Privacy Commissioner suprisingly approves cyberbullying bill’s ‘lawful access’ powers

Whoa. According to the Globe & Mail, the outgoing Privacy Commissioner of Canada has come out supporting the lawful access provisions of the government's new so-called cyberbullying bill (Bill C-13) (See: Privacy watchdog backs cyberbullying bill’s ‘lawful access’ powers - The Globe and Mail.)

From the Globe:

Ms. Stoddart – who steps down Monday after a high-profile 10-year term – was a vocal critic of the 2012 bill. She said the latest version appears to be an improvement and she doesn’t fault the government for linking lawful access and cyberbullying.

“I think it stands to reason that in order to literally police the Internet, you do need these powers. And if you want to be effective against cyberbullying, I would understand you do need extraordinary powers, so it doesn’t seem to me inappropriate,” she said. “That’s my take on it at the moment, but as we learn more, perhaps there are things in there that you don’t need.”

I am very surprised and, frankly, disappointed.

The bill creates a number of new production orders, by which the police can require a third party to hand over any kind of information, including location tracking data. And all the production orders require that the police convince a justice of the peace that you are a suspect of having violated any Canadian federal law (such as the Copyright Act) without any obligation to substantiate that you likely committed a crime. Current search warrants require "reasonable grounds to believe", not the incredibly low "reasonable suspicion" standard.

These production orders can apply to your text messages, your e-mail messages, your internet history, your banking information and any other information that a third party may know about you.

For more on this, see my post on the new cyberbullying bill.

Update (2013-11-28) - The statements attributed to the Commissioner have been significantly tempered by a posting on the OPC's website:

Statement from the Privacy Commissioner of Canada regarding Bill C-13 - November 28, 2013

OTTAWA, November 28, 2013 – Privacy Commissioner of Canada Jennifer Stoddart today issued the following statement in response to requests for her Office’s preliminary comments on Bill C-13, An Act to amend the Criminal Code, the Canada Evidence Act, the Competition Act and the Mutual Legal Assistance in Criminal Matters Act:

My Office is currently reviewing the Bill thoroughly and, in particular, we are examining legal controls over any new investigative powers. We will make our full comments to Parliament in due course, with the goal of contributing constructively to the eventual study of this Bill in keeping with our role as an Agent of Parliament.

We commend the government for recognizing the gravity of privacy intrusions online, and for proposing action to address the issue of cyberbullying.

We recognize that law enforcement authorities need up-to-date tools to fight online crime at a time of when technologies are changing rapidly, but this must be done in a way that respects Canadians’ fundamental right to privacy.

As for our preliminary observations on Bill C-13, we note that many troubling aspects of the former Bill C-30 have not been repeated, for example, warrantless access to personal information. However, we have questions about the following issues:

• new investigative powers, (including preservation orders) proposed by the Bill and the thresholds for their use;
  
• the potentially large number of “public officers” who would be able to use these significant new powers; and
  
• a lack of accountability and reporting mechanisms to shed light on the use of new investigative powers.

My Office was not consulted on the Bill and the first time we saw a copy was Wednesday, November 20th, when the legislation was tabled. Justice Canada officials met with officials from our Office this summer, at which time we discussed specific recommendations made in a report by Federal-Provincial and Territorial officials on cyberbullying.

We look forward to sharing more comprehensive comments on the Bill with Parliament.

Update (2013-12-03) - The Commissioner has responded to the Globe & Mail's report in a letter to the editor:

Dec. 3: Safety derailed – and other letters to the editor - The Globe and Mail

Privacy but …

Re Privacy Online (letters, Dec. 2): We welcome the fact that government is taking action against cyberbullying; we are also pleased to see that the government has not repeated some of the more privacy-intrusive aspects of previous lawful access legislation – in particular, access to personal information without a warrant.

However, after a preliminary review of the legislation, we have a number of questions, specifically with respect to proposed new investigative powers and thresholds for their use, as well as the potentially large number of “public officers” who would be able to use these significant new powers. We also note there is a lack of accountability and reporting mechanisms to shed light on the use of new investigative powers.

The Office of the Privacy Commissioner will make its full comments to Parliament in due course, with the goal of contributing constructively to the eventual study of this bill.

Jennifer Stoddart, Privacy Commissioner of Canada

Notice of Vacancy: Privacy Commissioner

Earlier today, the Prime Minister's Office announced that Chantal Bernier has been appointed interim Privacy Commissioner of Canada upon the retirement of Jennifer Stoddart next week.

PM ANNOUNCES APPOINTMENT OF CHANTAL BERNIER AS INTERIM PRIVACY COMMISSIONER

Ottawa, Ontario

27 November 2013

Prime Minister Stephen Harper today announced the appointment of Ms. Chantal Bernier as Interim Privacy Commissioner, to serve pending the completion of the publicly advertised selection process for the next Privacy Commissioner. The appointment is effective December 3, 2013.

The Prime Minister took the opportunity to thank outgoing Privacy Commissioner, Ms. Jennifer Stoddart. “I would like to thank Jennifer Stoddart for her years of service as the Privacy Commissioner of Canada,” said the Prime Minister. “Canadians have been well-served by her exemplary leadership in overseeing compliance with Canada’s privacy laws.”

The Office of the Privacy Commissioner was created in 1977 under the Canadian Human Rights Act, Part IV. The Privacy Act, which currently governs the functions of the Privacy Commissioner, was adopted in 1983.

As an Agent of Parliament, the Privacy Commissioner oversees compliance with both the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act, Canada's private sector privacy law. The mission of the Office of the Privacy Commissioner of Canada is to protect and promote the privacy rights of individuals. The Privacy Commissioner of Canada, who is independent of government, reports directly to Parliament.

In the meantime, if you're looking for a cool gig and want to be Privacy Commissioner of Canada, they are advertising for the position:

Notice of Vacancy: Privacy Commissioner (full-time position) - Opportunities at the Office of the Privacy Commissioner of Canada

Notice of Vacancy

Office of the Privacy Commissioner Of Canada

Privacy Commissioner (full-time position)

Salary: $295,500

Location: Ottawa, Ontario (until relocated to Gatineau, Quebec in February 2014)

The mission of the Office of the Privacy Commissioner of Canada is to protect and promote the privacy rights of individuals. The Office oversees compliance with both the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s private sector privacy law, along with some aspects of Canada’s anti-spam law.

As an Agent of Parliament, the Privacy Commissioner reports directly to the House of Commons and the Senate. The Commissioner’s powers to further the privacy rights of Canadians include: investigating complaints; conducting audits and pursuing court action under the Privacy Act and PIPEDA; publicly reporting on the personal information-handling practices of public- and private- sector organizations; undertaking and publishing research related to the protection of personal information; and promoting public awareness and understanding of privacy issues. The Commissioner works independently of the government to investigate complaints from individuals with respect to the federal public sector and the private sector.

