Appeared in the Toronto Star on November 1, 2014 as Had the Tide Turned on Canada’s Privacy Embarrassment

In a year in which privacy issues have captured near weekly headlines, one concern stands out: warrantless access to Internet and telecom subscriber information. From revelations that telecom companies receive over a million requests each year to the Supreme Court of Canada’s landmark decision affirming that there is a reasonable expectation of privacy in subscriber information, longstanding law enforcement and telecom company practices have been placed under the microscope for the first time.

Last week, the Privacy Commissioner of Canada released a report that shed further light on the law enforcement side of warrantless disclosure requests, raising disturbing questions about the lack of record keeping and politically motivated efforts to drum up data on the issue.

The Office of the Privacy Commissioner of Canada notified the Royal Canadian Mounted Police last October that it was planning to conduct preliminary investigative work on the collection of warrantless subscriber information from telecom companies. The plan was to assess RCMP policies and to determine the frequency and justification for warrantless requests.

Despite interviewing dozens of personnel, investigators were unable to obtain specific numbers as the RCMP simply did not compile the requested information. When asked why the information was not collected, law enforcement officials noted that its information management system was never designed to capture access requests.

While that may help explain the absence of data, investigators also found that the RCMP issued an internal memorandum in 2010 instructing officers to begin collecting such information. Why the change in approach?

It would appear that the new policy was directly linked to lawful access legislation that was facing public criticism over provisions that would have required telecom and Internet companies to disclose subscriber information without a warrant (the law at the time permitted voluntary disclosure but left discretion over whether to disclose to the telecom or Internet provider). Critics of the lawful access bill noted that there was little evidence that mandated disclosure was needed. In response, the RCMP attempted to pull together the missing data, but later abandoned the effort when the lawful access bill died on the order paper.

When combined with non-transparent telecom provider policies and government legislative initiatives seeking to expand disclosure, the RCMP revelations should give all Canadians concerned with their informational privacy pause. We now know that entering this year, law enforcement and government departments were requesting access to subscriber information without a warrant over a hundred thousand times every month. We also know that telecom companies were keeping their responses to the requests secret, that law enforcement was not tracking its access requests, and that the government was determined to expand the system by encouraging voluntary disclosure of personal information through a pair of bills that are still before Parliament.

Despite the sorry state of subscriber privacy at the start of 2014, the situation has improved in recent months. Pressure on the telecom companies to offer greater transparency on their practices has led both Rogers and Telus to regularly disclose aggregated data on subscriber requests. Moreover, the Supreme Court of Canada’s Spencer decision confirmed that there is a reasonable expectation of privacy in telecom and Internet subscriber information.

Those are positive steps, yet at least three major issues remain unresolved. First, there are still some telecom companies that have not issued transparency reports, most notably Bell Canada, the country’s largest telecom provider.

Second, the RCMP remains somewhat coy about how it plans to address warrantless disclosure requests in the future. As part of the Privacy Commissioner of Canada investigation, it undertook only to study mechanisms for reporting requests. Potential recommendations are not due until April 2015.

Third, the government remains committed to encouraging voluntary warrantless disclosure of subscriber information. Justice Minister Peter MacKay’s Bill C-13, which is now at the Senate, grants full civil and criminal immunity for organizations that voluntarily disclose personal information to law enforcement, while Industry Minister James Moore’s Bill S-4, which will be studied later this month by the House of Commons Industry Committee, expands voluntary warrantless disclosure between private sector organizations.

Michael Geist holds the Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, Faculty of Law. He can be reached at mgeist@uottawa.ca or online at www.michaelgeist.ca.