In the fall of 2007, Public Safety Canada quietly launched a lawful access consultation that envisioned mandatory disclosure of customer name and address information. After I posted the consultation online, the department claimed that the consultation was not secret and then-Public Safety Minister Stockwell Day suggested that the document actually contained old Liberal wording. Day promised not introduce legislation compelling disclosure without a court order, a commitment that Peter Van Loan, the next Public Safety Minister, rejected when the Conservatives introduced their first lawful access bill in 2009.

This third post on Spencer (case summary, comparison with government talking points) begins with some lawful access history because it is important for understanding what might come in the aftermath of the Supreme Court of Canada’s evisceration of the government’s arguments on voluntary disclosure of personal information in the Spencer decision. The starting point for the voluntary disclosure provisions in Bills C-13 and S-4 can be traced back to the 2007 consultation. Law enforcement complained about inconsistent access to customer name and address information and sought new provisions to make such disclosure mandatory (PIPEDA permitted voluntary disclosure but did not require it).

Public Safety responded with a plan to create a mandatory disclosure provision, but hit a roadblock when Day promised no warrantless disclosure. Once Day was shuffled out of that position, the Van Loan and Vic Toews lawful access bills both brought it back, with Van Loan’s bill specifying 13 identifiers that would be required to be disclosed and Toews’ bill slimming the list down to six identifiers. Both bills did not proceed past first reading: the Van Loan bill died with an election call weeks after it was introduced and the Toews bill was infamously shelved after the public outrage over the bill and Toews characterization of either siding with the government or child pornographers.

After then-Justice Minister Rob Nicholson promised no Criminal Code reforms based on the Toews bill (another promise that did not last long), the government adopted a different approach. If mandatory warrantless disclosure was out (the Spencer decision makes it clear those provisions would have been struck down as unconstitutional), a more robust voluntary disclosure system might do the trick.  PIPEDA already contains voluntary disclosure provisions, which are used thousands of times every year.  The government envisioned expanding the current system by offering full criminal and civil immunity for voluntary disclosures in Bill C-13 and expanding the scope of voluntary disclosures to public officials (in C-13) and any private sector organization (in S-4). The Privacy Commissioner and other experts argued against the changes, but the government relied on claims that disclosure was permitted by law (now debunked by the Supreme Court) to support the policy.

All of which raises the question of what comes next. With the Spencer decision, the expanded voluntary warrantless disclosure strategy is effectively dead. Law enforcement will not seek voluntary disclosure (except in exigent circumstances) since it is likely to be treated as an illegal search and the resulting information will be inadmissable. In any event, telecom companies will no longer provide customer name and address information on a voluntary basis since that is likely to be treated as a violation of Canadian privacy law.  With no one seeking voluntary disclosure and no one providing it, the C-13 and S-4 provisions have been neutered by the Supreme Court. In fact, the immunity provision now seems inoperable since it is contingent on a lawful voluntary disclosure, which customer name and address information is not.

The government could adopt the “bury our heads in the sand approach” by leaving the provisions unchanged, knowing that they will be unused or subject to challenge. That would run counter to the spirit of the Supreme Court ruling and do nothing to assist law enforcement. The better approach would be to directly address the problems in the bills and the current legislation. The first involves voluntary warrantless disclosure of subscriber information. Those provisions in C-13 and S-4 should be dropped from the bill. Moreover, the existing PIPEDA provisions should also be eliminated. In their place, a new subscriber information warrant could be developed that ensures court oversight, an appropriate standard given the Supreme Court of Canada’s finding of the privacy import of such information, and a system to allow law enforcement to apply for a subscriber information warrant expeditiously.

Second, the transmission data warrant (typically referred to as metadata) in C-13 should be amended as many recommended to the committee. Numerous witnesses (myself included) argued that the reason to suspect standard was too low given the privacy implications of metadata and that the reason to believe standard was more appropriate. Given the Spencer decision, the transmission data warrant is a court challenge waiting to happen and adopting the higher standard would provide far more legal certainty.