The ideal candidate should possess a degree from a recognized university in a relevant field of study, or an acceptable combination of education, job-related training and/or experience. A degree in law would be considered an asset.

The ideal candidate would have management experience at the senior executive level in a private or public sector organization, including managing human and financial resources. Experience working with and rendering decisions on complex sensitive issues, preferably in areas related to privacy (data protection, security, cyberspace, technology, etc.) is desired. He or she would also have experience in the interpretation and application of legislation, regulations and policies. Experience dealing with government, preferably with senior government officials, as well as stakeholders and the media, is sought.

The ideal candidate would have knowledge of the principles of the Privacy Act and PIPEDA as well as the mandate, roles, responsibilities and accountabilities of the Privacy Commissioner. Knowledge of the role of an Agent of Parliament and its relationship with Parliament and the Government, as well as knowledge of the Canadian government, including its policies, practices and decision-making frameworks, are desired. The candidate would have knowledge of the global nature of privacy and data protection. Knowledge of privacy regimes in other jurisdictions – provincial, territorial, national and international – would be considered an asset.

The ideal candidate would possess superior leadership skills in managing a team of people and championing privacy interests in an ever-changing environment and the ability to develop and maintain effective relationships with a broad range of stakeholders that include the private sector, policy makers at all levels of government nationally and internationally, the media and civil society. The ability to interpret relevant statutes, regulations and policies, and analyse complex situations in order to make equitable and timely decisions and recommendations, while anticipating their short- and long-term consequences is desired. The candidate would also have the ability to think strategically, anticipate trends and act to influence the policy development process. He or she would have superior communication skills, both written and oral, and the ability to act as a spokesperson on privacy issues in dealing with Parliament, the Government, the media, the general public and other organizations on both a national and international level.

To achieve the Office of the Privacy Commissioner of Canada’s objectives and carry out its mandate, the Privacy Commissioner would possess strong professional ethics, sound judgement, objectivity and diplomacy. A person of integrity, he or she would possess superior interpersonal skills, tact and discretion.

Proficiency in both official languages is required.

The Office of the Privacy Commissioner of Canada’s head office is currently located in Ottawa, Ontario, but will be relocating to Gatineau, Quebec in February 2014; therefore, the successful candidate must reside in or be willing to relocate to the Ottawa/Gatineau area or to a location that is within reasonable commuting distance.

The Government is committed to ensuring that its appointments are representative of Canada’s regions and official languages, as well as of women, Aboriginal peoples, disabled persons and visible minorities.

The selected candidate must comply with the Ethical and Political Activity Guidelines for Public Office Holders. The guidelines are available on the Governor in Council Appointments website, under "Reference Material".

The selected candidate will be subject to the Conflict of Interest Act. Public office holders appointed on a full-time basis must submit to the Office of the Conflict of Interest and Ethics Commissioner, within 60 days of appointment, a confidential report in which they disclose all of their assets, liabilities and outside activities. For more information, please visit the Office of the Conflict of Interest and Ethics Commissioner’s website.

This notice has been placed in the Canada Gazette to assist the Governor in Council in identifying qualified candidates for this position. It is not, however, intended to be the sole means of recruitment.

Further details about the Office of the Privacy Commissioner of Canada and its activities can be found on the website.

For more information, please contact:

Michelle Richard or Paul Marshall at (613) 742-3217 or paul.marshall@odgersberndtson.ca

Class Action filed against Health Canada in Medical Marijuana privacy breach

This afternoon, my firm filed a statement of claim in the Federal Court against Health Canada (John Doe v. Her Majesty) in connection with the massive privacy breach associated with the government’s medical marijuana program. As we understand it, Health Canada irresponsibly deviated from their usual practice of plain brown envelopes, couriers and registered mail by sending a mailing to around 40,000 individuals associated with the program clearly announcing the “Medical Marihuana Program” on the return address.

Between Friday and today, I have had many calls from individuals whose privacy was compromised by this breach, most of them fearing for their jobs and all of them concerned about their own safety. If it gets out in your community that you lawfully possess cannabis, this makes you a target for break and enters. The risk is even more heightened if you are a licensed grower of the plant. While this is a lawful program, the use of medical marijuana is heavily stigmatized.

This is not like most large-scale privacy breaches where the harm is mostly theoretical, since the missing hard-drive or thumb-drive likely didn’t leave the building. In this case, sensitive personal information was exposed to people who had no right to see it. I am told that some people have already lost their jobs because of this. For the rest, it is hard to put a price on legitimate concern about your family’s safety. I lived for a number of years in a community of 400 people, where the Canada Post employees were also neighbours.

Health Canada has dismissed this as a simple administrative error that they’ll endeavour to not repeat. But that’s not good enough from our government. People get to choose the businesses they deal with. If you don’t like how your bank or other service provider handles your personal information, you can change banks or businesses. But that’s not the case with your government. It’s a non-consensual relationship and the government owes a special duty of care to its citizens to protect them and to protect their sensitive personal information. Participants in this program were obtaining a restricted drug for medical purposes and could not do so lawfully except through the government program. Citizens should not have to choose between doing it lawfully or doing it safely. And we are talking about sensitive personal health information, which is generally recognized in Canada as the most sensitive personal information.

If you, or anyone you know, has been affected by this breach, please go to http://www.healthprivacyclassaction.com to provide your contact information so we can keep you apprised of this case as it progresses. Please provide an e-mail address that is confidential only to you. If this breach has had a particular impact on you, there is a portion of the form to provide details about this. Any information you provide will be kept confidential.

Here is the media release:

McInnes Cooper law firm files national class action in medical marijuana privacy breach

HALIFAX, Nov. 25, 2013 /CNW/ - McInnes Cooper law firm today filed a proposed class action in Federal Court against the Government of Canada in response to Health Canada's breach of the privacy rights of 40,000 patients in the Marijuana Medical Access Program. Under the Marijuana Medical Access Program, patients are permitted to grow marijuana in their residence for medicinal purposes.  

Earlier this month, Health Canada sent these patients a letter via Canada Post that clearly indicated on the envelope that the named patient participated in the Marijuana Medical Access Program.

Health Canada's disclosure of the patients' private medical information has raised serious employment and security concerns, and caused the patients to suffer considerable stress and anxiety.

"As a result of Health Canada's error, we have already spoken with a number of people whose lives have been affected by this breach," said David Fraser, a national expert on privacy law, and McInnes Cooper's lead lawyer on this case.

"We have heard that some individuals have already lost their jobs as a result, and everyone we've spoken with is concerned about their safety in their homes."

