Canadian Internet and telecom providers have, for many years, disclosed basic subscriber information, including identifiers such as name, address, and IP address, to law enforcement without a warrant. The government has not only supported the practice, but actively encouraged it with legislative proposals designed to grant full civil and criminal immunity for voluntary disclosures of personal information.
Last month, the Supreme Court of Canada struck a blow against warrantless disclosure of subscriber information, ruling that there is a reasonable expectation of privacy in that information and that voluntary disclosures therefore amount to illegal searches.
The decision left little doubt that Internet and telecom providers would need to change their disclosure policies. Last week, Rogers, the country’s largest cable provider, publicly altered its procedures for responding to law enforcement requests by announcing that it will now require a court order or warrant for the disclosure of basic subscriber information to law enforcement in all instances except for life threatening emergencies (warrantless disclosures may still occur where legislation provides the lawful authority to do so). Telus advised that it has adopted a similar approach.
The change in policy, which should ultimately be mirrored by all Canadian providers, will have a massive impact on how law enforcement operates and on the privacy of millions of Canadians. Simply put, the number of government requests for subscriber information has been staggering, most of which occur without court oversight.
A 2011 document supplied to the Privacy Commissioner of Canada advised of 1.2 million requests for subscriber information affecting roughly 750,000 account holders. While that revelation garnered media headlines across the country, a little-noticed 2013 document from Public Safety Canada released under the Access to Information Act indicates that in excess of a million requests annually has been standard for years.
The document states that ITAC members (the Information Technology Association of Canada that counts major telecom providers among its members) “handled 1,130,000 basic subscriber information requests annually from 2006 to 2008.”
As Canadian telecom and Internet providers race to comply with the law by reversing longstanding practices, law enforcement and the government must also catch up. Law enforcement will rarely seek voluntary disclosure (except in exigent circumstances) since it is likely to be treated as an illegal search and the resulting information will be inadmissible in court.
Meanwhile, Justice Minister Peter MacKay faces an important decision. With law enforcement not seeking voluntary disclosure of personal information and providers requiring a warrant, the government’s proposed immunity provision in Bill C-13 now seems inoperable since it is contingent on a lawful voluntary disclosure, which customer name and address information is not.
The Canadian government could adopt the “bury our heads in the sand approach” by leaving the provision unchanged, knowing that it will be unused or subject to challenge. That would run counter to the spirit of the Supreme Court ruling, however, and do nothing to assist law enforcement.
If the government is serious about providing law enforcement with the tools they need to address online harms, it will drop the voluntary disclosure immunity provision in Bill C-13 and its companion proposal in Industry Minister James Moore’s Bill S-4, which seeks to expand voluntary disclosure in non-law enforcement cases.
In their place, a new subscriber information warrant could be developed that ensures court oversight, an appropriate evidentiary standard given the Supreme Court’s finding of the privacy import of such information, and a system to allow law enforcement to apply for a subscriber information warrant expeditiously.
While government MPs were unmoved during committee hearings by repeated expression concerns from experts about the voluntary disclosure provisions, the Supreme Court decision effectively reshaped Canadian privacy law and has forced everyone to rethink longstanding practices. As Internet and telecom providers change their approach, the big question is whether the government is prepared to do the same.
Michael Geist holds the Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, Faculty of Law. He can reached at mgeist@uottawa.ca or online at www.michaelgeist.ca.
