Public Safety Committee on June 9th, 2026

[Sima Acan, Liberal, Oakville West, ON]

It's only 305 pages.

[Jacob Mantle, Conservative, York—Durham, ON]

It's actually over 800 pages, but I won't read it.

I presume, Ms. Gibner, that you're familiar with Ruth Sullivan's The Construction of Statutes. She's the authority. Is that right?

[Kimberly Gibner, Deputy Assistant Deputy Minister, Policy Sector, Department of Justice]

I agree.

[Jacob Mantle, Conservative, York—Durham, ON]

I'll read a couple of sections on understanding exhaustive definitions and non-exhaustive definitions. She actually has—I was surprised by this—a specific section on when a statute has the words “means” and “including” in it, so we'll start there.

She wrote:

Exhaustive definitions declare the complete meaning of the defined term and completely displace whatever meanings the defined term might otherwise bear in ordinary or technical usage. An exhaustive definition is generally introduced by the verb “means”. For example, in Part 2 of the Canada Transportation Act, “tariff means a schedule of fares, rates, charges and terms and conditions of carriage applicable to the provision of an air service and other incidental services”. This definition resembles the ordinary meaning of “tariff” in the context of air transportation. Nonetheless, the statutory definition displaces any understanding of the term based on dictionary definitions or linguistic intuition.

That's the exhaustive definition. She continued:

Non-exhaustive definitions do not purport to displace the meaning that the defined term would have in ordinary usage; they simply add to, subtract from or exemplify that meaning. Non-exhaustive definitions are generally introduced by “includes” or “does not include” (or “excludes”), as in the following examples:

sell includes agree to sell, or offer, advertise, keep....

Non-exhaustive definitions are used to expand or narrow the ordinary meaning of terms, to deal with borderline applications of terms or to illustrate their range—

[The Chair, Liberal, Jean-Yves Duclos]

Excuse me, Mr. Mantle. I'm not an interpreter, but given how quickly and intensely you're speaking, the interpreter must be having a hard time keeping up.

[Jacob Mantle, Conservative, York—Durham, ON]

That's a fair point, Mr. Chair.

The text continues:

Non-exhaustive definitions are used to expand or narrow the ordinary meaning of terms, to deal with borderline applications of terms or to illustrate their range of application by setting out examples.

That makes sense.

In the last section, Ms. Sullivan describes examples in our situation, where we have “means” and “includes” in the same clause. She said:

A statutory definition stating that a defined term “means and includes” something would be confusing since it would imply that the definition both displaced ordinary meaning (means) and relied on it (includes). However, a definition that first uses “means” to stipulate a definition that displaces ordinary meaning and then uses “includes” to enlarge, narrow or illustrate the stipulated definition makes sense and is a conventional drafting technique. In such a case, the defined term applies to anything that comes within the stipulated definition regardless of whether it also comes within the meaning of the words that follow “includes”....

This is where it gets a little tricky, because there seems to be some disagreement at the Supreme Court on this. I won't go through all of it, but she makes reference to the Entertainment Software Association case. She notes, “It is not always obvious whether a list that follows ‘includes’ is meant to expand the scope of the stipulated definition or merely illustrate it.” She then quotes Justice Abella's majority in that case and Justice Rothstein's dissenting opinion. I won't read them, but they're there.

After reading that, I was still unsure, to be honest. Maybe if I had spent some more time considering it, I would have been more comfortable. What I have proposed solves this, in my mind at least, because we're simply going to say, in the current clause, “means” in the chapeau, and in each subclause, we'll remove “including” and use the word “namely” to denote an exhaustive list.

I would like your view on this, Ms. Gibner or Mr. Wong, or whoever else would like to comment. In my view, by doing so, we've made it doubly clear that the amendment's purpose is to say the classes of subscriber information that are listed in that clause are exhaustive.

[Kimberly Gibner]

I'll start.

I would take a step back and remind myself what the subscriber information provides to people who provide services to the public. It's not going to be one-size-fits-all, which means that the information needs to not be an exhaustive list. It needs to be an exhaustive definition that could have varying components or examples of it.

Ms. Sullivan said it was a good drafting technique. That's a thumbs-up from Ms. Sullivan that we did a good job by putting in the chapeau. It must mean information used to identify the subscriber, and then they're giving examples of what that could look like. It has to be non-exhaustive, as it were, because service providers capture identifying information in different ways.

I am personally comfortable with that because it is a judicially authorized warrant where the police will have to go to a judge or a justice, identify the kind of information they want and set out how the reasonable grounds to suspect test is met in order to fall into those rubrics. That's how I would answer the question. Mr. Wong may have further things that might help you.

[Normand Wong]

Thank you.

