Thursday, April 28, 2011

The IT.CAN – LSUC Annual Spring IT Law Forum

Anyone interested in privacy in general and mobile privacy in particular should check out this upcoming professional development event being put on by the Canadian IT Law Association and the Law Society of Upper Canada:

The IT.CAN – LSUC Annual Spring IT Law Forum will be held in Toronto at the LSUC teaching facility, 130 Queen Street West, on Monday, June 6th & Tuesday, June 7th, 2011.

This year we have an all new series of 4 individual half day programs. You may register for 1, 2, 3 or all 4 programs, for maximum savings. Each of the 4 programs will be fully accredited by all provincial Law Societies for CLE credit.

The 4 programs offered this year are:

A) Intellectual Property Issues for IT Law & Business -Monday, June 6th (8:45am-12:30pm)

B) Online and Mobile Privacy Issues - Monday, June 6th (1:00-4:45pm)

C) Key Contracting Issues for IT Agreements – Tuesday, June 7th (8:45am- 12:15pm)

D) Outsourcing Information Technology- Tuesday, June 7th (1:00-4:45pm)

For more details, go to the Canadian IT Law Association website: www.it-can.ca

Monday, April 18, 2011

Cloud Computing and Privacy FAQ

[Printer Friendly Version]
Cloud Computing and Privacy FAQ[1]
David TS Fraser
In Canada, there is often a perception that using cloud computing services may be against the law or may undermine privacy. This is often not the case, but the perception remains. The purpose of this frequently asked questions is to dispel some of the mythology and to provide the reader with a framework so that cloud computing and privacy can be properly assessed.
One important consideration for anyone contemplating a cloud computing solution is that the “baseline” from which you should measure any potential decision is your existing information system, warts and all. As objectively as possible, you will need to consider the security and privacy risks that are inherent in your corporate infrastructure. This may include insecure desktop systems, users with unencrypted mobile devices and constantly playing catch-up with patches and security updates. When making comparisons about the different options, keep your eyes as open as you can. Also, factor in the cost of bringing your existing system up to your desired standards as a matter of comparison.

Is it illegal for a Canadian business to outsource services, such as cloud computing, to a non-Canadian company?

No. There is no law that prevents most Canadian businesses from “exporting” personal information. Private sector privacy laws require that you ensure a comparable level of security for personal information, regardless of whether you permit it to be managed by a Canadian company or a non-Canadian company. (Some highly regulated industries, such as banking, have special rules which may include additional regulation for outsourced services.)

Is it illegal for a Canadian public sector or government body to outsource services, such as cloud computing, to a non-Canadian company?

It depends on the jurisdiction of the public sector or government body. Only British Columbia and Nova Scotia have laws strictly regulating the export of personal information from Canada by public bodies. For all other jurisdictions, including the federal jurisdiction, export is permitted but the public body must ensure a comparable level of security for personal information, regardless of whether you permit it to be managed by a Canadian company or a non-Canadian company.
Alberta has enacted legislation that makes it an offense for a public body or a service provider to disclose personal information in response to an order that does not have jurisdiction in Alberta.

What is all the fuss about privacy and cloud computing?

In 2001, the United States Congress passed the USA Patriot Act, which expanded the powers of law enforcement and national security agencies to carry out investigations and to obtain intelligence in connection with anti-terrorism investigations. Investigative powers that had been restricted to counter-intelligence (spy vs. spy stuff) were extended to anti-terrorism investigations. In Canada, attention was focused on the USA Patriot Act when the British Columbia government proposed to outsource processing of medicare claims to the Canadian subsidiary of a US company. Public sector unions who opposed the outsourcing focused on the fact that the company was American and suggested that sensitive health information would be readily available to US authorities. The British Columbia Information and Privacy Commissioner carried out an inquiry into the impact of this outsourcing on the privacy of British Columbians and recommended wide prohibitions on the “export” of personal information by BC’s public bodies.
British Columbia amended its Freedom of Information and Protection of Privacy Act to prohibit the export of personal information. (It is notable that the government did outsource the processing to the Canadian subsidiary of the US company and the legislature has had to amend the Act to scale back some of the unworkable provisions.) For more information, see below.
Nova Scotia followed suit with the passage of the Personal Information International Disclosure Protection Act. For more information, see below.

What does British Columbia’s anti-export law say?

