Thank you.
When a production order is requested and the officer believes that there is a reason to pursue or to inquire, SAAIA does not appear to draw any practical distinction between the data of a person who is the subject of a production order and the data of innocent people who share an account with that person. I see that as a significant gap.
Most Canadians share phone plans, cloud storage and digital accounts with family members. A production order targeting one person on a shared account does not stop at that person's data. It pulls everything on that account, including the private information of people who have never been suspected of anything and have no idea that an order was ever made. The bill may intend for providers to limit disclosure to what is ordered, but the technical reality of shared accounts is that one person's data cannot always be practically separated from another's.
Canadian law already recognizes this principle in other contexts. A joint bank account holder cannot be compelled to hand over funds or information belonging to the other holder simply because that person is under investigation. Why does that protection exist at the bank, but when it comes to a telecom or digital service provider through which a family shares an account, the technical architecture makes that same separation nearly impossible? What enforcement mechanism in this bill ensures providers actually achieve it?