I will just add that it is a convention that we use in the Criminal Code. The third thing that you read by Ruth Sullivan is exactly what this is. It's a class definition. The defined classes are proposed paragraphs (a), (b), and (c) before the “including”, and all the “including” is supposed to do is give examples of what a class covers.

The issue with making it “namely” and adding an exhaustive list in the paragraph (b) category is that you leave out things like IP addresses that are assigned, so important bits of information would be lost. When I mentioned future-proofing last time, it wasn't about being vague; it was about not using terminology, as Ms. Gibner just said, that is inappropriate for all service providers and may be left out.

I also made the comment that if we were to do something like that and make it an exhaustive list, the definition would have to be rebuilt into something to make sure that we don't miss important bits of information the police need for doing their investigations.

[Jacob Mantle, Conservative, York—Durham, ON]

Okay. I think we're getting somewhere on understanding what the clause was intended to mean, which, in my view, reinforces why I wanted to move the subamendment. Whether you agree with it or not, that's fine. We can differ on that.

Just to clarify, though, Mr. Wong, the BQ-3 amendment does include IP addresses, so that's not accurate. That was also included in the Privacy Commissioner's recommendation. Narrowing it to a finite list of discrete identifiers does include IP addresses. It's just written out—Internet protocol address—in the clause. That's an important bit of information, but it would be included.

I just want to push back a bit on the idea that if we create an exhaustive list, we're going to hamstring ourselves in the future. From a philosophical position, my view would be that that's okay; that's the law-making process. Parliament passes law. Those who utilize it or implement it do so. Then the courts interpret it, and then it flows back to Parliament to say, “Does it need to be...?” If Parliament is not satisfied with the law or with how it's operating, then we can legislate again.

I think there can be good-faith disagreement on how the feedback loop—if I can describe it as a feedback loop—in the legislation-making process—the enforcement and then the interpretation—should work. Different laws take a different view on that, including whether there's regulation-making ability or whether agencies develop policies to interpret their own.... There's a whole spectrum of how that works.

I would say that it's a fine result. I think you need to make a more persuasive argument to me that says in this specific case, having the non-exhaustive list here, then requiring the police to give feedback to Public Safety and then requiring Public Safety to bring that to Parliament through the appropriate channels is not the best way to do that, for whatever reason. I haven't really heard that.

The evidence I will put to you for why I haven't heard that is that at our last meeting, I asked you, Ms. Wong and Ms. Gibner, if there was anything not included in this definition that you thought needed to be included, and you could not give me any examples. Then I asked Sergeant Gilkes, and your response was, “I think that the categories cover most of the identifiers that I would look for.”

The evidence you have provided to the committee is that the list is actually pretty good. It covers what we understand to be what police, Public Safety and CSIS need right now. If in three or five years it changes, that's great. Come tell us, and Parliament can consider changes.

To me, that's a good balance, because right now without the amendment, as we've established, we're talking about it meaning subscriber information, but the subcategories are non-exhaustive, so more things could be included. I think that's why the Privacy Commissioner honed in on this—I think so, but I don't know, and this is why I'd like someone here so that I could ask them—and suggested that a lot of information could be required. It's not just that it's a lot of different types of information. It's that the different types of information that could be required attract different levels of privacy. The Privacy Commissioner makes this point by saying, “Depending on the nature of the services in question, such information could reasonably attract a heightened expectation of privacy.”

Would you disagree with this, Ms. Gibner? Depending on the class of information and subscriber information, there may be different expectations of privacy attached to that. Is that fair?

[Kimberly Gibner]

No, I wouldn't agree with that statement. I want to take a step back to when you were asking about the Privacy Commissioner.

What we have done at the Department of Justice and at Public Safety is come up with legislation that has built-in privacy considerations. That's the Privacy Commissioner's mandate, as your colleague pointed out. Law enforcement have a mandate. You will recall that Hunter v. Southam set out that section 8 protects a “reasonable expectation of privacy”, not “all expectations of privacy”. Law enforcement and privacy interests have to be balanced in the analysis.

We came up with this legislation after already thinking that through. It is now up to the committee to think through whether we got that calibration right.

What we did when we came up with that definition is think about subscriber information more broadly. It's not an exhaustive list because of the services provided to Canada. We can't possibly identify every single way services characterize subscriber-type information. The category of subscriber information itself, more generally, is calibrated in such a way to target information in a minimally intrusive way, one that provides law enforcement with basic information about services, like name, address and the things we can think about today. My friend calls it future-proofing. When the digital world becomes an AI world, that language might not be exactly the same, but it is basic identifier information.

[Jacob Mantle, Conservative, York—Durham, ON]

I'm having trouble with that. You're suggesting that all the classes of subscriber information in the definition attract the same level or expectation of privacy.

[Kimberly Gibner]

Yes, I would say that.