Amendments to the Freedom of Information and Protection of Privacy Act require that information under the custody and control of a public body be stored only in Canada and accessed only in Canada unless the individual has consented to its storage or disclosure outside of Canada or one of a number of narrow exceptions apply. The public body and any of its service providers are under a legal obligation to  report any foreign demands for disclosure. Violating any of these provisions is an offense.

What does Nova Scotia’s anti-export law say?

The Personal Information International Disclosure Protection Act requires that information under the custody and control of a public body be stored only in Canada and accessed only in Canada unless the individual has consented to its storage or disclosure outside of Canada or one of a number of narrow exceptions apply. Importantly, the head of a public body may authorize the storage of personal information or access to personal information from outside of Canada if the head of the public body determines it is for the necessary operations of the public body. The head is obliged to report these exceptions to the Minister of Justice after the year end in which these decisions are made.
The public body and any of its service providers are under a legal obligation to  report any foreign demands for disclosure. Violating any of these provisions is an offense.

Is information better protected from law enforcement and national security access in Canada than in the United States?

Not necessarily. The provisions of the USA Patriot Act that have attracted the most criticism have equivalents under Canadian law. Regardless of where information resides, it will always be subject to lawful disclosure to law enforcement or national security bodies. In Canada, this includes search warrants under the Criminal Code of Canada and the Canadian Security Intelligence Service Act, and administrative subpoenas such as those issued under the Income Tax Act.
It should also be noted that many European countries permit broader law enforcement and national security access to information than in both the United States and Canada.
Secret Court Orders - The Foreign Intelligence Surveillance Act (amended by the USA Patriot Act) permits a specialized court - the Foreign Intelligence Surveillance Court - to issue secret court orders for the production of “any tangible thing” in connection with terrorism investigations. These orders are accompanied by a “gag order”, which prevents the recipient of the order from telling anyone other than legal counsel about the order. Canadian authorities have virtually identical powers under the Canadian Security Intelligence Service Act, which permits secret court orders that authorize CSIS to intercept communications or to obtain any thing named in the warrant.
Warrantless Wiretapping - The Foreign Intelligence Surveillance Act law permits the American government to intercept foreign communications and international communications without a warrant. Canada’s National Defence Act has essentially the same powers.
National Security Letters - National Security Letters are a form of administrative subpoena that permits a senior official of the Department of Justice to compel a third party (such as a bank, a telecom provider or an Internet service provider) to hand over information about a person’s use of the third party’s services. For example, they can require a telephone company to provide information about a customer’s use of the telephone, such as phone numbers called and the phone numbers of callers to the target of surveillance. It does not authorize the provision of the contents of any communications. Canada does not have an equivalent, but authorities in Canada can obtain this information by use of production orders.

Does keeping data in Canada keep it away from American law enforcement and national security agencies?

In short, no. Canada, the United States and most western democracies engage in a very high level of cooperation that includes mutual legal assistance treaties[2] and ad hoc information sharing. If US agencies are interested in an individual who has ties to Canada, the Federal Bureau of Investigation can make a formal request of the Royal Canadian Mounted Police or CSIS to obtain the relevant information on their behalf. Most Canadian privacy laws actually permit this sort of information sharing under treaties or informal arrangements. And if you are concerned about covert access to this sort of data, American laws do not prohibit federal agencies from seeking the information covertly if it is not in the United States. Some have suggested that information is safer from US authorities in the US because of this.

If we go with a cloud solution, should we give notice of this to our customers/users?

Under most Canadian laws, you technically do not need to seek consumer consent or provide notice. However, the Privacy Commissioner of Canada has taken the position that businesses that propose to have personal information processed outside of Canada should give notice of this to customers. This is not required under the statute, but probably represents a best practice. If you are required to give notice or elect to as a best practice, you should be mindful of how it is presented to your customers so that it does not appear to be a request for consent that they can “opt out” of or that raises concerns. Under the Alberta and Quebec private sector laws, you are required to give notice of this to your customers.  

What are the legal security requirements for Canadian companies considering cloud computing?