SOURCE: McInnes Cooper

The statement of claim is here:

FEDERAL COURT

 

PROPOSED CLASS ACTION

 

 

BETWEEN:

 

JOHN DOE

 

                                                                                                                            PLAINTIFF

 

- and -

                                                                                                                                                                

                                                                                                                                                                 

HER MAJESTY THE QUEEN

 

                                                                DEFENDANT

 

 

STATEMENT OF CLAIM

 

 

TO THE DEFENDANT:

 

A LEGAL PROCEEDING HAS BEEN COMMENCED AGAINST YOU by the Plaintiff.  The claim made against you is set out in the following pages.

 

                IF YOU WISH TO DEFEND THIS PROCEEDING, you or a solicitor acting for you are required to prepare a statement of defence in Form 171B prescribed by the Federal Courts Rules, serve it on the Plaintiff’s solicitor or, where the Plaintiff does not have a solicitor, serve it on the Plaintiff, and file it, with proof of service, at a local office of this Court, WITHIN 30 DAYS after this Statement of Claim is served on you, if you are served within Canada.

 

                If you are served in the United States of America, the period for serving and filing your Statement of Defence is forty days.  If you are served outside Canada and the United States of America, the period for serving and filing your Statement of Defence is sixty days.

 

                Copies of the Federal Courts Rules, information concerning the local offices of the Court and other necessary information may be obtained on request to the Administrator of this Court at Ottawa (telephone: 613-992-4238) or at any local office.

 

                IF YOU FAIL TO DEFEND THIS PROCEEDING, judgment may be given against you in your absence and without further notice to you.

 

 

Date:  _____________________________________

 

Issued by:  _________________________________

[Registry Officer]

 

Address of local office:  1801 Hollis Street,

                                            17th Floor, Suite 1720

                                            Halifax, N.S.  B3J 1S7

                             

 

To:                   The Attorney General of Canada

Attention:     Mr. Willian F. Pentney, Deputy Attorney General of Canada

 

 

 

Claim

 

1.    The Plaintiff claims on his own behalf and on behalf of the proposed Class:

 

a.    An Order pursuant to Rules 334.16(1) and 334.17 of the Federal Courts Rules certifying this action as a class proceeding;

 

b.    An Order pursuant to Rules 334.12(3), 334.16(1)(e) and 334.17(b) appointing the Plaintiff as the representative plaintiff for the Class;

 

c.    Damages for the torts of intrusion upon seclusion, publicity given to private life, breach of confidence and negligence;

 

d.    An Order pursuant to Rule 334.28(1) and (2) for the aggregate assessment of monetary relief and its distribution to the Plaintiff and the Class;

 

e.    Prejudgment interest pursuant to section 36 of the Federal Courts Act;

 

f.     Costs, if appropriate; and

 

g.    Such further and other relief as this Honourable Court deems just.

 

Parties

 

2.    The Plaintiff is an individual who resides in Nova Scotia. He is employed in the health care field.

 

3.    The Plaintiff brings this action on his own behalf and on behalf of the members of the proposed class, which is defined as follows:

 

All persons who were sent a letter from Health Canada in November 2013 that had the phrase Marihuana Medical Access Program or a similar French phrase visible on the front of the envelope.

 

4.    The Defendant, Her Majesty the Queen, is named as a representative of the Federal Government of Canada and Health Canada. Health Canada administers the Marihuana Medical Access Program under the Marihuana Medical Access Regulations.

 

Medical Marihuana Access Program

 

5.    Through the Marihuana Medical Access Program, the Defendant grants access to marihuana for medical use to Canadians suffering from grave and debilitating illnesses.

 

6.    Marihuana (cannabis) is categorized as a controlled substance, regulated in Canada under the Controlled Drugs and Substances Act. It is not legal to grow or possess marihuana except with legal permission by the Defendant under the Marihuana Medical Access Program.

 

7.    The Plaintiff applied to participate in the Defendant’s Marihuana Medical Access Program to grow and possess marihuana to alleviate the pain that he suffers due to a medical condition. The Defendant approved the Plaintiff’s application.

 

Disclosure of the Plaintiff’s Private Information

 

8.    The Defendant typically corresponds to the Plaintiff by courier service with plain unmarked brown envelopes.

 

9.    During the week of November 21, 2013, the Defendant sent the Plaintiff a letter plainly and clearly indicating on the envelope that it was from Health Canada and that it was in regards to the Marihuana Medical Access Program.

 

10.  By publically indicating that the Plaintiff was a participant in the Marihuana Medical Access Program, the Defendant disclosed the personal health information about the Plaintiff. Furthermore, the Defendant’s disclosure creates a security concern by alerting other individuals that the Plaintiff may possess and/or grow marihuana at his residence.

 

Negligence

 

11.  At all material times, the Defendant owed a duty of care to the Plaintiff and the proposed Class.

 

12.  Furthermore, the Defendant had a statutory duty under subsection 8(1) of the Privacy Act to not disclose personal information without that individual’s consent. The Plaintiff’s and the Class’ participation in the Marihuana Medical Access Program constitutes personal information as it is confidential information and relates to their medical history.

 

13.  The Defendant breached its duty of care owed to the Plaintiff and the Class by:

 

a.    Failing to meet its statutory duties and/or policies in the collection, retention and disclosure of personal information;

 

b.    Failing to take reasonable steps to ensure the personal information was not disclosed;

 

c.    Failing to communicate with the Plaintiff and the Class in a manner that did not disclose their personal information; and

 

d.    Other such particulars as counsel may advise.

 

Publicity Given to Private Life

 

14.  Through its actions stated above, the Defendant gave publicity to the Plaintiff’s private, personal information, particularly his medical condition.

 

15.  The Plaintiff’s private personal information is of no legitimate concern to the public. The Defendant’s disclosure of the Plaintiff’s private personal information is highly offensive to a reasonable person.

 

Breach of Confidence

 

16.  The Plaintiff states that the Defendant committed the tort of breach of confidence.

 

17.  In applying to participate in the Marihuana Medical Access Program, the Plaintiff conveyed confidential information in confidence to the Defendant.

 

18.  In its actions stated above, the Defendant misused the Plaintiff’s confidential information to the Plaintiff’ detriment.

 

Intrusion upon Seclusion

 

19.  The Defendant’s above stated actions constitute an intrusion on seclusion in a manner that would be highly offensive to a reasonable person.

 

Relief Sought

 

20.  The Defendant’s actions have caused the Plaintiff and the Class to suffer the following damages:

 

a.    Costs incurred in taking additional security precautions;

b.    Damage to reputation;

c.    Damage to employment;

d.    Mental distress;

e.    General damages; and

f.     Inconvenience, frustration and anxiety.

 

General

 

21.  The Plaintiff proposes that this trial take place in Halifax.

 

DATED at Halifax, in the Province of Nova Scotia, this 25th day of November 2013.