[Jacob Mantle, Conservative, York—Durham, ON]

How would you reconcile that with the Supreme Court saying that, for example, an ISP would attract a high level?

[Kimberly Gibner]

Again, if I take a step back, you will recall that before Spencer, before 2014, the Supreme Court of Canada said of subscriber information that there was no reasonable expectation for that kind of data. Plant is the case you might recall. In 2014, Spencer changed the world. Spencer said that subscriber information does have a reasonable expectation of privacy when it's attached to an IP address you can link to online activity.

You need to think that through as government in terms of judicial authorization. People can't do it voluntarily, which is what happened before that. That's what the legislation before you is about. It is about a judicially authorized warrant to obtain this subscriber information now.

[Jacob Mantle, Conservative, York—Durham, ON]

Regarding the definition of “subscriber information”, your view is that name, telephone number, email address, identifier assigned to a client, account numbers and types of services all attract the same expectation of privacy.

[Kimberly Gibner]

That would be my view.

I would refer you to the Criminal Code, where a similar provision already exists. To situate you, part of the balance we're talking about when we say “privacy rights” and “law enforcement” is built into a Criminal Code that already exists. I would refer you to section 487.018, which is about financial data. It might assist the committee to review that provision, because it's along the same lines, MP Mantle, of what you're asking me. What sort of reasonable expectation of privacy do these things have? They list all sorts of information related to your finances that is accessible with the standard of “reasonable grounds to suspect”. You need a court order. You need to get it judicially authorized. The police need to have reasonable grounds to get that. That is the type of information that I would call subscriber information.

Again, I'm suggesting this to you because it's going to be you who has to decide. Financial information seems a bit more.... If we're comparing, you're trying to ask, “Is there a gradation, Kim, on kinds of information?” I would suggest that this is your marker.

I just wanted to point that out, if it assists you.

[Jacob Mantle, Conservative, York—Durham, ON]

This is helpful. I feel a bit outgunned here, but I'm trying my best.

I'll put one case to you, Rodgers, in which the court said, “Since individuals have different expectations of privacy in different contexts and with regard to different kinds of information and documents, it follows that the standard of review of what is “reasonable” in a given context must be flexible”.

Putting that over the broader framework of different categories of privacy interests, the “biographical core”—I think that is one of the phrases the court has used—of personal information can reveal their choices, their habits and their lifestyles. Tell me if I'm wrong here, because I'm not—

[Kimberly Gibner]

That's correct.

[Jacob Mantle, Conservative, York—Durham, ON]

All right. Good.

I would think that some of the information in the definition of “subscriber information” could relate to that biographical core—for example, “the types of services provided”.

In my view, then, proposed subparagraph 487.011(c)(i) might actually attract a higher expectation of privacy than another part of that definition. That's why I'm having trouble with your perspective that everything in here attracts the same expectation of privacy.

Do you disagree with where I'm going on this, or are we just going to...?

[Kimberly Gibner]

I understand your question, and my responses are trying to assist you. I'm not sure what would assist you, but maybe talking to your RCMP witnesses here about the types of services.... You typically look at the types of services. We're thinking of the telco example: “Do you have cable? Do you have one phone or do you have two?”

Out of all of the different kinds of applications, nothing is coming to mind that would be able to answer your question any better, but maybe you have something you're thinking about that we can respond to.

[The Chair, Liberal, Jean-Yves Duclos]

I would kindly and respectfully suggest that if you do have questions related to your subamendment, you may want to pose them. My subjective impression is that we are running a bit outside of the topic of the subamendment by looking at what are other important issues possibly, but not focusing on the subamendment.

[Jacob Mantle, Conservative, York—Durham, ON]

That's fair. Let me bring it back.

The reason this discussion is important is that by simply saying “the types of services provided”, as we are here, we elicit, as Ms. Gibner correctly stated, the common-sense reaction that those are services provided by the telco. However, it's not limited to that, because we know, as we just established, that these proposed subparagraphs are non-exhaustive illustrative lists.

It's not just about the information that the telco has on you. It could be, for example—and I'll put it to you—a service related to hotels or an escort service that someone might have engaged. I suspect that would be different from saying, “Telco, do you provide them services?”

I don't know whether the RCMP or CSIS has any colour they want to add to your point. My point is that this being non-exhaustive leaves it open such that some of the information may have a lower expectation of privacy and for some it may be higher, and when we get to the discussion of the standard, that will also play a role there.

Mr. Burchill or Mr. Gilkes, go ahead.

[Richard Burchill]

I'm sorry. Just to be clear, what's the question?

[Voices]

Oh, oh!

[Jacob Mantle, Conservative, York—Durham, ON]

It's about trying to understand what you think services provided....

I don't appreciate the laughter.