Evidence of meeting #40 for Public Safety and National Security in the 45th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was c-22.
A video is available from Parliament.
Executive Director, OpenMedia
We'd not be comfortable. It's still incredibly valuable and incredibly personal data.
It's every person you've spoken with for 90 days and every place you've gone to for 90 days. That's actually an enormous picture of your life. Not only is that a bit concerning to hand to law enforcement, but if and when—and when is likely—that data is compromised, it's a huge amount of personal information in the hands of bad actors and on the dark web, potentially permanently.
Bloc
Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC
Mr. Hatfield, it takes time to gather the documents needed for an investigation. Furthermore, we would certainly like to see malicious individuals arrested. Don't you think it's unreasonable to say that there should be no data retention at all?
Executive Director, OpenMedia
There's a reason that very few of our allies do this. It's constitutionally questionable. It's the fact that it creates a pre-emptive collection of data from many millions of Canadians at once on every service that is scoped in.
We don't normally do surveillance of everyone just in case it proves useful. Normally, the process would be that if there's a warranted crime occurring, then perhaps you might start surveillance. That's how the traditional system works, and that would be a more appropriate system.
Liberal
The Chair Liberal Jean-Yves Duclos
Thank you very much, Mrs. DeBellefeuille.
Mr. Gill for five minutes.
Conservative
Sukhman Gill Conservative Abbotsford—South Langley, BC
Thank you.
This is an open-ended question to all the witnesses here today. Thank you for being here.
Does it feel rushed to you that we don't have enough time to study part 2? Could each of you respond to that, please?
Chair, Privacy and Access Law Section, Canadian Bar Associaton
I'll respond briefly.
This is one of our conclusions. There are too many pieces, and the risks are too high for all Canadians and all the parties involved. We recommend more consultations with different stakeholders.
Counsel, Canadian Constitution Foundation
I would echo that broadly. Again, I don't know what precisely it takes for parliamentarians to achieve what they need to achieve, but my sense in reviewing the bill is that it's about the sheer scope of words. I'm speaking as a former English major now, but it's about the number of words. I mean this in not too cute a way, but there are many verbs in this bill—“use”, “access”, “take”—and these are not trivial words. They are extraordinarily broad. They just are.
It's been quite a task to review this bill. I've had to review it countless times, at this point, and at no point have my worries been assuaged. I think much more time is needed just to go through some of these basic definitions.
Conservative
Sukhman Gill Conservative Abbotsford—South Langley, BC
I agree, 100%. Thank you for that.
Mr. Hatfield, could you please provide a response as well?
Executive Director, OpenMedia
Look, this is the most dangerous surveillance bill I've seen in more than 10 years of doing this work in Canada and even in other democracies. It has not gotten nearly enough time. If we had realized, I guess on a resource limit, that our brief was being held up and wouldn't reach you before you considered amendments, of course we would have gotten it in your hands by another way sooner. Certainly, you need to take more time to assess the weight of evidence here and realize that the weight of evidence is overwhelmingly against proposed part 2.
Conservative
Sukhman Gill Conservative Abbotsford—South Langley, BC
Yes. It is quite upsetting to be in kind of a dark hole and not have the information we need that is so crucial to the study.
I have one quick question for you, Mr. Hatfield. In an open letter of yours, your company argued that certain aspects of the bill would “create an unprecedented and extraordinarily dangerous surveillance architecture that could impact every digital tool people in Canada depend on every [single] day”.
Could you please expand on the specific aspects of Bill C-22 that you believe pose greater risks for Canadians' privacy and cybersecurity, and which amendments would most improve the proposed framework of this?
Executive Director, OpenMedia
This gets back to the definition of “electronic service provider” and how enormously open-ended it is. The government has refused to put clear limits on that. The government, of course, can scope folk in as a core service provider for undefined reasons in the future. The baseline definition of electronic service provider includes basically everyone who handles data. Of course, the minister has the power to issue any of the orders requiring any of the features it requires of a core provider or of a non-core provider in the future.
We continue to realize just how extraordinarily broad this is in scope. Does that mean the minister would abuse it on day one? No, not necessarily—but having it so broad textually is very problematic.
Conservative
Sukhman Gill Conservative Abbotsford—South Langley, BC
Thank you very much.
I would like to allocate the rest of the time to my colleague Roman Baber.
Conservative
Roman Baber Conservative York Centre, ON
This is for the Canadian Bar Association, following up on Mr. Caputo's question on seizure.
The issue is not that a third party is holding on to the metadata. It's the fact that it's holding it by virtue of a government order, effectively. It doesn't matter if a school principal is holding on to the contents of a student's locker by virtue of police direction or government direction. That's a seizure. If a gym is holding on to my gym bag because the cops asked them to, they're an agent of the state, and therefore there is seizure. Am I correct in that respect?
Conservative
Roman Baber Conservative York Centre, ON
To follow up, some people are making the argument that there is no production because the metadata never left the Internet provider, but the production is in the holding. It's already defined because the service provider is ordered to hold it. Effectively, it's defined data and defined information. Am I wrong on that?
Chair, Privacy and Access Law Section, Canadian Bar Associaton
The problem is not only the holding. It's all the risk from holding all this and the potential access—
Conservative
Roman Baber Conservative York Centre, ON
I'm not talking about risk. I'm talking about the law. I'm talking about the fact that by virtue of its being held, defined and filed away, that amounts to the level required to meet a breach of section 8.
Chair, Privacy and Access Law Section, Canadian Bar Associaton
According to our study, yes, but I need to check—
Liberal
The Chair Liberal Jean-Yves Duclos
Thank you, MP Baber. That was short, indeed.
MP Sodhi, you have five minutes, please.
Liberal
Amandeep Sodhi Liberal Brampton Centre, ON
Thank you, Mr. Chair.
Thank you to our witnesses for being here today.
Ms. Saad, from a legal standpoint, how do you suggest that we balance the safety and security of Canadians with the concerns your organization has raised?
Chair, Privacy and Access Law Section, Canadian Bar Associaton
You will receive it eventually, but in our full submission we propose certain amendments, although we highlight many risks, as I mentioned.
Part 2 of the bill is really problematic, and it needs additional amendments to strike this balance that you are referring to.
Liberal
Amandeep Sodhi Liberal Brampton Centre, ON
If you're able to, can you elaborate on some of those amendments? We don't have the brief right now.
Chair, Privacy and Access Law Section, Canadian Bar Associaton
I've mentioned the ministerial orders that we recommend be struck.
Another recommendation is on systemic vulnerability. We recommend an amendment to the definition. We recommend really focusing on and mentioning the encryption part to clearly carve out the encryption. We recommend the following: “Systemic vulnerability” means a vulnerability in an electronic protection that creates substantial risk of confidentiality, integrity, availability of information or services. This is one of the other amendments.
I mentioned the question of the involvement of the electronic service providers, where they are involved without compensation and without holding all the risk. We also recommend that the minister should have to justify, on a per order basis, the need for secrecy associated with these orders. These are some of the recommendations as well.
For inspection powers, we recommend including a threshold of reasonable and probable grounds before designated persons can enter the premises. We elaborate on some of these. As well, for the audits, we recommend that further procedural safeguards be included.
In several sections in our submission, we also highlight the judicial overview and the possibility of appeal and judicial review.
These are some of the recommendations in our submission.