Canadian legislation is silent about what particular security practices should be adopted when using cloud computing. The Personal Information Protection and Electronic Documents Act, for example, only says that safeguards must be adopted that are commensurate with the sensitivity of the information. The more sensitive the information, the greater the precautions that should be taken. The general prevailing view is that you should insist on at least the industry best practices for the sort of data at issue.
The original organization remains legally responsible for the safeguarding personal information even if it is outsourced. It is up to the organization to make sure that any service provider implements adequate protections.
One must be mindful of any additional risks introduced by cloud computing, which is principally related to having data in transit over the open Internet. These risks can generally be mitigated by the use of SSL, VPN or other encryption technologies to make the information safe in transit.
When evaluating the security and privacy implications of outsourcing services, you should benchmark the provider against the status quo at your organization. If the provider you are considering is compliant to a national or international standard such as ISO27001 or FISMA/FIPS or SAS 70, consider whether your current systems would be compliant.
Provided a reputable provider is used, information is generally safer when in the custody of a cloud service provider.  This is generally because cloud providers have greater resources to devote to security and because mobile users will no loner have to carry data with them in vulnerable devices, such as laptops and USB/thumb drives.

What role should jurisdiction play in a decision about whether to adopt cloud computing?

Jurisdiction is not irrelevant, but is less relevant that many people believe. For example, you should be very wary of any situation that casts doubt over whether your contract with your service provider will be enforceable. Afterall, their obligations to secure your data are set out in the contract. This means, at a minimum, you should be sure that your service provider is based in a jurisdiction with a mature and fair legal system. You should be aware that data may fall under the jurisdiction of any country that is reasonably connected to, so this would include at a minimum where you are located, where the service provider is based and where the data resides (which may be difficult for the customer or any third party to determine). For each of these jurisdictions, you should consider whether any them introduce any significantly meaningful increase in risk to your data. Expert legal advice should be sought as it is very difficult to determine and measure this risk.

What should I be looking for in the contract with my service provider?

Below is a list of what you should be asking for. Not every service provider will negotiate these terms and some are simply difficult or impossible to deliver depending on the model of cloud computing the provider uses, but you should ask for them and consider any response.
1.        Limit service provider to only using your data for your purposes and for no other purpose
Depending on the service, it is reasonable that your provider will want to gather analytics about how users use the service so  they can improve it, but the provider should be limited in what possible secondary uses they can make of your own data. In most cases, they should not make any use of this data for their own purposes unless you explicitly consent.
2.        Include provision that data is held “in trust” for customer
The purpose of this stipulation is to make it clear that the data remains yours and their role is to process/store/manage it on your behalf. In addition, if the data is held for you in trust, their obligations with respect to the data are increased as they are a legal fiduciary.
3.        No disclosures of information without your consent
The provider should not permit -- and should be legally responsible for -- any disclosures of your data other than as expressly set out in the service agreement.  The service agreement should contemplate what the provider should do to respond to a legal order for access.
4.        Liquidated damages for any disclosure without consent
It is often difficult to quantify the harm resulting from disclosure of information, so it is a good idea to try to set out in the agreement a reasonable sum of damages that the service provider should pay in the event of a disclosure without your consent. It should not be a fixed sum, but rather a multiplier connected to the extent of the disclosure. And make sure that it is “general damages”, so that you are not precluded from claiming additional damages for the out-of-pocket costs associated with any claims made by your customers against you, any fines that may be levied and your costs associated with notifying your customers.
5.        Obligation to resist – to the extent lawful – orders to disclose information without consent
If the service provider receives legal process that would require them to hand over the data and they are  not able to tell anyone about it, this would make it mandatory for them to resist the disclosure to the extent that they can. For example, if they receive a subpoena or a production order, they should not just hand it over but apply to the issuing court to have the subpoena quashed. (There is never any assurance that it will be successful, however.) It should be noted that some orders, such as search warrants, cannot be resisted at the time but an application can be made to have the warrant set aside and the data returned.
6.        Obligation to cooperate with you in any regulators’ investigations
In the event of any investigation by the Privacy Commissioner or some other regulator, your service provider should be obliged to assist you with such an investigation.
7.        Will not deal with any regulators related to your information without your participation
In the event of any investigation by the Privacy Commissioner or some other regulator, your service provider should not be dealing directly with the investigators. It is your data and you are ultimately responsible for it, so the job of addressing any complaints should be yours alone.
8.        Implement safeguards to protect information – Set minimums but shift as much responsibility to the service provider
Cloud computing agreements are complicated, technologies are subject to constant change and security standards shift over time, so it is better to have the service provider agree to abide by well-known information security standards instead of dictating particular technologies to use. Make sure your provider is regularly audited against these standards and make sure that you will have the right to obtain copies of the audit reports. It is unlikely that you will be able to audit them yourselves (which is a good thing, because you don’t want other customer’s auditors going through the systems on which your data resides).
Make sure they warrant that they will abide by these standards and that they will cover all of your costs in the event of any breach that results from their lapse.
If possible, you should make sure that you are able to audit your users’ access of the data, which may be necessary if there is a breach of security that originates within your systems.
9.        Do not accept any limitations of liability related to privacy and security – full indemnity
One of the reasons for choosing a cloud provider is because of their expertise in securing your data. The agreement should not limit their liability to a nominal amount if they fail to safeguard the data. Their warranty and indemnity should cover all of your costs and any remedies you have to offer your customers due to a security breach. The service provider should have adequate insurance for incidents such as these and the provider should be obliged to keep their insurance in force and to provide you with certificates of insurance evidencing this.
10.        No retention of your information after the contract is finished (and make sure you get all your data back!)
You should make sure that any contract with your service provider permits you to get all our data out if you choose to terminate the agreement or if it expires and that the provider cannot retain or use any of your data (other than general analytics information that is used to improve the service) after that point. It just makes sense.

