Thank you very much.
Thank you for inviting me to appear on behalf of the Privacy and Access Council of Canada, an independent, non-profit, non-partisan organization that is not funded by government or industry.
Our members, like everybody in this room and the rest of us who use the Internet, can thank Sir Tim Berners-Lee, whose brainchild became the web we know and love—or love to hate. It's a source of news and views, ones that might be at odds with our own, where we can freely find and share information. It is that very freedom that is now under threat, with democratic governments leading the charge.
Canada's government has said that controlling Internet content is vital to protect democracy and social cohesion and has pointed to the January 6 insurrection in Washington, D.C., which by all accounts was organized online. It has crafted several laws to protect us from potential danger.
Of course, Bill C-26, which is one of them, is to provide a framework for the protection of the critical cyber-systems that really are vital to national security and public safety. Bill C-26 allows Canada to take strong action against threats to the security of its telecommunications sector, but also so very much more. To start, it applies to six critical infrastructure sectors, but that is just the start.
As referenced by Ms. Baron, any service, system and class of operator can be designated as a vital service or system. Every company is at risk of falling under the bill's sweeping powers, and being required to do, or refrain from doing, anything they are ordered to do, such as create back doors and break encryption or go on a fishing expedition to find whatever information the government wants—including what's in your emails and your texts, your cellphone and vehicle locations, purchaser or purchasing information, or donor details—so that it can make an order. The order will be secret until the target realizes something is up, because just disclosing the existence of orders made under this bill will be illegal.
With a nod to eastern European regimes 100 years ago, this bill lets the minister compel any person, under threat of punitive fines, to provide any information, within any time, subject to any conditions that might be specified, or authorize anyone to enter and seize any information and systems, but without the checks and balances that are a mainstay of democracy.
Notably, there is no requirement for those timelines or conditions to even be achievable. The bill does not limit compelled information to corporate or operational. There is reason for that, but it provides a dragnet for unsupervised collection, use, and broad disclosure of personal information, threatening individuals' privacy and making it impossible for organizations to comply with privacy laws or provide accurate responses to access to information requests.
Sadly, the bill makes no mention of consulting the Privacy Commissioner to ensure that personal information is adequately safeguarded. While the bill specifies that corporate information may be designated as confidential, it offers no such consideration for personal information. The bill's vague language opens the door to telcos and ISPs being given unreasonable orders to spy on or deny service to any person, company or group whose conduct or commentary the government deems a threat to the security of Canada.
To encourage voluntary compliance, the penalties are steep and unaffordable by all but the largest of organizations. In the manner of the Salem witch hunts, anyone who fails to pay the penalty or dispute the notice, and anyone who does pay, is “deemed to have committed the violation”. Either way, businesses pass their costs and fines along to consumers, so penalties will reduce competition by eliminating organizations that can't afford the fines. Consumers will end up covering the penalties paid by those that are large enough to afford them.
Incentives like that can be a strong motivator. Some would call it coercive, since companies and people eager to retain their hard-earned money and avoid fines are easily nudged to simply do as they're told, while the government will be shielded from claims of overreach, since it won't be the government but the organizations voluntarily complying with orders that will be the ones violating charter-protected freedoms.
In our view, allowing Bill C-26 to become law in its current form, and granting elected representatives and unelected bureaucrats overly broad and unaccountable authority, will further undermine public trust in the government, public service and federal institutions, and further foster a technocracy built on Sir Tim Berners-Lee's brainchild. Canadians deserve better.
We would be happy to help by providing additional information and suggested amendments.