Mr. Speaker, it is my pleasure to be here today to express my strong support for Bill S-4, the digital privacy act. This bill would make significant and long-overdue improvements to Canada's Personal Information Protection and Electronic Documents Act, or PIPEDA.
One question that has been asked repeatedly by members opposite is why the government is not amending PIPEDA in response to the Supreme Court of Canada's decision in Canada v. Spencer. They claim they cannot support the digital privacy act because the bill fails to act on this decision. Those are very strong words and it is clear that the opposition parties have not done their homework before speaking on this matter.
The answer to their question is quite simple. The government is not proposing amendments to PIPEDA in response to the Spencer decision because the Supreme Court confirmed that PIPEDA does not give the police any search and seizure powers. In fact, the whole purpose of the law is to increase the protection of Canadians' personal information.
Given the questions that have been raised around the Spencer decision, it is important that I take time today to clear up some of the misinformation. My hon. colleagues opposite do not need to take my word for it. They can always take the time to read paragraphs 71 and 73 of the decision themselves. The Spencer decision deals with a child pornography investigation carried out by the Saskatoon police department. As part of the ongoing investigation, police identified the IP address of a computer that was being used to access and distribute child pornography.
It is important to understand that the police were able to obtain the IP address simply by going online and interacting with the child pornographer, because computers make their IP addresses public whenever they engage in a file-sharing activity. With this IP address in hand, the police then asked the Internet service provider to voluntarily provide account information for the subscriber assigned to the IP address. The account information included the subscriber's name and mailing address. The police asked for the service provider's co-operation on the good faith belief that the subscriber did not have a reasonable expectation of privacy with respect to his or her basic account information, which is the individual's name and address.
With this information in hand, the police obtained a warrant to search the suspect's house, at which time a computer was seized and found to contain child pornography. Mr. Spencer was charged and convicted of possession of child pornography. Mr. Spencer appealed his conviction on the grounds that he had a reasonable expectation of privacy with respect to the account information obtained by the police. In other words, he argued that the police were required to obtain a warrant before getting his basic subscriber account information from his Internet service provider to make sure that his charter rights were respected.
In its decision, the Supreme Court found that Canadians in general have a reasonable expectation of privacy with respect to their Internet browsing habits and history. This is because the sites we visit and the online activities we engage in can reveal “intimate biographical details” about ourselves, details that we may wish to keep private. Because linking an IP address with a specific account holder enables the police to learn about and observe an individual's Internet habits, the court found in the specific circumstances of the Spencer case that the police should have obtained a warrant from a judge to collect Mr. Spencer's account information.
It is, however, important to note that because the police were acting in good faith, believing that Mr. Spencer did not have a reasonable expectation of privacy in his account information, the court did not exclude the evidence obtained by the police and Mr. Spencer's conviction was upheld.
These are the facts. It is difficult to see how this decision means that PIPEDA, the digital privacy act or Bill S-4 in some way violates the charter rights of Canadians, as the members opposite have asserted at every opportunity. This is blatantly false.
As I stated at the outset of my remarks, the Supreme Court confirmed that PIPEDA does not create any search and seizure powers for law enforcement. Nothing in the law compels companies to provide personal information to law enforcement and the digital privacy act would not change that fact.
Justice Cromwell stated in his decision, “In short, I agree with the Ontario Court of Appeal...on this point that neither...the Criminal Code, nor PIPEDA creates any police search and seizure powers”.
He said, “PIPEDA is a statute whose purpose” as set out in section 3 “is to increase the protection of personal information”. Justice Cromwell further clarified that there are clear restrictions that PIPEDA places on disclosures by private businesses to law enforcement agencies. He stated that even in child pornography cases, the circumstances “cannot override the clear statutory language of...PIPEDA, which permits disclosure only if a request is made by a government institution with 'lawful authority' to request the disclosure”.
This fact clearly demonstrates that PIPEDA prohibits unlawful disclosure unless the requirements of the law are met, including that the government institution demonstrates the necessary authority to obtain, not just simply to ask, for the information.
In addition to a warrant or court order, what might this lawful authority to obtain information include? Justice Cromwell stated:
“Lawful authority” may include several things. It may refer to the common law authority of the police to ask questions relating to matters that are not subject to a reasonable expectation of privacy. It may refer to the authority of police to conduct warrantless searches under exigent circumstances or where authorized by a reasonable law.
Justice Cromwell clearly noted that issues of disclosure and lawful authority arose in this case simply because the investigation was begun by police. This is simply not the case for private organizations. In his Supreme Court decision, Justice Cromwell wrote that, “...entirely different considerations may apply where an ISP itself detects illegal activity and of its own motion wishes to report this activity to the police”.
To summarize, this is what the Supreme Court said about PIPEDA in the Spencer decision.
PIPEDA does not provide law enforcement with any “search and seizure powers”.
Consistent with the charter, PIPEDA permits businesses to disclose personal information to law enforcement without consent in only the following circumstances: law enforcement have a warrant or a similar court order; the information is required to address an emergency, such as information that is needed to stop a crime in progress that threatens someone's life; the law enforcement agency is acting pursuant to a specific law that gives it the authority to obtain private information without a warrant; in response to a routine inquiry by law enforcement regarding information for which there is no reasonable expectation of privacy; or the organization, on its own initiative, provides the information to police to report a crime.
Clearly, the Supreme Court did not find any part of PIPEDA unconstitutional.
I hope that with this clarification, all hon. members will join us in supporting the digital privacy act Bill S-4, the digital privacy act, in ensuring that Canadians' personal information is protected.