Industry committee  Sure. Thanks. The Spencer decision, as I think we've all recognized and have seen raised now concerning a number of bills and committees, finally brought to a head a long-standing, simmering issue around the question of whether there was a reasonable expectation of privacy and subscriber information.

Industry committee  Sorry, do you mean mandatory security breaches, or the transparency report?

Industry committee  Sure, to start with transparency reporting, I think what we've learned over the last year is that privacy has become a major issue for many Canadians. It's the enormity of disclosures that are taking place without any sort of awareness. This is happening, frankly, I think to all of us.

Industry committee  We've seen a couple of the largest telecom companies in the country, such as Rogers and Telus, start to do it. We've seen smaller players like SaskTel and TekSavvy do it. I think it's clearly doable. We've seen larger players on the global stage that face far more complicated circumstances.

Industry committee  Sure. Just to reiterate some of the opening remarks that I made along those lines, I think we've actually seen a lot of people come forward and express concern about the particular provision. But specifically in regard to the Privacy Commissioner's comments—and I thought it was a good question—as I noted in my opening remarks, I frankly think it's almost an unfair burden to say where's the evidence of harm from Alberta and B.C. when people are kept in the dark about when these disclosures take place.

Industry committee  Thank you, Mr. Chair. Good morning. My name is Michael Geist. I'm a law professor at the University of Ottawa, where I hold the Canada research chair in Internet and e-commerce law. I've appeared before this committee on a number of occasions on digital policy issues, including privacy, and I appear today, as always, in a personal capacity representing only my own views.

Justice committee  The issue that I think a lot of people have raised is both in the context of the bill and also in the context of the revelation of there being over a million requests for this information. So while Mr. Turk has asked whether people are phishing and stuff like that, I'm not accusing people of phishing, but I know there are requests for 750,000 user accounts to be disclosed on an annual basis.

Justice committee  —and all the providers, every single one, said that they did not notify those disclosures to the underlying customer.

Justice committee  I think we need to do a couple of things. Earlier this year all the major telcos were asked in a letter sent out by many in the privacy community in Canada to disclose some of their practices. We need to recognize that they all declined to do so citing Solicitor General rules, and generally saying that if the government told them to make these kinds of transparency disclosures they would, but otherwise they felt inhibited from doing so even on an aggregate basis.

Justice committee  Sure, and I certainly agree with what Mr. Turk had to say. I think it likely is that potential liability coming around to class action, but at the same time, I would suggest that if we take a look in totality around the privacy policy issues, both with this bill and with Bill S-4, those actually suggest that the government is promoting and pushing towards more voluntary warrantless disclosure.

Justice committee  Thanks for that. My only response was going to be that we're in agreement. We both agree victims, especially in the cyberbullying context, need to have recourse and need to have appropriate tools. My only point in raising the issue was that victims of privacy breaches are of all ages and from all different walks of life.

Justice committee  With respect to the specific question on what is an IP address, in some ways it's our location on the Internet. That same IP address can disclose—and I commend the Privacy Commissioner's report on this—more than just the computer or the device we happen to be using, because that information gets placed in many places all around the Internet.

Justice committee  Thanks for the question. I think there is enormous concern about the kinds of disclosure we've seen. I should note that even that number of 1.2 million probably doesn't fully reflect the number of requests that are out there. As you know, that was a request that came out of the Office of the Privacy Commissioner of Canada, and the telecom companies refused to provide individual responses.

Justice committee  Thank you, Mr. Chair. Good morning. As you heard, my name is Michael Geist. I'm a law professor at the University of Ottawa. I have appeared many times before committees on digital policy issues, including privacy, but I appear today in a personal capacity, representing only my own views.

Industry committee  The concern would arise when you have something that is legally made or licensed in one jurisdiction and someone tries to license a similar or the same product in multiple places. We had a major Supreme Court of Canada case at one time, believe it or not, over chocolate, which was licensed for sale in Europe, and then similar chocolate, namely Toblerone, was licensed for sale here.