What are the best practices for decision-making around cloud computing?

As with any new program that involves the handling of personal information, the organization should undertake a privacy impact assessment (also known as a “PIA”). PIAs are a systematic way of canvassing all of the privacy issues inherent in a project so they can be identified and hopefully mitigated. PIAs are widely done in the public sector and should be undertaken by private sector organizations who are considering moving customer or employee data to a service provider. The author has considerable experience with PIAs and can provide training and additional information.

About the author

DAVID FRASER is a partner with McInnes Cooper, working with a range of private and public sector clients to implement compliance programs for Canadian privacy legislation. He regularly provides opinions related to Canadian privacy law for both Canadian and international clients and is a frequently invited speaker on this topic. He is the author of the popular Canadian Privacy Law Blog (http://blog.privacylawyer.ca) and the Canadian Cloud Law Blog (http://www.cloudlawyer.ca).
David is widely recognized as one of Canada’s foremost experts on privacy law and other legal issues associated with cloud computing. He regularly advises vendors and customers in connection with implementing cloud computing projects, in both the public and private sectors. David is particularly known for his ability to cut through the rhetoric often associated with cross-border outsourcing to implement clear risk-based assessment of such projects.
In addition, David is the Past President of the Canadian IT Law Association and the former Chair of National Privacy and Access Law Section of the Canadian Bar Association. David was honoured to be included in the inaugural (2006) and each subsequent edition of The Best Lawyers in Canada in the category of Information Technology law. He is listed among the world’s leading lawyers in Internet and eCommerce Law in the International Who’s Who of Business Lawyers. In the spring of 2006, David was a recipient of an Outstanding Young Canadian Award by the Junior Chamber of Commerce International - Halifax Chapter.  In 2009, David was named as one of Canada’s “Top 40 Lawyers Under 40” by Lexpert.
He is a member of the faculty of Dalhousie Law School, where he teaches Internet and Media Law, Law and Technology, and Law and Policy for Electronic Commerce. He is on the editorial board of the Canadian Journal of Law and Technology. Active in the Halifax technology community, David is secretary and director of advocacy for Digital Nova Scotia, the IT industry association of Nova Scotia.

[1] This document is intended to be a summary of common questions along with brief answers. It is meant to provide a brief guide so that the reader is able to seek relevant legal advice and is not intended to be a substitute for competent legal advice.
[2]See the Mutual Legal Assistance in Criminal Matters Act (R.S.C., 1985, c. 30 (4th Supp.)) athttp://laws-lois.justice.gc.ca/eng/acts/M-13.6/. For a list of the countries with which Canada has mutual legal assistance treaties, see http://www.treaty-accord.gc.ca/index.asp?lang=eng.

Saturday, April 16, 2011

Political parties can spam you as much as they want

I was contacted this week by a reporter from the Toronto Star inquiring about the legality of Members of Parliament adding constituents' names to the databases of the parties with which they are affiliated. The answer is, either intentionally or unintentionally, politicians have exempted themselves from Canada's privacy laws and Canada's anti-spam law. While it flies in the face of fair information practices, MPs and political parties are free to spam you all they want.

Email to MP lands woman in campaign database - thestar.com

Brendan Kennedy

Staff Reporter

Mary Krohnert wrote her MP earlier this year to voice her concerns about changes to CRTC regulations. The act of civic engagement also appears to have signed her up to receive Conservative attack ads in her email.

