If Prime Minister Mark Carney’s election was meant to be a rejection of authoritarian trends south of the Canadian border, things are not off to a good start.
That’s Robert Diab’s conclusion given what’s been rolled into Bill C-2, the government’s Strong Borders Act, tabled in June.
While past governments have unsuccessfully attempted to make it easier for police to access Canadians’ private data, specifically the subscriber information attached to an internet service provider account or an internet protocol address, he says the current government’s kick at the legal access can is in a league of its own.
“(The provisions) do more to expand the state’s power to access private data in Canada than any law in the past decade,” Diab, a professor of law at Thompson Rivers University, specializing in law and technology, and constitutional rights, wrote in a piece for Tech Policy.
In an interview with National, he says he was surprised by how many new search powers have been rolled into the omnibus bill, how extensive they are and how many are unrelated to border security.
Among the lawful access provisions buried among border security measures, the bill proposes expanding the legal definition of subscriber information. While there’s currently no definition in the Criminal Code, in 2014, the Supreme Court of Canada in R v Spencer defined it as “the name, address, and telephone number” of a customer associated with an internet protocol (IP) address.
Last year, in R v Bykovets, the Court went a bit further, defining subscriber information as “the name, address, and contact information” associated with an individual IP address.
The definition proposed in C-2 includes “information that the subscriber or client provided to the person in order to receive the services,” “identifiers assigned,” and “information relating to the services provided to the client.” This would capture types of services, information that identifies devices and equipment, account numbers and pseudonyms.
‘Astonishing breadth of demand’
The definition isn’t restricted to information associated with an IP address, nor is it just aimed at internet service providers. The bill empowers police and Canada’s spy agency to make an information demand to any “person who provides services to the public, or any subscriber to the services of such person.” That could include everything from a hospital, a women’s shelter, a psychiatrist or a financial institution.
Of particular concern is that these demands can be made of a service provider without a warrant or any judicial authorization as long as there are reasonable grounds to suspect a federal offence has been or will be committed, which the sought information will help investigate.
“I think it’s quite astonishing the breadth of the demand here,” says Michael Geist, the Canada Research Chair in Internet and E-Commerce Law at the University of Ottawa’s Faculty of Law.
“The problem is that there are really an unlimited number of potential uses.”
He wonders about physicians and lawyers, who have ethical and legal obligations to keep that kind of information secret, as it’s either privileged or subject to intense privacy rules.
“Are we expecting lawyers to have to go to court to maintain solicitor-client privilege every time there’s a request?
The irony is the suggestion that there’s some significant problem with the status quo that requires law enforcement to get a warrant for this information, given the large number of requests made yearly through the existing system. According to Rogers’ annual transparency report, in 2023, the company received nearly 169,000 requests from a court order/warrant for customer information. Shaw received more than 1,100 such requests. Customer information was shared by Rogers in more than 160,000 cases, and by Shaw in 1,425 instances.
As the Supreme Court noted in…
Privacy 2024 Recap – some significant decisions, slow progress for reform
The past year saw a few court decisions of note as well as halting progress toward privacy…
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
