COLUMN: Shanoff – Bill C-30 is nothing compared to PIPEDA
Media ignoring Liberals’ attack on our Internet privacy rights
by Alan Shanoff
It’s strange how so many commentators have whipped themselves into a lather over the attack on privacy rights in Bill C-30, otherwise known as Protecting Children From Internet Predators Act, yet don’t appear troubled by another equally troubling infringement of privacy rights.
Anyone worried by the potential erosion of privacy rights in the Conservatives’ Bill C-30 should be even more concerned about the actual erosion of privacy rights in existing federal law known as the Personal Information Protection and Electronic Documents Act (PIPEDA). [See: http://laws-lois.justice.gc.ca/eng/acts/P-8.6/]
Introduced by the Chretien Liberal government in 2000, PIPEDA has been in force for over a decade. It regulates the collection, use and disclosure of personal information by businesses.
In other words, it applies to cellphone and Internet service providers, phone companies, credit card companies and all other businesses that collect and track data on our daily activities.
It covers a wider range of businesses than C-30.
PIPEDA allows any business to disclose any personal information without the knowledge or consent of an individual to a government institution or part of a government institution (including a police officer), where the disclosure is requested for the purpose of enforcing or administering any law, or if the information is suspected to relate to national security.
The only limit on this is that the person requesting the information must have identified his or her “lawful authority”.
Courts have interpreted this “lawful authority” to include a police officer’s authority to investigate.
(Further, under the proposed terms of new legislation known as Bill C-12, PIPEDA will be amended to state police do not require a subpoena or warrant prior to making any request._
PIPEDA means every police officer in Canada has the power to request disclosure of personal information from any business collecting information from subscribers or customers.
True, there’s no legal compulsion on the business to supply the information but they often do, based on user agreements and their so-called privacy policies, which permit information to be supplied under “lawful authority”.
Yet it seems few, if any, commentators are concerned with PIPEDA.
Surely, for the sake of consistency, opponents of Bill C-30 should be demanding the government amend PIPEDA to define “lawful authority”, so that it requires the person making the request for disclosure has a judicial warrant backing up that request.
True, Bill C-30 goes a step beyond PIPEDA by legally requiring all telecommunication service providers to provide subscriber information, based solely on a written request, whereas PIPEDA doesn’t force, but allows, businesses to release the information.
Still, PIPEDA covers a wider range of businesses, allows for more information to be released based solely upon request and is accessible to any government institution, as well as police.
Arguably PIPEDA is more intrusive than C-30. Anyone objecting to one must logically object to the other.
That said, a particularly troubling aspect of C-30 relates to the compelled disclosure of subscriber information.
Such disclosure may seem innocuous at first blush.
After all, who could reasonably object to release of a subscriber’s name, address, telephone number, e-mail address, Internet protocol address and service provider identifier associated with the subscriber’s service and equipment?
But we can’t look at any one piece of information in isolation. While it in itself might reveal nothing of significance, it may be that same piece of information, when coupled with other data, leads to disclosure of significant facts,
For example, the IP address alone may be of no significance, but it may be the missing piece to a puzzle that leads to disclosure of personal information deserving of protection.
For these reasons even seemingly innocuous subscriber information shouldn’t be accessible to authorities without a warrant, unless of course, there’s an emergency situation.