 

 

PLACE OF TRIAL:                    HALIFAX, NOVA SCOTIA

 

 

                                                                ____________________________________

                                                                            David T.S. Fraser

Solicitor for the Plaintiff

 

Some comments on the new Canadian Cyberbullying bill, aka Bill C-13 "Protecting Canadians from Online Crime Act"

As promised, and perhaps not surprisingly, I have some things to say about the new Bill C-13, called the "Protecting Canadians from Online Crime Act". It was introduced as Canada's cyberbullying law, but it's more than that. The summary of the bill only refers to the portions of the legislation that deal with cyberbullying, but the government has buried a number of other provisions in the statute that seem to have little, if nothing, to do with cyberbullying.

A word of caution: I've only just gotten my hands on the Bill and my comments are necessarily quick off the mark and without a whole lot of opportunity for reflection. My opinions may change as I digest this or hear responses to this. And, of course, this does not reflect the opinions of my firm, its clients, my friends, my cat or anyone else. If I make a mistake, please let me know and I will be glad to correct it.

First of all, the actual cyberbullying parts, which start at Clause 3 of the Bill:

The heart of it is the creation of a new crime of the non-consensual distribution of intimate images.

162.1 (1) Everyone who knowingly publishes, distributes, transmits, sells, makes available or advertises an intimate image of a person knowing that the person depicted in the image did not give their consent to that conduct, or being reckless as to whether or not that person gave their consent to that conduct, is guilty

(a) of an indictable offence and liable to imprisonment for a term of not more than five years; or

(b) of an offence punishable on summary conviction.

Definition of “intimate image”

(2) In this section, “intimate image” means a visual recording of a person made by any means including a photographic, film or video recording,

(a) in which the person is nude, is exposing his or her genital organs or anal region or her breasts or is engaged in explicit sexual activity;

(b) in respect of which, at the time of the recording, there were circumstances that gave rise to a reasonable expectation of privacy; and

(c) in respect of which the person depicted retains a reasonable expectation of privacy at the time the offence is committed.

Defence

(3) No person shall be convicted of an offence under this section if the conduct that forms the subject-matter of the charge serves the public good and does not extend beyond what serves the public good.

Question of fact and law, motives

(4) For the purposes of subsection (3),

(a) it is a question of law whether the conduct serves the public good and whether there is evidence that the conduct alleged goes beyond what serves the public good, but it is a question of fact whether the conduct does or does not extend beyond what serves the public good; and

(b) the motives of an accused are irrelevant.

This is a very difficult provision to get right and an easy provision to get wrong. It is a good thing, in my view, that in order to be found guilty, the accused has to have known that the person depicted did not give consent. But the standard is then lowered to being reckless about whether or not the person gave their consent. This is problematic, in my view.

Imagine a scenario where a woman (let's call her Anne and also assume she's an adult) takes an intimate image of herself and sends it to her boyfriend, Bob. By doing that she has at least consented to having that image sent to him. Anne sent it to Bob, afterall, but there is not explicit communication of the consent involved. Bob is an idiot and a braggart, so he then sends the image to his friend Carl. Did Bob not have Anne's consent to do that? Probably, but the police would have to prove that he knew that he did not have her consent or that he was reckless about a lack of consent. This would have to be proven beyond a reasonable doubt. But now Carl has it and is two steps removed from Anne and has little knowledge about the circumstances under which Bob got the image. It's harder to convict him of knowledge of lack of consent and probably about his recklessness. Imagine that Bob and Anne broke up. As I said, Bob is an idiot, so he posts it on a website, where it is viewed by Dan and Ed. Both Dan and Ed like the photo, so they re-post it and tweet it all over the internet. Dan and Ed have no idea who Anne or Bob are and have no knowledge of this history. They also don't know that Bob took the photo and posted it on the internet to hurt Anne. Are Dan and Ed criminals in this situation? Are they reckless if they don't inquire into it? Can they, since they don't know who Anne is or how to contact her? In this scenario, I would think that Bob is and Carl may be criminals, but Dan and Ed are too far removed to know whether there was consent and the law can't assume any sort of knowledge about lack of consent. It has to be proven. I would not want the law to assume a lack of consent unless the distributor had confirmed it.

I also wonder what is meant by "publishes". Criminal liability should not attach to an intermediary who has no knowledge of the background and the law should not place an obligation on that intermediary to somehow establish the provenance of the photo or image.

The new Section 162.2 allows a court to prohibit someone convicted under the previous section from using the internet for any indeterminate period of time set by the court.

162.2 (1) When an offender is convicted, or is discharged on the conditions prescribed in a probation order under section 730, of an offence referred to in subsection 162.1(1), the court that sentences or discharges the offender, in addition to any other punishment that may be imposed for that offence or any other condition prescribed in the order of discharge, may make, subject to the conditions or exemptions that the court directs, an order prohibiting the offender from using the Internet or other digital network, unless the offender does so in accordance with conditions set by the court.

Duration of prohibition

(2) The prohibition may be for any period that the court considers appropriate, including any period to which the offender is sentenced to imprisonment.

Court may vary order

(3) A court that makes an order of prohibition or, if the court is for any reason unable to act, another court of equivalent jurisdiction in the same province may, on application of the offender or the prosecutor, require the offender to appear before it at any time and, after hearing the parties, that court may vary the conditions prescribed in the order if, in the opinion of the court, the variation is desirable because of changed circumstances after the conditions were prescribed.

I can see the logic behind this, but I often find myself wondering whether the people who draft these laws and the people who enforce them are detached from living in the modern world. Refusing access to the internet is not the same as prohibiting ownership of a firearm. It is virtually impossible for a young person to live any sort of normal life without access to the internet. I know of few jobs these days, other than flipping burgers, that doesn't involve using the internet in one way or another. It's pretty hard to even get a cell phone that doesn't have access to the internet. (Even the old Nokia 252 sitting in the bottom of my junk drawer can access the internet.) I am concerned that such a measure may be imposed too regularly without enough consideration of what sort of impact this may have on the ability of someone to reintegrate into society.

Next up are a number of amendments to existing sections of the Criminal Code which allow for the seizure of obscenity, child pornography and "crime comics" (yes, you read that right), to which "intimate images" are added.

After that, Clause 6 provides for the forfeiture of property related to the offence.

Clause 7 adds the distribution of intimate images to the category of offences that are applicable for certain warrants. some other sub-clauses look like housekeeping, though I'll take a closer look later.

Clause 8 deals with authorizations to intercept certain private communications with the consent of a party to the communication. It adds a new subsection (5) to Section 184.2 of the Criminal Code:

(5) A judge who gives an authorization under this section may, at the same time, issue a warrant or make an order under any of sections 487, 487.01, 487.014 to 487.018, 487.02, 492.1 and 492.2 if the judge is of the opinion that the requested warrant or order is related to the execution of the authorization.