The 36-year-old Oshawa resident says she had Tory campaign literature sent to her inbox this week, though she has never signed up for anything to do with the party.

When she called the Conservative party’s Ottawa headquarters to inquire, she says she was told her email address was added to a national campaign database after she wrote her MP — Conservative incumbent Colin Carrie — on a number of different issues in recent years.

“As far as I know I’ve never given consent for my email address to be shared,” said Krohnert, an actor who is studying to become an art therapist. “I was just communicating with my MP.”

Carrie refused to be interviewed for this story through his campaign manager, Judy Pati.

What apparently happened to Krohnert is perfectly legal because political parties are exempt from Canada’s privacy rules, said David Fraser, a privacy lawyer with Halifax-based McInnes Cooper.

“They can collect, use and disclose your personal information without your consent and they can use it for whatever purpose they want.”

Ryan Sparrow, a spokesman for the Conservatives, refused to comment on whether it was common practice for the party’s elected politicians to use constituents’ personal information when campaigning, saying he could not speak on behalf of MPs. He also three-times repeated a statement saying the party is “more than happy” to remove someone’s name “from any distribution list that we have” when requested.

Wednesday, April 13, 2011

Join the discussion about Dalhousie University and Cloud Computing

Dalhousie University, like many other Canadian post-secondary institutions, is engaging in a deep conversation with students, faculty and staff about the possibility of moving e-mail and other IT services to the cloud. As part of that conversation, the university is hosting a special forum on privacy and the cloud. Here's the details:

“A Forum on Privacy Laws, Cloud Computing and Impact to IT Strategy”

Presentation Date: Monday, April 18th, 2011 2:00-5:00 (Rowe Potter Auditorium)

Information Technology Services at Dalhousie University is exploring a number of opportunities with emerging “Software-as-a-Service” or “Cloud Computing” initiatives. Cloud computing introduces a number of potential concerns around security, privacy, data ownership and data stewardship.

In an effort to address concerns and increase awareness around the legal, policy and academic implications, Dalhousie has invited professionals in a number of areas to speak and take part in a panel discussion on these topics.

David Fraser, Partner, McInnes Cooper

Mr. Fraser will speak to Canadian and American laws in relation to cross border data transfer, privacy and access to information.

Dwight Fischer, CIO, Dalhousie University

Mr. Fischer will speak to the technology challenges and changes taking place and the impact on Dalhousie.

Paul Jones, Policy & Education Officer, Canadian Association of University Teachers

Mr. Jones will speak to the concerns around privacy and academic freedom, specifically how it relates to faculty.

Come and take part in the discussion on April 18th from 2:00 to 5:00 p.m!

Join in the online conversations now at blogs.dal.ca/connectedU

Tuesday, April 12, 2011

US Senators introduce Commercial Privacy Bill of Rights

US Senators John McCain and John Kerry have introduced a bill entitled the Commercial Privacy Bill of Rights (PDF), which appears to be similar to Canada's PIPEDA. Most notably, it is not restricted to online companies.

It'll be interesting to see where this goes. Here's John Kerry's summary: John Kerry - United States Senator for Massachusetts: At Work for You in Congress - List of All Issues. And here's what the Forbes Tech Blog has to say: John Kerry and John McCain Want Your Company To Hire a Privacy Officer.

Microsoft has come out in favour of the proposed statute: Microsoft Supports Kerry-McCain Privacy Bill - Microsoft on the Issues - Site Home - TechNet Blogs.

Why internet privacy matters

Over the last couple of days, I've blogged a bit about the proposed legislation that came to be known as Bill C-52 in the last session of Parliament. (See: Canadian police state legislation needs closer examination, and Conservative majority would pass lawful access within 100 days. Also check out Michael Geist's excellent post: The Conservatives Commitment to Internet Surveillance.) Bill C-52 fell off the order paper when the 40th Parliament was dissolved for the current election, but I think it really needs to be extensively discussed in the current election. (I should note that this is not necessarily a partisan issue, since it was originally proposed by the Liberals many elections ago.)

The Internet is not quite like the real world. When you go to a library, you don't have to provide ID or leave a record of what you looked at or that you were even there. When you step into a store in the real world, you don't necessarily leave a trace of what you perused and what you bought (if you paid cash). You can send an anonymous letter to the editor of your local newspaper to voice an unpopular opinion without giving your name or any other identifying information. (They probably will not publish it, but that's beside the point.) But the Internet doesn't work like that.

