Recent allegations that the Communications Security Establishment Canada has been tracking Canadians through free Wi-Fi networks and swapping information with foreign governments have focused the ongoing Internet privacy debate on the collection of metadata. Proposals for parliamentary oversight and the inclusion of metadata in privacy legislation are now on the table in the hope of protecting Canadians from illegal monitoring.
Metadata is data that describes the contents and context of data files. Far from being benign and anonymous, this so-called data about data may be extremely personal in nature. In fact, metadata can reveal a trove of information, including the location and numbers of all calls, texts or e-mails a person makes and receives. It doesn’t include the content of the communication, something that would require a warrant to intercept.
Stephen McCammon, legal counsel for the Ontario office of the information and privacy commissioner, believes metadata can be more revealing than listening to calls or reading e-mails. The federal privacy commissioner agrees. In a special report to Parliament in late January regarding privacy protection and oversight for the Canadian intelligence community, the federal office noted: “The very exchange of personal information itself generates still more personal information through profiles and metadata. Specifically, online communications create data trails that can paint a detailed picture of individuals.”
The issue first attracted broad public attention in 2013 when former National Security Agency contractor Edward Snowden exposed dozens of wide-ranging intelligence collection programs underway in several countries with concerns in Canada centring on a Communications Security Establishment Canada airport sweep.
“I understand it was a trial of technology for tracking individuals, basically picking them up at the airport and following them,” says David Fewer of the Canadian Internet Policy and Public Interest Clinic. “The CSEC said it was not personal information. We disagree wholeheartedly with that view. There are enormous privacy implications of the highest order. We need law enforcement and national security organizations to act more responsibly.”
Fewer sees it as a small example of a much bigger issue with respect to security institutions. “Plainly, we are in the early stages of calibrating what behaviour is appropriate to protect a free and democratic society.”
McCammon sees the issue as a global problem. “All the security organizations struggle with having good people who are committed to national security, but their interpretation of what is appropriate is occurring inside a hothouse. There is not enough sunshine and fresh air getting in. Security is important, but privacy and other fundamental rights have to be respected.”
He notes civil liberty groups, the judiciary, and legislators are all trying to play catch-up on the issue. “There is a need for vigorous public debate. Our office has been speaking out for some time that this data is inherently private.”
One of the questions now arising is whether privacy legislation should specifically classify metadata as personal information. Fewer doesn’t think so.
“In Canada, we don’t need that. The privacy commissioners are absolutely clear that metadata can be personal information of an identifiable individual. You can’t just strip the name and render it non-personal. Anonymous information can still be personal information under the legislation.”
The problem appears to lie in the larger regime that regulates intelligence bodies. “The body of law that bears on the privacy interest in metadata is not confined to privacy legislation,” says McCammon.
“It alone does not regulate law enforcement and security organizations,” he adds, noting other factors include the Criminal Code and the National Defence Act.
In his opinion, the government must clarify the law to ensure intelligence surveillance is subject to judicial supervision as is the case with private conversations under the Criminal Code. “The shortcoming of the current understanding and emerging practices is that a wide range of enforcement and security organizations treat metadata as if it doesn’t attract much expectation of privacy.”
Fewer believes judicial intervention will be necessary before there’s any change in practice. He refers to the
Re X decision of the Federal Court last year in which Justice Richard Mosley initially granted the warrants sought under the Canadian Security Intelligence Service Act to monitor foreign telecommunications. After the Snowden revelations, the judge rescinded his decision, noting the Canadian Security Intelligence Service had “strategically omitted information in applications for the warrants about their intention to seek the assistance of the foreign partners.” The revised decision is under appeal.
The B.C. Civil Liberties Association has launched two lawsuits against CSEC claiming its secret and unchecked surveillance of Canadians violates the protections under the Charter of Rights and Freedoms against unreasonable search and seizure.
The Supreme Court is considering the issue in
R. v. Matthew David Spencer. It canvassed whether a subset of metadata, namely subscriber information, attracts a reasonable expectation of privacy under s. 8 of the Charter.
McCammon wonders whether Parliament will get ahead of the game by redesigning the security system. There are also calls for stronger oversight to ensure privacy protection in the context of national security. The concerns come as the special report from the federal privacy commissioner noted formerly solitary intelligence organizations were increasingly co-operating and merging without any commensurate ability for joint oversight efforts by their review bodies.
McCammon thinks the problem lies at the heart of the National Defence Act. “It was an interim measure, now 10 years old, that was brought in quickly in the weeks that followed 9/11. It left a lot of unanswered questions about the scope of its powers. CSEC commissioners have, to a man, raised alarms that it puts at risk the integrity of the review process, but the government is yet to respond.”
Those following the issue expect the matter will definitely get some attention this year. “Privacy commissioners and civil societies are pushing for an open debate and some members of Parliament are picking up on that,” says McCammon.
“There are lawsuits coming up and we can count on more news from Edward Snowden. That’s almost certain. The temperature will go up and pressure for a proper realignment over power and transparency will increase.”
