Wednesday, October 11, 2017

Nova Scotia introduces new "secure" ID and licenses; fails to mention use of biometrics

The Government of Nova Scotia just announced that it is introducing new "secure" provincial ID cards and drivers licenses.

What they failed to mention in any of their press releases or in any of the media coverage is that the new system will incorporate facial recognition technology. How this will be used or controlled is still unclear.

I contacted the province, which confirmed the use of facial recognition, but was unable to provide me with any information about the incidence of forgery and fraud that they use to justify the new licenses.

Privacy geeks will recall that the provincial authority in British Columbia offered police the use of their massive biometric database to identify people involved in the Vancouver Stanley Cup riot. (Canadian Privacy Law Blog: ICBC offers up its drivers' license database (with facial recognition) to ID Vancouver rioters) Who controls the database and how it will be used is very important, and very unclear at the moment.

Added later: See below for some follow-up questions and answers.

Here's their media release:

New Secure Driver’s Licence and Photo ID Cards

Transportation and Infrastructure Renewal/Service Nova Scotia

October 10, 2017 12:44 PM

Nova Scotia driver’s licence and photo ID cards will soon be better protected against identity theft, fraud and forgery.

Nova Scotia and the three other Atlantic provinces, are introducing a new, highly secure driver’s licence and photo ID card. Starting in November, the cards will be printed at a central facility shared by all four provinces and mailed to clients within 14 days.

“The main reason for this change is to protect Nova Scotians against identity theft and fraud,” said Lloyd Hines, Minister of Transportation and Infrastructure Renewal. “These changes will help us keep pace with the latest security and technology advances, and bring us in line with the rest of the country.”

Nova Scotians do not need to get a new licence or photo ID card until their current one is up for renewal. Since the cards will no longer be printed at Access Nova Scotia Centres and Registry of Motor Vehicles offices, clients renewing their licence will be given a 30-day temporary document to use until their new licence arrives.

There will be a strict review process before cards are issued to help prevent fraud and identify theft. Highly advanced, anti-counterfeiting security features will also help ensure they cannot be copied using new printing technologies.

"As Nova Scotia's provincial police, the RCMP is pleased to see any initiative that decreases opportunities for fraudulent activity," says Chief Superintendent Marlene Snowman, Nova Scotia RCMP Criminal Operations Officer. "Police officers often rely on the validity of licence information for a variety of reasons so these changes will make a positive difference for frontline officers across the province."

Access Nova Scotia will start to move to the new process for driver’s licences and photo ID cards next month with full implementation expected to be in place by the end of December.

In December 2016, the four Atlantic provinces awarded Gemalto, a world leader in digital security, a five-year contract to produce and mail the driver's licences and photo ID cards.

There is no fee increase for the new driver’s licence and photo ID card. The new cards will be implemented over the next five years as driver’s licences expire.

Edit: I asked the government some follow-up questions and the Q/A is below ...

For more information, visit .

Edit: I had some follow-up questions for the government's spokesperson. Here are my questions and the answers:

The new IDs will bring NS in line with the cutting edge of security features. That being said, protecting the privacy of citizens remains a top priority. The sole purpose of the facial recognition is to help identify individuals attempting to obtain fraudulent duplicate IDs. The province has no authority to share it for any other purpose, with any other entity, unless ordered by the courts. To your specific questions:

1. Will the biometric database be managed by the contractor or by the government? Government

2. If by the government, which department? Transportation and Infrastructure Renewal and Service Nova Scotia.

3. Will the database for NS be combined with those of the other provinces? No

4. Was a privacy impact assessment carried out? If so, by whom? Was it reviewed by the Information and Privacy Commissioner? Yes, the PIA was conducted by Nicom IT and IAP Services (at the department of Internal Services) has participated in the process, reviewed and recommended for approval, also as per their usual practice. It will be provided to the Commissioner for their records.

5. Are there any policies in place or being developed for access to or use of the database, other than administration of the license/ID card system? No.

