Thank you, Mr. Chair.
Members of the committee, thank you for having us here today.
Allow me to introduce myself. My name is Marcel‑Olivier Nadeau, and I am the president of the Barreau du Québec. I am accompanied by Michel Marchand, a member of the Criminal Law Experts Group, and Nicolas Le Grand Alary, a lawyer with the Secretariat of the Order and Legal Affairs of the Barreau.
The Barreau du Québec thanks you for inviting us to take part in the consultations on Bill C‑22. Let us recall that the mission of the Barreau du Québec is to protect the public, to promote accessible justice and to defend the rule of law. It is in that capacity that we are speaking today.
To begin, I would like to remind you of a fundamental principle. The concept of the rule of law is at the heart of our democracy. It requires that state powers be exercised, particularly in criminal investigations, within a framework, predictably and subject to independent judicial review. It also requires that laws uphold the fundamental rights guaranteed by the Canadian Charter of Rights and Freedoms, including the right to privacy and protection against unreasonable search and seizure. This balance is not theoretical. It is essential to maintaining public trust in our institutions.
The Barreau du Québec recognizes the legitimate objective of the bill, which is to modernize investigative tools in an ever-changing digital environment. We are nonetheless concerned about several provisions that could undermine fundamental rights, particularly when it comes to privacy and constitutional guarantees. Our goal is therefore to improve the bill so that it achieves its objectives without compromising the principles central to the rule of law or provoking court challenges.
Our recommendations focus on four main points.
First, the definition of subscriber information is too broad. The bill provides a very broad definition that is likely to reveal sensitive personal information when combined with other data, such as a person's name, alias, address, phone number and email address. The Supreme Court has also reminded us that the reasonable expectation of privacy must be analyzed in the current social and technological context, in which a massive quantity of data is collected, cross-referenced and retained. As a result, even isolated information can reveal a great deal when combined with other information.
Furthermore, the lack of a clear definition of the term “person providing services to the public” increases the risks of the invasion of privacy, as it allows for broad interpretation and potentially abusive applications. In the absence of legislative safeguards, this generic wording is likely to apply to a wide range of entities. That includes not only Internet service providers, but also companies and organizations with sensitive personal information.
This wording also creates uncertainty for the entities concerned, which could be forced to pass on sensitive information without clearly knowing whether they are legally required to do so. We recommend clarifying and narrowing these definitions to avoid overbreadth.
Second, the bill sets out an insufficient legal threshold for obtaining production orders. Under the bill, certain orders could be authorized on the basis of “reasonable grounds to suspect”, which is a lower threshold than is generally required for infringements of fundamental rights.
Let us not forget that the Supreme Court has established that subscriber information has a high level of constitutional protection, warranting rigorous judicial oversight. In our opinion, by stipulating the lower standard of mere suspicion, which does not require probability but only a reasonable possibility that an offence has been or will be committed, the bill does not meet constitutional privacy requirements. We therefore propose that, as with other similar orders currently in the Criminal Code, the threshold of “reasonable grounds to believe” be considered.
Third, there is a lack of judicial oversight in certain situations. Indeed, in certain cases, the bill allows for voluntary disclosure of information without judicial authorization, which we consider a significant departure from traditional safeguards in criminal law.
Let us not forget that even information that is considered “basic”, such as a subscriber's contact information or IP address, can, when linked to other elements, provide a detailed profile of the person in question. In this regard, the courts have found that it is imperative that the disclosure of this information be accompanied by procedural safeguards, including the requirement for prior judicial authorization. We recommend removing these mechanisms or, at the very least, requiring prior judicial oversight in all cases.
Fourth, the protection of solicitor-client privilege and computer data is at risk. The bill makes useful changes for the review of computer data. We maintain, however, that there should be a requirement that the extraction of computer data must be carried out by a person whose only role in the investigation of the offence in question is precisely to extract that data. That would be an effective way to avoid contamination of the investigation and, at the same time, to preserve solicitor-client privilege, which is a principle of fundamental justice as defined in the Canadian Charter of Rights and Freedoms.