Likewise, clause 9 adds a similar subsection to section 186 of the Criminal Code:

(8) A judge who gives an authorization under this section may, at the same time, issue a warrant or make an order under any of sections 487, 487.01, 487.014 to 487.018, 487.02, 492.1 and 492.2 if the judge is of the opinion that the requested warrant or order is related to the execution of the authorization.

Clause 10 deals with keeping the affidavit to obtain a warrant secret. This appears, at first glance, to be housekeeping. Clause 11 also looks like a housekeeping amendment.

Oddly out of place, Clause 12 seems to expand the categories of identifiable groups for the advocating genocide crime under Section 318 of the Criminal Code:

(4) In this section, “identifiable group” means any section of the public distinguished by colour, race, religion, national or ethnic origin, age, sex, sexual orientation, or mental or physical disability.

Clauses 13 amends the provisions of the Code dealing with hate propaganda.

Clauses 14-17 amend the existing sections in the Criminal Code addressing computer crime, none of which have anything to do specifically with cyberbullying. Clause 15 augments the offence of possession of a device to obtain use of telecommunication facility or telecommunication service while Clause 17 amends the offence of Possession of device to obtain unauthorized use of computer system or to commit mischief.

Clause 18, on the other hand, actually has to do with cyberbullying. It amends the existing provisions of the Code related to harassing communications and extends them to include all modes of telecommunications:

Message in false name

371. Everyone who, with intent to defraud, causes a message to be sent as if it were sent under the authority of another person, knowing that it is not sent under that authority and with intent that it should be acted on as if it were, is guilty of an indictable offence and liable to imprisonment for a term of not more than five years.

False information
372. (1) Everyone commits an offence who, with intent to injure or alarm a person, conveys information that they know is false, or causes such information to be conveyed by letter or any means of telecommunication.

Indecent communications

(2) Everyone commits an offence who, with intent to alarm or annoy a person, makes an indecent communication to that person or to any other person by a means of telecommunication.

Harassing communications

(3) Everyone commits an offence who, without lawful excuse and with intent to harass a person, repeatedly communicates, or causes repeated communications to be made, with them by a means of telecommunication.

Punishment

(4) Everyone who commits an offence under this section is

(a) guilty of an indictable offence and liable to imprisonment for a term of not more than two years; or

(b) guilty of an offence punishable on summary conviction.

Clause 20 adds new categories of production orders to the Criminal Code, including orders related to transmission data and tracing data, along with giving law enforcement the ability to demand that anyone preserve computer data for 21 or 90 days, depending upon the nature of the offence. They are all somewhat problematic, since all that is required is a "reasonable suspicion", not "reasonable and probable grounds to believe" or another higher threshold. The drafters appear to think that the sort of information that would be produced is not sensitive and should not be afforded a high level of protection.

Preservation demand

487.012 (1) A peace officer or public officer may make a demand to a person in Form 5.001 requiring them to preserve computer data that is in their possession or control when the demand is made.

Conditions for making demand

(2) The peace officer or public officer may make the demand only if they have reasonable grounds to suspect that

(a) an offence has been or will be committed under this or any other Act of Parliament or has been committed under a law of a foreign state;

(b) in the case of an offence committed under a law of a foreign state, an investigation is being conducted by a person or authority with responsibility in that state for the investigation of such offences; and

(c) the computer data is in the person’s possession or control and will assist in the investigation of the offence.

Limitation

(3) A demand may not be made to a person who is under investigation for the offence referred to in paragraph (2)(a).

Expiry and revocation of demand

(4) A peace officer or public officer may revoke the demand by notice given to the person at any time. Unless the demand is revoked earlier, the demand expires

(a) in the case of an offence that has been or will be committed under this or any other Act of Parliament, 21 days after the day on which it is made; and

(b) in the case of an offence committed under a law of a foreign state, 90 days after the day on which it is made.

Conditions in demand

(5) The peace officer or public officer who makes the demand may impose any conditions in the demand that they consider appropriate — including conditions prohibiting the disclosure of its existence or some or all of its contents — and may revoke a condition at any time by notice given to the person.

No further demand

(6) A peace officer or public officer may not make another demand requiring the person to preserve the same computer data in connection with the investigation.

I don't have any particular concerns with this new provision, other than subsection (5), which seems to give the peace officer unfettered discretion to place conditions on the demand, including a gag order. If a gag order is contemplated, it should be clearly set out in the Code, the criteria to justify it should be clearly set out as well and it should be subject to judicial review. Providing the police with such discretion only means it will be exercised in the vast majority of cases.

The following sections allow a police officer to seek a judge's order that data be preserved in similar circumstances.

Next up is a new Section 487.014 of the Code, which provides for a "general production order".

General production order

487.014 (1) Subject to sections 487.015 to 487.018, on ex parte application made by a peace officer or public officer, a justice or judge may order a person to produce a document that is a copy of a document that is in their possession or control when they receive the order, or to prepare and produce a document containing data that is in their possession or control at that time.

Conditions for making order

(2) Before making the order, the justice or judge must be satisfied by information on oath in Form 5.004 that there are reasonable grounds to believe that

(a) an offence has been or will be committed under this or any other Act of Parliament; and

(b) the document or data is in the person’s possession or control and will afford evidence respecting the commission of the offence.

Form

(3) The order is to be in Form 5.005.

Limitation

(4) A person who is under investigation for the offence referred to in subsection (2) may not be made subject to an order.

Subsequent sections add on production orders for tracing communications (new s. 487.015), to obtain transmission data (new s. 148.016), to obtain tracking (location) data (new s. 487.017) and to obtain financial data from a financial institution (new s. 487.018).

The Bill introduces new production orders that do require judicial authorization, but the threshold for obtaining them are very low. As with the preservation demand, all that is required are “reasonable grounds to suspect” that an offence has been committed, rather than the more onerous “reasonable and probably grounds to believe”. The specific production orders fall under the categories of “general production order” related to any document, tracing data, tracking data, non-content transmission information and financial information. For example the tracking data provisions read:

“tracking data” means data that relates to the location of a transaction, individual or thing.

Production order — tracking data

487.017 (1) On ex parte application made by a peace officer or public officer, a justice or judge may order a person to prepare and produce a document containing tracking data that is in their possession or control when they receive the order.

Conditions for making order

(2) Before making the order, the justice or judge must be satisfied by information on oath in Form 5.004 that there are reasonable grounds to suspect that

(a) an offence has been or will be committed under this or any other Act of Parliament; and

(b) the tracking data is in the person’s possession or control and will assist in the investigation of the offence.

Form

(3) The order is to be in Form 5.007.

Limitation

(4) A person who is under investigation for the offence referred to in subsection (2) may not be made subject to an order.

