Privacy lawyers expect a “dramatic” increase in warrantless disclosures of personal information by Internet service providers if the latest proposed amendments to the Personal Information Protection and Electronic Documents Act take hold.
PIPEDA currently allows voluntary disclosures of personal information without consent to government institutions and investigative bodies for law enforcement and national security purposes. But lawyers say a clause in bill S-4, the digital privacy act, would significantly broaden both the circumstances in which organizations can make disclosures and the range of possible recipients. The bill passed second reading in the Senate in May. The next stage will see it head to the Senate committee on transport and communications for further study.
Section 10 of the bill would amend PIPEDA to allow disclosure without consent when it’s to “another organization and is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada or a province that has been, is being or is about to be committed and it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the investigation.”
“If this were to become the law, it would fundamentally change the current privacy protections that exist in our civil law regime,” says Ren Bucholz, a commercial litigator with Lenczner Slaght Royce Smith Griffin LLP.
“What’s quite frankly shocking to me is the way this would empower private companies to investigate private disputes using the tools in this bill. It would be amazing to me if these rules didn’t dramatically increase the amount of private subscription information voluntarily provided.”
In his defamation and intellectual property practice, Bucholz says he frequently ends up in court seeking data from Internet service providers in an attempt to identify anonymous bloggers and copyright infringers. He says bill S-4 could eliminate the need in many cases for Norwich orders that compel third parties uninvolved in litigation to disclose relevant information. It’s a situation he’s uncomfortable with.
“There are presently good ways to do this well and effectively. It just requires a judge to look at evidence and make a call as to whether or not it passes the sniff test. Here, you skip the judge and go directly to the record holder who has to judge for themselves whether or not what they’ve been told is accurate and reliable. You’ll get some brave record holders who say they have no capacity to make that judgment and ask for a court order, but others are going to take the easy route.”
Barbara McIsaac, a privacy lawyer and counsel to the Ottawa office of Borden Ladner Gervais LLP, says the most prudent course of action for an Internet service provider or other record holder facing a request under the proposed amendments would be to err on the side of requesting a court order.
“If you do simply turn over the information without considering whether the test has been met for disclosure, then you do face at least some prospect of civil liability,” she says.
According to McIsaac, there are plenty of non-litigation situations in which the proposed amendments would make life easier for private companies.
“Organizations such as insurance companies can become aware of individuals committing serial fraud and there has always been a concern that they were limited in the extent to which they could share information about those frauds. There are obvious advantages to being able to alert other people in the industry to a potential issue in a way that requires the disclosure of some personal information to make it understandable. But it’s also open to abuse, which is where the difficulty arises.”
John Simpson, a lawyer with intellectual property and new media law firm Shift Law in Toronto, says his initial concern about the bill has decreased over time. He says the fear of a public relations backlash will act as a natural bar to overzealous disclosure by Internet service providers and other record holders.
“They have commercial interests to protect. It would take a toll on goodwill or their ability to get new customers if they became known to be handing over private information willy-nilly,” he says.
“The permissiveness of the regime is a big safety mechanism. I would be much more concerned if there was some sort of obligation to turn this information over.”
But Bucholz says the secrecy built into the bill will make public scrutiny of record holders’ disclosure practices difficult.
“The other pernicious thing about this is they don’t have to tell the individual now or even later that the disclosure has been made about them,” he says.
“I would think a relatively minor change would fix that flaw. Even if there is no notice today, you could build in some requirement to notify within 30 days or some other time frame.”
McIsaac says it’s important to read bill S-4 in conjunction with another piece of government legislation currently before Parliament in order to understand the full extent of expanded warrantless disclosure of personal information. Bill C-13, the protecting Canadians from online crime act, contains provisions that would grant record holders immunity from civil or criminal liability related to voluntary disclosures made on request from police officers.
“The combination means that restrictions in legislation that were originally built around disclosure without a court order have been significantly weakened,” she says.
“The same committee will end up looking at both bills, so they’re hopefully going to make the necessary linkages.”