Every device on the network has an IP address. IP addresses can be tied to an individual computer or a range of computers sitting behind a firewall or a router. Every mobile device, such as a cell phone or a smart phone, has a number of unique identifiers that it chirps out to the network that it's attached to. Every interaction that you have online, you can assume is being logged in some fashion in connection with that IP address. Many e-mails you send include in the headers the IP address of the computer it was written on.

It's just the nature of how networks work. That IP can perhaps be traced to you, to your household or to your employer. In most cases, where residential internet accounts are concerned, they are connected to the name and address of the account holder. With phones, that identifier is connected to the individual who owns the phone.

In short: Everywhere you go on the internet or with your mobile phone, you leave digital footprints. That's the nature of the modern, networked world. So what protects your privacy when you do anything online? The fact that whoever allocated that IP address or provides your cell phone service has to keep it confidential unless a judge decides that the public interest (or the state interest) overrides your privacy interest. That's why we have a Charter of Rights and Freedoms in Canada and why we have an independent judiciary. There is no absolute anonymity online, but there is effective privacy by obscurity because anyone who can connect your IP address to an individual is bound to keep it confidential unless a judge says otherwise.

However, Bill C-52 proposed to take that important balance away. It would give police forces and national security folks virtually unfettered powers to connect those otherwise anonymous footprints to an actual person (or small group of persons).

That is inconsistent with your rights to privacy and is dangerous to the free and open internet. Whoever is elected needs to know that privacy is something that all Canadians value.


I have heard that the Conservatives have said that they will not include Bill C-52 in their omnibus "get tough on crime" legislation they plan to pass within 100 days if re-elected, which is a good thing. This is something that needs a full debate in Parliament, in Parliamentary committees and in the public square.

Monday, April 11, 2011

Canadian police state legislation needs closer examination

I try not to get too opinionated on this blog, but there are some things I feel strongly about. One thing is the ability of people to live their lives (online and off) free of state surveillance and intrusion unless an impartial judge decides that the balance needs to be shifted in favour of the state.

When the recent election was called, a bill fell off the order paper that would remove the impartial judge and put significant surveillance powers it the hands of the state. (In fairness, I have to say that this was originally conceived under the previous Liberal goverment, but is currently part of the Conservative Party's law and order platform that they say will be passed within 100 days if they win a majority (Conservative majority would pass lawful access [laws] within 100 days)). One Bill in particular needs a full airing and thorough debate. It was introduced in the last session and never made it past first reading. This means there was no debate and no scrutiny of any kind.

Here's why Bill C-52 - An Act regulating telecommunications facilities to support investigations needs much closer examination.

Section 16 of the Bill requires all telecommunication service providers to hand over enormous quantities of customer information to the police, CSIS or the competition cops. There is no limit on the amount of information to be provided and is only restricted to "duties" of the cops or intelligence agency.

The provisions, at least as they appeared in Bill C-52, read as follows:

OBLIGATIONS CONCERNING SUBSCRIBER INFORMATION

16. (1) Every telecommunications service provider must provide a person designated under subsection (3), on his or her written request, with any information in the service provider’s possession or control respecting the name, address, telephone number and electronic mail address of any subscriber to any of the service provider’s telecommunications services and the Internet protocol address, mobile identification number, electronic serial number, local service provider identifier, international mobile equipment identity number, international mobile subscriber identity number and subscriber identity module card number that are associated with the subscriber’s service and equipment.

(2) A designated person must ensure that he or she makes a request under subsection (1) only in performing, as the case may be, a duty or function

(a) of the Canadian Security Intelligence Service under the Canadian Security Intelligence Service Act;

(b) of a police service, including any related to the enforcement of any laws of Canada, of a province or of a foreign jurisdiction; or

(c) of the Commissioner of Competition under the Competition Act.

(3) The Commissioner of the Royal Canadian Mounted Police, the Director of the Canadian Security Intelligence Service, the Commissioner of Competition and the chief or head of a police service constituted under the laws of a province may designate for the purposes of this section any employee of his or her agency, or a class of such employees, whose duties are related to protecting national security or to law enforcement.

(4) The number of persons designated under subsection (3) in respect of a particular agency may not exceed the greater of five and the number that is equal to five per cent of the total number of employees of that agency.

(5) The Commissioner of the Royal Canadian Mounted Police and the Director of the Canadian Security Intelligence Service may delegate his or her power to designate persons under subsection (3) to, respectively, a member of a prescribed class of senior officers of the Royal Canadian Mounted Police or a member of a prescribed class of senior officials of the Canadian Security Intelligence Service.