New Code section 492.1 provides for warrants to authorize the installation of “tracking devices” on vehicles and things carried or worn by individuals and “transmission data recorders” to obtain transmission data. Again, both these warrants only require “reasonable grounds to suspect”.

The Bill also provides immunity to third parties who voluntarily provide information to the police:

For greater certainty

487.0195 (1) For greater certainty, no preservation demand, preservation order or production order is necessary for a peace officer or public officer to ask a person to voluntarily preserve data that the person is not prohibited by law from preserving or to voluntarily provide a document to the officer that the person is not prohibited by law from disclosing.

No civil or criminal liability

(2) A person who preserves data or provides a document in those circumstances does not incur any criminal or civil liability for doing so.

It does however seem unusual that a service provider would need the immunity in subsection (2) if the “is not prohibited by law from disclosing” is satisfied from subsection (1).

Provisions in the Competition Act related to telemarketing are amended by Clauses 28-35, while the Mutual Legal Assistance in Criminal Matters Act is amended by Clauses 36 – 45 to extend these new investigative powers to incoming requests from foreign authorities. Also amended is the Canada Evidence Act so that a spouse is a competent and compellable witness for the prosecution with respect to the new offence of non-consensual distribution of intimate images.

Anti-cyberbullying bill tabled in Canadian Parliament

This afternoon, the Canadian Justice Minister and the Minister of Public Safety and Emergency Preparedness announced a new bill designed to counter specific aspects of online cyberbullying. The bill does not create any new crime of cyberbullying (as existing laws can deal with harassment, extortion and the like), but it does create an offence related to the non-consensual distribution of intimate images online.

While I haven't had the opportunity to scrutinize the bill in great detail (update: now posted online here), it does create an to prohibit the non-consensual distribution of intimate images – punishable by a maximum penalty of five years’ imprisonment on indictment or six months’ imprisonment on summary conviction. An intimate image is one that depicts a person engaged in explicit sexual activity or that depicts a sexual organ, anal region or breast. Further, the image would be one for which, at the time of the recording, the person depicted had a reasonable expectation of privacy and, at the time of the offence, had not relinquished his or her privacy interest. How this will be construed by the courts will be something to watch closely.

The Bill also would permit the Court to order the removal of an intimate image that is posted online. This may ultimately be problematic as many of the online services that host such content would be based outside of Canada and likely beyond the effective jurisdiction of Canadian court orders. It may be more effective for any order to be directed that the person who posted it in the first place, who likely retains the ability to have it removed.

The law also augments existing investigation powers of the police -- all of which the Government has taken great pains to emphasise involve judicial oversight -- including preservation demands.

More analysis to follow. In the meantime, here is the media release and backgrounder prepared by the Department of Justice:

GOVERNMENT INTRODUCES LEGISLATION TO CRACK DOWN ON CYBERBULLYING

OTTAWA, November 20, 2013 – The Honourable Peter MacKay, P.C., Q.C., M.P.

for Central Nova, Minister of Justice and Attorney General of Canada, today introduced legislation to address criminal behaviour associated with cyberbullying. This legislation demonstrates the Government’s firm commitment to ensuring that Canadians are better protected against online exploitation. Minister MacKay was joined by the Honourable Steven Blaney, Minister of Public Safety and Emergency Preparedness.

“Our Government is committed to ensuring that our children are safe from online predators and from online exploitation. We have an obligation to help put an end to harmful online harassment and exploitation.

Cyberbullying goes far beyond schoolyard bullying and, in some cases, can cross the line into criminal activity,” said Minister Mackay. “With the click of a computer mouse, a person can be victimized before the entire world. As we have seen far too often, such conduct can destroy lives. It clearly demands a stronger criminal justice response, and we intend to provide one.”

The legislation being introduced today would:

• Prohibit the non-consensual distribution of intimate images;
  
  
• Empower a court to order the removal of intimate images from the Internet;
  
  
• Permit the court to order forfeiture of the computer, cell phone or other device used in the offence;
  
  
• Provide for reimbursement to victims for costs incurred in removing the intimate image from the Internet or elsewhere; and
  
  
• Empower the court to make an order to prevent someone from distributing intimate images.

The proposed investigative powers to identify and remedy this and other cybercrimes would be subject to appropriate judicial oversight.

The Government worked closely with the provinces and territories in developing the report and recommendations on which this legislation is closely based.

“With this legislation, we are confirming that this type of behaviour is absolutely unacceptable and has serious consequences,” added Minister Blaney. “As part of Bullying Awareness Week, we are committed to reminding victims that they are not alone, and encouraging them to reach out to a teacher, a trusted adult, a parent or a friend. Bullying – whether online or off – is a problem that affects us all, and we all have a role to play in stopping it.”

Working with partners in the public and private sectors, the Government of Canada is taking action to address all forms of bullying through education, awareness and prevention activities.

For example, the Government is also supporting the development of a number of school-based projects to prevent bullying, as part of $10 million in funding that was committed in 2012 towards new crime prevention projects.

Other important projects that the Government supports to address cyberbullying include the Cybertip.ca and NeedHelpNow.ca websites operated by the Canadian Centre for Child Protection. Canadians can use these websites to report online sexual exploitation of children and to seek help for exploitation resulting from the sharing of sexual images.

In addition, through the Government’s GetCyberSafe campaign, Canadians can get the information they need to protect themselves and their families against online threats, including cyberbullying.

For more information on Bullying Awareness Week, please visit the website www.bullyingawarenessweek.org.

Backgrounder

Cyberbullying and the Non-Consensual distribution of Intimate Images

Bullying and Cyberbullying

Bullying, including cyberbullying, is a form of aggression, usually among children and youth but not always. When the bullying behaviour occurs via electronic means, it is often referred to as cyberbullying.

Bullying, including cyberbullying, can take many forms. Some forms, such as name-calling, teasing, belittling and social exclusion, are familiar and may be hurtful but are not criminal offences. However, bullying and cyberbullying conduct can escalate to more serious activities that are criminal offences under the Criminal Code, including criminal harassment (section 264); uttering threats (section 264.1); intimidation (subsection 423(1)); mischief in relation to data (subsection 430(1.1)); unauthorized use of computer (section 342.1); identity fraud (section 403); extortion (section 346); false messages, indecent or harassing telephone calls (section 372); counselling suicide (section 241); incitement of hatred (section 319); child pornography (section 163.1); and defamatory libel (sections 298-301).

More recently, a new form of cyberbullying has emerged that is not covered by the criminal law. It involves the distribution of intimate (sexual) images without the consent of the person depicted in the image.

Sometimes the motivation is to take revenge on a former partner (sometimes colloquially referred to as “revenge porn”). Young people are increasingly exchanging intimate images consensually, which is a problem in itself, but one that is exacerbated if those images later become fodder for humiliating cyberbullying attacks involving non-consensual distribution or so-called “sexploitation.”