6. Will any contents of the database be provided to any other government and under what circumstances? No.

7. Will faces in the database be matched to any other database? No.

Friday, October 06, 2017

Nova Scotia introduces new anti-cyberbullying bill

On October 5, 2017, the Nova Scotia Liberal government introduced a new bill to replace the former Cyber-safety Act, which was struck down as unconstitutional (a "colossal failure", said the judge). The Intimate Images and Cyber-protection Act is the result of a serious re-think of all the defects found in the Cyber-safety Act.

Some important differences:

1. The bill has a much more narrow definition of "cyberbullying". The previous law would have considered anything done online that could hurt your feelings to be cyberbullying. In this version, the alleged cyberbully has to maliciously intend to cause harm or has to be reckless with regard to the risk.

(c) "cyber-bullying" means an electronic communication, direct or indirect, that causes or is likely to cause harm to another individual's health or well-being where the person responsible for the communication maliciously intended to cause harm to another individual's health or well-being or was reckless with regard to the risk of harm to another individual's health or well-being, and may include

(i) creating a web page, blog or profile in which the creator assumes the identity of another person,

(ii) impersonating another person as the author of content or a message,

(iii) disclosure of sensitive personal facts or breach of confidence,

(iv) threats, intimidation or menacing conduct,

(v) communications that are grossly offensive, indecent, or obscene,

(vi) communications that are harassment,

(vii) making a false allegation,

(viii) communications that incite or encourage another person to commit suicide,

(ix) communications that denigrate another person because of any prohibited ground of discrimination listed in Section 5 of the Human Rights Act, or

(x) communications that incite or encourage another person to do any of the foregoing;

2. Applications are no longer ex parte. The accused cyberbully has to be given notice of the application and is given an opportunity to appear and respond to the allegations. This fixes the Charter s. 7 defect in the old law.

3. There are a range of defences available. One defect identified in the old Cyber-safety Act was that there were no defences available to an allegation of cyberbullying. In the new bill, there are a few that are intended to protect freedom of expression:

7(2) In an application for an order respecting cyber-bullying under this Act, it is a defence for the respondent to show that

(a) the victim of the cyber-bullying expressly or by implication consented to the making of the communication;

(b) the publication of a communication was, in accordance with the rules of law relating to defamation,

(i) fair comment on a matter of public interest,

(ii) done in a manner consistent with principles of responsible journalism, or

(iii) privileged;

(c) where the respondent is a peace officer acting in the course of the peace officer's duties, that the communication was necessary to prevent a crime or discover, investigate or prosecute the perpetrators of a crime and did not extend beyond what was necessary;

(d) where the respondent is a public officer acting in the course of the duties of the public officer's office, that the communication was necessary to fulfil the duties of that office and did not extend beyond what was necessary.

4. The bill addresses the non-consensual distribution of intimate images separately, which is a good thing. The language for this is essentially drawn from Criminal Code offence of distributing an intimate image without consent, but this bill provides civil remedies including an order for removal.

5. The CyberSCAN unit has no role in enforcement. I heard about a number of instances where the CyberSCAN unit itself bullied people to remove political content, so taking away their ability to do that is a good thing. The downside is that individuals don't have a publicly-funded organization that they can look to for legal remedies.

6. The remedies are all self-help. Applications for orders and damages go only to the Supreme Court of Nova Scotia, using the usual processes for applications under the complicated civil procedure rules. This will lead to self-represented litigants getting lost in the civil justice system or having to hire lawyers. I think I would have preferred a simplified process, similar to a peace bond, in the Nova Scotia Provincial Court.

7. Orders to prevent the identification of victims are virtually automatic. A publication ban to protect the identity of the complainant is automatic if the applicant is a minor and will automatically be granted on request to an applicant related to an intimate images proceeding. This is a good thing, as putting discretion in the hands of the court would discourage applicants from coming forward. They can proceed knowing their identity is protected and they will not be re-victimized by the court process.

8. The bill seems to anticipate possible diversion to restorative justice. How this will play out is anyone's guess, but it makes sense to encourage diversion where appropriate.

I expect I'll have more comments on it as I fully digest it, but these are the principal differences between the old and the new.

The government appears to be planning to spend the next few months consulting publicly, with the bill slated to pass in the spring of 2018.