Government snooping on social media may breach Privacy Act

Canadian social media users might have some unexpected followers lurking on their Twitter feeds — data-mining agents of the federal government, according to a report from the privacy commissioner.

But while Treasury Board President Tony Clement defended the digital surveillance in question period as fair "in a day and age when Canadians willingly put information about their opinions" online, privacy and legal watchdogs argue that publicly accessible domains such as Facebook and Twitter should be free from state snooping.

If not, they say, the practice could violate Canada's privacy laws.

"Certainly it's a breach of the spirit of the Privacy Act," said Avner Levin, director of the Privacy and Cyber Crime Institute at Ryerson University.

The act dictates that government departments can only collect personal information if it "relates directly to an operating program or activity of the institution." It adds that, with some exceptions, government institutions "must inform the individual of the purpose" of collecting their data.

"Our government, as a liberal democracy, has to justify why it's collecting any kind of information [on the public]," Levin said. "In a rule-of-law system, they have to answer for why they would be creating databases like that. What's the point? How are they going to be using it?"

Unanswered questions by government

Those are questions the government hasn't answered, said Christopher Parsons, a post-doctoral fellow at the University of Toronto's Citizen Lab, which focuses on human rights, IT and global security research.

When we share on Facebook, we think we're sharing with our friends. We don't think we're sharing everything with some faceless government bureaucrat in Ottawa using our tax dollars to snoop on us- David Christopher, OpenMedia

"This is information that's been collected without Canadians knowing, and as the privacy commissioner noted, without clear reason," said Parsons, an expert on state surveillance tools.

"This government is saying they should be able to access public information just like anybody else, but that confuses how Canadian law works."

Parsons said, once information is made public, Canadians maintain a "privacy interest" in the material. 

For example, even though license plate numbers on cars are clearly visible to all, Canadians expect those plates will not be tracked or monitored outside of their intended purpose.

• Chantal Bernier says Ottawa snooping on social media
• Ottawa snooping on social media: CBC readers weigh in
• State surveillance under microscope

The same goes for Facebook's 1.28 billion users worldwide, Levin said.

Although the social media activity is publicly accessible, he said, it's often meant for an "intended audience" of Facebook friends.

In a letter to interim privacy commissioner Chantal Bernier on Thursday, Clement reiterated that the personal data being collected was "publically [sic] available" and helped the government "engage in conversations" with the public.

Criticized in Cindy Blackstock case

Parsons said Clement's reasoning is "disappointing" and misses the nuance of Canada's privacy legislation.

The privacy commissioner addressed that point last year in her investigation into the surveillance of First Nations activist Cindy Blackstock, whose social media feeds were monitored by the Department of Justice and Aboriginal Affairs and Northern Development.

In her report, Bernier wrote: "It turns out that the misconception that people surrender their right to privacy by posting on Facebook is unfortunately still breeding to some degree within government circles."

David Christopher, a spokesman with OpenMedia, a community-based organization dedicated to protecting online rights, said the data collection illustrates "how out of touch" senior government officials are with privacy in the digital era.

"When we share on Facebook, we think we're sharing with our friends. We don't think we're sharing everything with some faceless government bureaucrat in Ottawa using our tax dollars to snoop on us," he said.

As for how the government might use the information it's collecting, Parsons said the purposes could be as "benign" as the Prime Minister's Office monitoring social media to understand how voters are reacting to government policies. 

It could also be used for law enforcement or shared with other government departments, he said.

Another major concern is the accuracy of any data being collected.

Bernier's letter to Clement said it was "incumbent" upon the government to verify information culled from social media sites, particularly if it's used to make "administrative decisions about individuals."

Accuracy of information in doubt

The internet is often unreliable, however.

"People lie on those sites all the time — about their age, about anything," said Lisa Stam, a Toronto-based privacy lawyer who specializes in employment and social media law. "I can't imagine how you would assess the credibility of evidence that you've collected on social media sites without testing it properly."

Stam said the underlying principle of privacy law is that the purpose for which information is gathered must satisfy a "consistent use" provision — or a plausible link to the original purpose for which the information was obtained.

• Data privacy recommendations unveiled by White House
• Private data given to feds limited to 'basic' information, Bell says

"Collectively, we have agreed that the government will provide certain services to us, so they need certain information to do that," she said. "I want them to take care of me when I go to the hospital and regulate my life. But the purpose of collecting that information has to be consistent with how it will be used."

The digital generation is also redefining what "private" means, and the laws need to catch up, Stam said. Just as diners at a restaurant have an expectation for privacy that no strangers will sit down and begin recording their public conversations, society appears to be broadening what a private space means on the internet.

"When you think about, especially the next generation that has spent their whole life online, why shouldn't they be able to carve out that expectation of privacy online as well?" she said.

The privacy commissioner has said it's becoming more important for the government to develop guidelines clarifying privacy protections when it comes to collecting publicly available information from social media.

In his letter to Bernier, Clement said the government is sensitive to the need to respect privacy concerns of Canadians, and that his staff are studying the matter to report back to him in the coming months.