17. (1) A police officer may request a telecommunications service provider to provide the officer with the information referred to in subsection 16(1) in the following circumstances:

(a) the officer believes on reasonable grounds that the urgency of the situation is such that the request cannot, with reasonable diligence, be made under that subsection;

(b) the officer believes on reasonable grounds that the information requested is immediately necessary to prevent an unlawful act that would cause serious harm to any person or to property; and

(c) the information directly concerns either the person who would perform the act that is likely to cause the harm or is the victim, or intended victim, of the harm.

The police officer must inform the telecommunications service provider of his or her name, rank, badge number and the agency in which he or she is employed and state that the request is being made in exceptional circumstances and under the authority of this subsection.

Let me break this down: Any designated police officer or CSIS agent can ask a telecommunications service provider to hand over any of the following information about a customer:

  • name,
  • address,
  • telephone number,
  • electronic mail address,
  • Internet protocol address,
  • mobile identification number,
  • electronic serial number,
  • local service provider identifier,
  • international mobile equipment identity number,
  • international mobile subscriber identity number and
  • subscriber identity module card number.

This goes well beyond the usual scenario of when the cops have an IP address of someone suspected of online child exploitation and want the customer name and address information. But the bill doesn't say that if the cops have X info, they can get Y subscriber data. Instead, it just says on request the telco has to hand over the entire laundry list of data on customers. This is without a warrant, without a production order and without any court oversight at all. Unlike wiretap laws where stats have to be released, there is no obligation on the part of the police or the ministers responsible to release information about how these powers are used and under what circumstances. The Privacy Commissioner gets to audit it, but I don't think this saves any of the problems with the Bill.

The Bill contained no limitation on what level of investigation was required. It isn't limited to serious crimes or even trivial crimes. It is not limited to criminal or national security investigations. All that's necessary is that it be connected with the cop's duties. Collecting parking tickets fit within that category.

Think about what this means, given the laundry list of data to be provided with no threshold of probable cause or even a real investigation. The police can scan the airwaves at a protest and identify the IMEIs of the mobile phones in the vicinity. One request to the telcos can get the names and addresses of virtually everyone who was there. I bet the Egyptian authorities would have loved to have done this in Tahrir Square. Next time there's a G-20 protest in Canada, the police can do this, too.

There is no limitation in the statute that would prevent the police from asking for all the above data for any subscribers who connected, for example, to any cell site in a particular neighbourhood at a particular time.

In Canada, we expect that we can generally live our lives free of government surveillance and intrusion, unless an independent judge says that the government interest in crime fighting outweighs our individual right to privacy. This legislation would remove this balance and tips the scales dramatically toward police state powers.

Saturday, April 09, 2011

How responsible online companies use user data

Farhad Manjoo has a very interesting article posted earlier this week on Slate about online privacy (Google privacy: The good things that happen when Web companies use our personal data. - By Farhad Manjoo - Slate Magazine). It presents a view that you don't often hear, but really needs to be listened to.

The reality is that most online services are awesome because they can understand how their users interact with the service and learn from it. This requires collecting user data.

Here's a very simple example: How does Google know that the word you've entered is misspelled and offers you the corrected search query? Because it knows that other people who mis-spelled it the same way then went on to correct it. An aborted search followed by the correct search. It can only know that if it closely analyzes the search queries of its users.

Another easy example: If you search for "GEDS", you'll get a different result if you searching from Canada. (In Canada, GEDS is the acronym for the Canadian government's online employee directory.) Google knows that people in Canada who search for GEDS choose to go to the online directory. So it's the first result for Canada.

And it needs to be said that most of the internet is free because of advertising. Google spent $18 billion dollars offering mostly free services last year. Yahoo! spent about $5 billion. People, servers and bandwidth are all expensive. The reason why it's mostly free is because it's advertising supported. It's very simple. Advertising depends on knowing the general demographics of who is being presented with what ad. When more personal information is used to produce more relevant ads, the greater the return to the advertiser and to the service hosting the ads.

