system. With conventional telephony, transmission data refers to the number called from, the number called to, whether the call was connected, and how long that call lasted.
In the Internet context, the amount of information that's included in the kind of out-of-band signalling information and what it reveals is dramatically different. It would include the IP address of the originating computer, the destination computer, information about the browser that's being used, information about the computer that's being used, information about the URL, the address being accessed, which can actually disclose content, even though the definition of transmission data is intended to exclude that.
It will also tell you what kind of communications are being done. Is it an e-mail communication? Is it an instant message? Is it peer-to-peer file sharing or otherwise? So it provides much more insight into actually what is going on than just phone number information.
An interception of transmission data would tell law enforcement agencies whether the target of surveillance was visiting a search engine, an encyclopedia site, a poker site, or a medical site. Furthermore, the data would provide greater insight into the likely physical location of the surveillance target. This is a dramatic expansion of the information that's provided and available, compared to traditional telephone communications.
As anybody in this room knows, I expect, the way we use computers today is dramatically different from the way we used telephones 15 years ago. We use them as spellcheckers. We use them to find out facts. We use them for a much wider range of activities. With the disclosure of greater information through these transmission data orders, you're revealing much more about an individual. Even though the definition excludes content, just the transmission data tells you a lot more about really what's going on.
I would suggest this can be fixed by either raising the standard from reasonable grounds to suspect to reasonable grounds to believe with respect to this data, or re-crafting the definition of transmission data, so we're sure that we are, in fact, paralleling what is intended, which is to take the telephony tool and move that into the modern Internet age.
I would also note that in all of these orders—again, I'm pleased that they're subject to judicial oversight and judicial approval—there is no mechanism in these for notifying the individual after the fact that their information has been accessed, which I think is something that happens with respect to wiretap orders. Certainly it happens with respect to search warrants. I believe that should be extended into this environment as well for these sorts of production orders.
Finally, I would touch very briefly on the issue of service provider immunity that's touched on within this statute. I find this to be gravely problematic. I think it's a very cleverly crafted provision. We're told that this is simply for greater certainty, but it goes beyond that. Everything we know suggests otherwise.
It says that you will not be liable for handing over any data that you're not prohibited by law from handing over, and if you do so you're civilly immune. Now, only the criminal law and other regulations create prohibitions against handing over information, but you can hand over information when you're not legally prohibited and still incur civil liability. Civil liability is there for a reason. I may not be legally prohibited from accidentally driving my car into yours, but if I do that, you're entitled to damages from that. I should be paying for the harm that is caused.
If there were an immunity provision that said you could not sue me if I did something that was not legally prohibited, that would be squelched. That would go away. So this provision, I believe, should be removed. It can't be fixed and will only encourage overreaching by law enforcement.
In conclusion, while we don't have Bill S-4, the digital privacy act, in front of us, that fits together with the immunity provisions. I'm concerned that the two taken together will extend the amount of information not only available to law enforcement but will extend the information available to other civil litigants and others. Although I understand it's not within the jurisdiction of this committee, I flag the fact that Bill C-13 and Bill S-4 do, in fact, fit together, and somebody should look at that interrelationship.
Thank you very much for this opportunity to speak with you today. The cyberbullying provisions are an important step forward and will, if properly tweaked, address this very serious problem. The rest of the bill needs to be very closely examined to ensure that it does what it is supposed to do and nothing more. It should be about providing the police with appropriate tools, with adequate thresholds and accountability, and judicial oversight, but not redrawing the line with respect to personal privacy.
I very much look forward to discussing this issue with you further. Thank you.
