Science

Online surveillance bill may breach privacy law, charter

A new bill that would require telecommunications providers to give police subscriber information without a warrant will likely be challenged in the courts if crucial changes aren't made, critics say.

Experts offer suggestions for privacy safeguards

A new bill that would require telecommunications providers to give police subscriber information without a warrant will likely be challenged in the courts if crucial changes aren't made, critics say.

"A court challenge, I think will be inevitable, if this law passes as is," said University of Ottawa law professor Michael Geist, who holds a Canada Research Chair in internet and e-commerce law.

"I think the more immediate question is whether or not the government is prepared to consider amendments to this legislation."

How sensitive is subscriber data?

Under the new bill, police, intelligence and Competition Bureau officials can obtain from telecommunications service providers, without a warrant, customer names, addresses, telephone numbers, email addresses, internet protocol (IP) addresses, and a local service provider identifier.

Police officials have denied that they will be able to see the content people have accessed and say they therefore can't "track" people with this data.

But Chantal Bernier, assistant privacy commissioner of Canada, said that according to her office's technologists, the six easily obtainable types of subscriber data are enough information to identify a person and track where he or she goes online.

Ken Anderson, assistant privacy commissioner of Ontario, said the information can be used to build a profile of what sites someone has been to and what they've been doing on the internet.

The "protecting children from internet predators act," introduced in the House of Commons Tuesday, is similar to previous bills designed to give police and intelligence officials new powers to access digital communications. All the previous bills died when the minority governments that proposed them fell and elections were called.

Compared to similar, previous bills, the new one contains more provisions for oversight and reduces the types of information available without a warrant from 11 to six. Critics say those are positive steps.

But many are still concerned that the bill would provide warrantless access to six types of telecommunications subscriber data, including names, addresses and internet protocol addresses.

Chantal Bernier, assistant privacy commissioner of Canada, said the government has not made a convincing case that this is necessary to protect public safety and is proportionate to the necessity. She questioned whether it would effectively address the problem and if there were no alternative that poses less of a privacy invasion.

"If it doesn't meet the tests, then it does not conform to established principles of privacy law in Canada," she said.

She added that her office would make that clear to Parliament if changes are not made to address the problem.

Micheal Vonn, policy director for the B.C. Civil Liberties Association, said the bill changes the amount and type of information that police need to justify searches. It will therefore likely be challenged on the basis that it violates Section 8 of the Charter of Rights and Freedoms, which protects against unlawful search and seizure.

Police argue that they need subscriber data in a hurry to find people who are suicidal or luring children over the internet. At the moment, they can request that information from telecommunications service providers, but it is up to the company to decide whether to provide the data without a warrant.

Current system not working as hoped: police

Murray Stooke, deputy chief of the Calgary police, told CBC's Power and Politics that the current system hasn't worked as well as police had hoped. Some service providers will only hand over the information in cases of child exploitation, but require a warrant for extortion or robbery cases, he said.

A person's identity and IP address can be used to build a profile of what sites someone has been to and what they've been doing on the internet, Canada's and Ontario's assistant privacy commissioners say. (Associated Press)

But Geist questioned whether that's a bad thing.

"To me, that's a feature, not a bug," he told CBC's As it Happens.

He noted that law enforcement statistics show telecommunications providers comply with police requests voluntarily in 95 per cent of cases.

Meanwhile, government and law enforcement officials say the new bill provides for more oversight and accountability compared to the current system.

Currently, any police officer can request customer data from telecommunications providers, said Stephen Tanner, chief of Ontario's Kingston police. The new bill says only trained, designated staff can make requests. They will also have to record the requests for audit purposes.

Bernier said the mandatory audits are an improvement over previous legislation and could discourage abuse, but suggested the oversight comes too late in the process.

"They are still coming into play after there could have been a violation of privacy," she said.

The privacy experts offered their suggestions for privacy safeguards that could be built into the legislation.

Bernier wants the warrantless access provision to be reworded to make clear that it can only be used in the context of suspicion of criminal activity.

Both Geist and Bernier think telecommunications subscriber information should be protected with some judicial oversight, and they suggested that if getting a warrant takes too long, perhaps a faster, alternative system could be put in place specifically for obtaining subscriber information.