People are often suspicious of what they don't understand and most consumers don't understand how online advertising works. Many users find it creepy when they see an ad on Facebook that is apparently custom made for them. They assume that Facebook has disclosed their personal information to an advertiser. That's not the case; Facebook doesn't sell user information to advertisers. They simply don't. The reason why you seeing a particular ad targeted at your particular demographic and your particular interests in your particular city is because Facebook knows that information (because you told them) and because it is Facebook who is choosing the ad. The advertiser only learns about the number of times it was presented and how many times it was clicked on. Much less creepy. If Facebook couldn't present relevant ads, the service would not be free.

Part of the bargain is that consumers should expect honesty and transparency, and that the company follows fair information practices. There are bad actors out there, but people need to be discerning so that not all of them are tarred with the same brush.

FSB/KGB proposes banning foreign secure internet services; shot down

Hmm.... Are we seeing a trend here?

On Friday, a representative of the FSB (formerly known as the KGB) suggested that foreign secure internet services, like Skype, Hotmail and GMail, should be banned because the Russian security apparatus couldn't get into them and control them: In Russia, official proposes curtailing Internet freedom - The Washington Post.

Thankfully, this has been rejected by the Russian Government: Kremlin Rejects FSB Proposal To Ban Skype, Gmail.

I expect this isn't the last we'll hear on this topic, though.

Friday, April 08, 2011

Presentation: Social media and the multi-generational workplace

I just gave a professional development presentation for the Canadian Bar Association on Social Media and the Multi-Generational Workplace. Since there's a definite privacy angle, I thought it might be of interest to readers of this blog.

Here's the link in case the embedded presentation isn't showing up for you: https://docs.google.com/present/view?id=ddpx56cg_444ffh725f3&interval=30.

Presentation: Dealing with data breaches

This past weekend, I had the pleasure of being invited to speak at the Canadian Corporate Counsel Association's annual spring training for new in-house counsel. My portion of the presentation focused on dealing with data breaches and investigations by Canadian regulators.

Here's a copy of the presentation, in case it's of interest:

In case you can't see the embedded presentation, follow this link: https://docs.google.com/present/view?id=ddpx56cg_438dq7nkrdc&interval=30.

France passes stunning data retention decree for online services

France has just passed a stunning decree that would require online service providers to retain a host of information to be made available to law enforcement, including:

Information furnished when agreeing to a contract or opening an account, including first name, last name, business name, associated mailing addresses, and pseudonyms utilized, associated e-mail addresses and accounts, telephone numbers, and passwords as well as data permitting the verification or modification of the password.

These companies must also keep all user id's and passwords for any internet connection, the IP address of the terminal used to connect, the time and date of every connection, and...

Here's the kicker: for EVERY action of a user on the internet, these companies are now required to record the nature of the operation, whether it is writing an e-mail or downloading an image or video.

This is just a staggering development and thankfully a number of organizations, including Facebook, Google, eBay and others, are challenging this new law.

See: France Goes Overboard In Data Retention: Wants User Passwords Retained | Techdirt.

Conservative majority would pass lawful access within 100 days

Stephen Harper, on the campaign trail, has promised that if he is re-elected with a majority his government would pass their "get tough on crime" legislation within 100 days. This includes their lawful access laws that fell off the order paper when the election was called.

See: Conservative majority would hustle crime bills into law all at once - The Globe and Mail.

Wednesday, April 06, 2011

Quebec court sends Facebook class-action packing to California

The Quebec Superior Court has just declined jurisdiction over a proposed class-action lawsuit against Facebook over its privacy policies and practices by upholding the choice of law and forum selection clause in the Facebook Terms of Use. Check out: St-Arnaud c. Facebook Inc., 2011 QCCS 1506 (CanLII)

Tuesday, April 05, 2011

Alberta Court of Appeal overrules province's Commissioner on license info

There appears to be a significant dissonance between the Information and Privacy Commissioner of Alberta and that province's Court of Appeal. The Court just released its decision in Leon’s Furniture Limited v. Alberta (Information and Privacy Commissioner), 2011 ABCA 94 (CanLII) and made some rather surprising findings.

The appeal centered around whether it is reasonable for Leon's Furniture to collect drivers license numbers and car license plate numbers when customers pick up furniture from the store. The Information and Privacy Commissioner's delegate had concluded that this was in appropriate under the Personal Information Protection Act to do so.

Two very notable findings:

  • An individual's "right" to privacy does not trump the "need" of a business to collect, use or disclose personal information. A balancing is called for.
  • A vehicle license number is not "personal information" because it is not about an individual.

Check out the full summary of this important case here: Majority of Alberta CA Slaps OIPC on Driver’s License Case « All About Information.