Government alludes to lawful access oversight role for privacy commissioner

OTTAWA—The privacy commissioner could play a role in monitoring law enforcement and security agencies that use Canada’s proposed lawful access provisions, the federal government says. Public Safety Minister Vic Toews and Justice Minister Rob Nicholson announced Tuesday the government’s new lawful access legislation, Bill C-30, the Protecting Children from Internet Predators Act. In the last Parliament, the Conservative government introduced bills C-50, C-51 and C-52, collectively known as lawful access legislation, but they died on the order paper due to an election. The legislation was reintroduced in the House of Commons Tuesday as Bill C-30. The law would require Internet and mobile providers to disclose customer information without court-ordered warrants—such as names, addresses, phone numbers, email addresses, Internet protocol addresses, and device identification numbers—as requested by law enforcement authorities. Currently, ISPs can voluntarily disclose information about their customers to police but are not required to do so by law unless ordered by a court. At a press conference Tuesday, Timothy Smith, a spokesman for the Association of Canadian Chiefs of Police, told reporters that oversight provisions would be put in place to ensure police do not abuse the expansion of powers the new law would afford them. “There will be oversight so that every time this is used, the police will be accountable as to why they used it,” Smith said. He said not all officers would gain access to information obtained through the act, which gives police the ability to collect identifying data transmitted by Internet users on mobile devices or computers. That is a change from the previous version of the legislation, he said. “Our understanding is that, from previous bills, there will be certain officers that will be appointed to be allowed to do this. In fact it won’t be something that any officer can do,” Smith said. “There will be an auditioning process that will be in place,” he added, explaining how senior officials would determine which officers could use the powers granted under the law. Smith said the oversight and the auditing process could involve the federal privacy commissioner. Michael Patton, director of communications for the minister of public safety, told The Wire Report in an email that the bill would offer improved oversight over current data-sharing arrangements, which involve telecommunications providers supplying identifier information to police on an “ad hoc basis” without oversight or privacy protections. He said Bill C-30 would restrict the number of people who would have access to the information and that all requests would “be maintained in a written format with an explanation and subject to internal review.” Oversight would be provided by a “responsible minister or official,” he said. “A report including all the requests will be submitted to the responsible minister or official,” Patton wrote. “All requests are subject to external audit by the responsible privacy official.” Patton wrote that the appropriate privacy official would have an option to file a public report showing their audit results. Former versions of the lawful access legislation have been opposed by MPs and academics, as well as federal and provincial privacy commissioners, who say they fear the law would allow police to investigate any suspect at any time without a warrant. A report commissioned by the B.C. Civil Liberties Association, released last week, recommended oversight mechanisms to guard citizens against abuse. The new legislation, Toews said at a press conference, would force ISPs to provide requested information to authorities and maintain information activities or hold evidence for a period of 90 days. The government said in a release that Bill C-30 would require providers to “implement and maintain systems capable of lawfully intercepting communications in order to support the police and CSIS when it is needed.” Under the proposed law, the Conservatives said, telecom companies and providers would also be required to provide basic subscriber information to designated police, CSIS and Competition Bureau officials without a warrant. The information would be limited to a subscriber’s name, address, telephone number, email address, the Internet protocol address and the names of the service providers. Toews told reporters that email monitoring data, online conversations and web surfing could not be obtained without a warrant. He said Bill C-30 would require six “identifiers”—the electronic data signatures that identify individual subscribers—for police officers to obtain a warrant from a judge. Police currently need 11 identifiers to obtain a warrant, he said. “Rapid changes in technology mean crimes and national security threats are more difficult to investigate,” Toews said. “As a result, criminals, gangs and terrorists have found ways to exploit technological innovations and hide their illegal activities.” Toews said the legislation would give Canada’s law enforcement agencies, including CSIS, “the investigative tools they need to do their jobs and keep our communities safe.” He said Bill C-30 would also update offences in the Criminal Code to cover ways of committing crimes with modern technologies. Anne-Marie Hayden, a spokeswoman for federal Privacy Commissioner Jennifer Stoddart, issued a statement by email saying the commissioner is not necessarily opposed to legislation that modernizes police powers online, but said “it must demonstrably help protect the public, respect fundamental privacy principles established in Canadian law and be subject to proper oversight.” Hayden said that, on preliminary review of Bill C-30, the government has made improvements over previous versions of the legislation, but that privacy concerns remain. “We recognize that the government has reduced the number of data elements which could be accessed by authorities without a warrant of prior judicial authorization,” the statement said. “At the same time, by requiring authorities to conduct regular audits and to provide them both to the relevant Minister and oversight bodies, including our Office, this appears to help address past concerns about a lack of oversight.” The Privacy Commissioner’s Office said it continues to be concerned about access to subscriber information behind an IP address without a warrant. “Since this broad power is not limited to reasonable grounds to suspect criminal activity or to a criminal investigation, it could affect any law-abiding citizen,” Hayden said. In a release Tuesday, the Public Interest Advocacy Centre (PIAC) said the bill has “weak oversight” and “permits indiscriminate ‘fishing expeditions’ into consumers’ Internet use for any offence.” “This is not phonebook information that is being accessed,” John Lawford, counsel with PIAC, said in a statement. “These identifiers have never been publicly available at the consumer level.” Lawford said accessing identifiers and customer information “is not appropriate without a warrant because Canadians don’t expect such monitoring of the Internet use by the state.” NDP MP Charlie Angus said at a press conference on Parliament Hill Tuesday that Bill C-30 “will treat every law abiding Canadian citizen as a potential criminal.” Angus said the act would create a situation where the police can ask telecom providers to give the ISP addresses of any Canadian. “What that means, is that every single Canadian citizen is walking around with an electronic prisoner’s bracelet, which can be turned on at any time for any reason without justification,” he said. Angus said the bill would force telecom providers to build “spy mechanisms” into devices that would allow Canadian cellphone users to be tracked. He said the NDP is against the bill and will continue to fight it. With files from Yael Berger dgrenier@thewirereport.ca

Government alludes to lawful access oversight role for privacy commissioner

News | 02/15/2012 12:02 am EST

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us