Impact of Cyberbullying

Bullies have been around throughout history, but the widespread use of new communications technologies increases the potential impact of bullying behaviour. Bullies can now expand their audience from the schoolyard to around the globe. Once the bullying conduct is in cyberspace, it may be permanently available over the Internet, where it can spread quickly and often uncontrollably. This may compound feelings of fear, humiliation, and social isolation and have other negative effects on victims. There have been several reported cases of teen suicide where cyberbullying is alleged to have played a part.

Finding Solutions

At their October 2012 meeting, Federal-Provincial-Territorial Ministers responsible for Justice and Public Safety directed senior officials to identify potential gaps in the Criminal Code on cyberbullying and the non-consensual distribution of intimate images. The results of that review were published in a report in July 2013. The report concluded that a multi-pronged approach was needed to address cyberbullying. In addition to education, public awareness, and family and community support, the report recommended that the Criminal Code be amended to address certain gaps in the law and give law enforcement officers better tools to deal with the issue.

Bullying is also being addressed through non-legislative means, including education, awareness and prevention activities.

This reflects the fact that bullying is a social problem that needs comprehensive responses from schools, non-government organizations, the police, and community groups.

Proposed Criminal Code amendments

The federal Minister of Justice has introduced legislation to amend the Criminal Code to:

• Create a new offence to prohibit the non-consensual distribution of intimate images – punishable by a maximum penalty of five years’ imprisonment on indictment or six months’ imprisonment on summary conviction;
  
  
• Direct the sentencing judge to consider whether or not a person convicted of the new offence should be subject to a prohibition order that would restrict his or her use of the Internet for a specified period;
  
  
• Authorize a judge to order the removal of an intimate image from websites if the person depicted did not consent to having the image posted;
  
  
• Allow a judge to order restitution following a conviction to enable the victim to recoup expenses involved in having the images removed from the Internet or social media;
  
  
• Empower the court to seize and order the forfeiture of property related to the offence, such as computers and mobile devices;
  
  
• Specify that a justice may issue a recognizance order (peace bond) where there are reasonable grounds to believe an individual will commit the new offence; and
  
  
• Ensure that the spouse of an accused person is eligible to testify against the accused in court.

For purposes of the Criminal Code, “intimate image” would be defined as an image that depicts a person engaged in explicit sexual activity or that depicts a sexual organ, anal region or breast. Further, the image would be one for which, at the time of the recording, the person depicted had a reasonable expectation of privacy and, at the time of the offence, had not relinquished his or her privacy interest.

The proposed amendments to the Criminal Code would also modernize existing investigative powers (warrants and other judicial orders) to enable police – subject to prior judicial oversight –to obtain electronic evidence from the Internet and other new technologies more efficiently and effectively. More specifically, the proposed amendments would:

• Provide for preservation of volatile computer data;
  
  
• Require judicial authority to acquire preserved computer data, and require the deletion of such data when it is no longer needed;
  
  
• Update production orders and warrants to make them more responsive and appropriate for today’s advanced telecommunications environment;
  
  
• Give the police better tools to track and trace telecommunications to determine their origin or destination; and
  
  
• Streamline the process for obtaining multiple warrants and orders that are related to the execution of a wiretap authorization.

To safeguard privacy, none of the updates of investigative powers would allow access to data or subscriber information without prior judicial oversight.

Privacy Commssioner says beneficiary access to estate information is limited to his own personal information under PIPEDA, bigger jurisdictional question not addressed

The Office of the Privacy Commissioner of Canada has released a new report of findings related to an individual's request of a law firm for information about his possible entitlement as a beneficiary of the estates of his mother and grandmother. (See: Commissioner’s Findings - PIPEDA Report of Findings #2013-005: Beneficiary’s access to estate information is limited to his own personal information under PIPEDA.)

The law firm initially ignored the applicant's request and the individual complained. From the summary:

Our investigation determined that the legal firm receiving the access request ought to have responded to the individual within the 30-day time limit allowed by PIPEDA, even if the firm did not hold any of his personal information.

As for the access rights of the individual, we determined that the individual was only entitled to obtain information held in connection with the estates that was specifically about him. We noted that it was far from clear how much of the requested information and documents (i.e., statements of accounts, money received and receipts of disbursements) would qualify as the individual’s personal information. In the circumstances, we were satisfied that the legal firm had carried out a reasonable search of its records for the individual’s personal information.

The Office of the Privacy Commissioner of Canada found that, given the firm’s initial failure to respond to the access request in a timely manner before eventually answering, the complaint was well-founded and resolved.

What I find particularly interesting in this case is the lack of any discussion about whether the Commissioner had jurisdiction to investigate in the first place. As was definitively decided in State Farm Mutual Automobile Insurance Company v. Privacy Commissioner of Canada, 2010 FC 736, PIPEDA only applies to the collection, use and disclosure of personal information in the course of "commercial activities". In State Farm, the court found that a claim for damages between to individual litigants before the courts was not a "commercial activity" even though an insurance company, a law firm and a private investigator were all involved. At its core, it was a personal matter and not a commercial one.

I would think that in the case of an estate, it is similarly not a "commercial activity" at all, even if a law firm is involved. There's no mention of the issue in the finding, so it's likely that this issue was never raised.

Federal cyberbullying legislation expected tomorrow

The CBC is reporting that the federal government plans to introduce its anti-cyberbullying bill in Parliament tomorrow.

The bill is expected to focus on the non-consensual distribution of intimate images, but keep a close eye out for an attempt to bring in new lawful access powers, as well.

Here's the CBC report: Cyberbullying legislation to be announced Wednesday - Nova Scotia - CBC News.

For my comments on the discussion paper that likely prompted this legislation: Throne speech calls for "new tools for law enforcement" against cyberbullying.

Update (2013-11-20) - Some details are beginning to emerge about the bill, which PostMedia is suggesting will be called the "Protecting Canadians from Online Crime Act" (echoes of Bill C-30's "Protecting Children From Online Predators Act", maybe?)

From PostMedia News:

Federal government to table bill aimed at combating cyberbullying | canada.com

The federal government is poised to table new legislation Wednesday, aimed at modernizing the Criminal Code and combating cyberbullying, Postmedia News has learned.

The bill, dubbed the Protecting Canadians from Online Crime Act, will, among other things, amend the Criminal Code and the Evidence Act.

While details of the bill have not been released, a key recommendation contained in a July report by federal, provincial and territorial justice and public safety ministers recommended making it a new Criminal Code offence to knowingly distribute sexually explicit photos of a person without their consent. It recommended the offence be punishable by as many as five years in prison.

Justice Minister Peter MacKay said at the time he would seriously consider the chief recommendation.

The report also called for new provisions that would allow judges to order intimate images removed from the Internet and the forfeiture of cellphones, computers and other equipment used in the commission of an offence.

