My column this week on warrantless access to personal information under Canadian law noted that Bill S-4, the Digital Privacy Act, will expand the likelihood warrantless disclosures between private organizations. As I posted recently:

Bill S-4 proposes that:

“an organization may disclose personal information without the knowledge or consent of the individual… if the disclosure is made to another organization and is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada or a province that has been, is being or is about to be committed and it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the investigation;

Unpack the legalese and you find that organizations will be permitted to disclose personal information without consent (and without a court order) to any organization that is investigating a contractual breach or possible violation of any law. This applies both past breaches or violations as well as potential future violations. Moreover, the disclosure occurs in secret without the knowledge of the affected person (who therefore cannot challenge the disclosure since they are not aware it is happening).

Yet despite the plain language of the provision and the concerns from the Privacy Commissioner of Canada, Industry Minister James Moore’s office continues to insist that the concerns are unfounded. In response to the column, Jake Enwright, Moore’s press secretary responded with a tweet that the concerns were “false.”

I debunked many of the government claims on S-4 in this post. With respect to Enwright’s comment, it bears repeating that the Privacy Commissioner of Canada has stated:

we believe that the grounds for disclosing to another organization are overly broad and need to be circumscribed, for example, by defining or limiting the types of activities for which the personal information could be used

As for the impact of S-4 on warrantless disclosures, the bill plainly expands the ability of organizations to voluntarily disclose personal information without a warrant or court oversight. While some organizations will decline to voluntarily disclose such information, when combined with Bill C-13’s grant of full immunity for voluntary disclosures, it seems likely that others will provide subscriber information without a warrant or court oversight.  That will lead to an increase in warrantless disclosures. Simply put, government claims that such concerns are false do not stand up to even mild scrutiny.