It’s unlikely Wednesday’s bill will create new laws to specifically address bullying and cyberbullying as the report ultimately concluded “existing” Criminal Code offences like criminal harassment, uttering threats, intimidation, unauthorized use of a computer, extortion, defamatory libel and child pornography “generally cover most serious bullying behaviour.” ...

Supreme Court of Canada finds Alberta privacy law to be unconstitutional infringement of freedom of expression

The Supreme Court of Canada today released its decision in Information and Privacy Commissioner et al v. United Food and Commercial Workers, Local 401, 2013 SCC 62.

This decision has been anxiously awaited as it has far-reaching implications for privacy legislation throughout Canada, as the provisions at issue in Alberta’s private sector privacy law are mirrored in the federal and British Columbia legislation.

The case arose in the context of a labour dispute at one of Alberta’s casinos. Striking employees set up a picket-line and video recorded replacement workers as they crossed the line. Images from the recordings were later placed on posters displayed at the picket‑line and appeared in newsletters and leaflets available to union members and the public.

Complaints were filed with the appellant Information and Privacy Commissioner of Alberta under that province’s Personal Information Protection Act. An adjudicator appointed by the Privacy Commissioner held that PIPA prohibited the Union from collecting, using and disclosing such photos and recordings without the consent of the individuals in question (which was unlikely to be forthcoming). The Union took the position that such a finding was in infringement of freedom of expression and sought judicial review in the Court of Queen’s Bench. which found that parts of the legislation were unconstitutional as an unreasonable infringement of freedom of expression as guaranteed under the Charter of Rights and Freedoms. The Alberta Court of Appeal concurred, and found that the infringement could not be justified.

On appeal, the Supreme Court of Canada has found that the provisions in question unduly limit the union's ability to communicate its message to the public and to other interested parties and are thus contrary to Section 2(b) of the Charter. This limitation is not justifible, the Court found:

[25] The price PIPA exacts, however, is disproportionate to the benefits it promotes. PIPA limits the collection, use and disclosure of personal information other than with consent without regard for the nature of the personal information, the purpose for which it is collected, used or disclosed, and the situational context for that information. As the Adjudicator recognized in her decision, PIPA does not provide any way to accommodate the expressive purposes of unions engaged in lawful strikes. Indeed, the Act does not include any mechanisms by which a union’s constitutional right to freedom of expression may be balanced with the interests protected by the legislation. As counsel for the Commissioner conceded during oral submissions, PIPA contains a general prohibition of the Union’s use of personal information (absent consent or deemed consent) to further its collective bargaining objectives. As a result, PIPA deems virtually all personal information to be protected regardless of context.

[26] But the extent to which significant values were actually impaired in the context of this case must be kept in context. The personal information was collected by the Union at an open political demonstration where it was readily and publicly observable. Those crossing the picketline would reasonably expect that their image could be caught and disseminated by others such as journalists, for example. Moreover, the personal information collected, used and disclosed by the Union was limited to images of individuals crossing a picketline and did not include intimate biographical details. No intimate details of the lifestyle or personal choices of the individuals were revealed.

[27] It goes without saying that by appearing in public, an individual does not automatically forfeit his or her interest in retaining control over the personal information which is thereby exposed. This is especially true given the developments in technology that make it possible for personal information to be recorded with ease, distributed to an almost infinite audience, and stored indefinitely. Nevertheless, PIPA’s restrictions operate in the context of a case like this one to impede the formulation and expression of views on matters of significant public interest and importance.

In the result, the provisions of PIPA were found to be unconstitutional and not justifiable. However, instead of striking down the provisions immediately and leaving a vacuum, the Court has suspended the declaration of invalidity for twelve months to allow the legislature to amend the legislation.

Because the provisions in question are effectively identical to those in British Columbia's privacy law and the Federal PIPEDA, it will be incumbent upon the BC legislature and the federal Parliament to make the same amendments to keep those laws constitutionally viable.

For previous blog posts on the case, click here and here's the headnote:

Constitutional law — Charter of Rights — Freedom of expression — Labour relations — Privacy — Union video‑taping and photographing individuals crossing its picket line for use in its labour dispute — Whether legislation restricting the collection, use and disclosure of personal information violates union’s expressive right under s. 2(b) of Charter and, if so, whether violation is justified — Canadian Charter of Rights and Freedoms, ss. 1, 2(b) — Personal Information Protection Act, S.A. 2003, c. P‑6.5 — Personal Information Protection Act Regulation, Alta Reg. 366/2003.

During a lawful strike lasting 305 days, both the Union and the employer video‑taped and photographed individuals crossing the picketline. The Union posted signs in the area of the picketing stating that images of persons crossing the picketline might be placed on a website. Several individuals who were recorded crossing the picketline filed complaints with the Alberta Information and Privacy Commissioner. The Commissioner appointed an Adjudicator to decide whether the Union had contravened the Personal Information Protection Act (PIPA). The Adjudicator concluded that the Union’s collection, use and disclosure of the information was not authorized by PIPA. On judicial review, PIPA was found to violate the Union’s rights under s. 2(b) of the Charter. The Court of Appeal agreed and granted the Union a constitutional exemption from the application of PIPA.

Held: The appeal is substantially dismissed.

PIPA establishes a general rule that organizations cannot collect, use or disclose personal information without consent. None of PIPA’s exemptions permit the Union to collect, use and disclose personal information for the purpose of advancing its interests in a labour dispute. The central issue is whether PIPA achieves a constitutionally acceptable balance between the interests of individuals in controlling the collection, use and disclosure of their personal information and a union’s freedom of expression. To the extent that PIPA restricts collection for legitimate labour relations purposes, it is in breach of s. 2(b) of the Charter and cannot be justified under s. 1.

The purpose of PIPA is to enhance an individual’s control over his or her personal information by restricting the collection, use and disclosure of personal information without that individual’s consent. The objective of providing an individual with this measure of control is intimately connected to individual autonomy, dignity and privacy, self‑evidently significant social values.

But the Act does not include any mechanisms by which a union’s constitutional right to freedom of expression may be balanced with the interests protected by the legislation. This Court has long recognized the fundamental importance of freedom of expression in the context of labour disputes. PIPA prohibits the collection, use, or disclosure of personal information for many legitimate, expressive purposes related to labour relations. Picketing represents a particularly crucial form of expression with strong historical roots. PIPA imposes restrictions on a union’s ability to communicate and persuade the public of its cause, impairing its ability to use one of its most effective bargaining strategies in the course of a lawful strike. This infringement of the right to freedom of expression is disproportionate to the government’s objective of providing individuals with control over the personal information that they expose by crossing a picket line. It is therefore not justified under s. 1 of the Charter.

Given the comprehensive and integrated structure of the statute, the Government of Alberta and the Information and Privacy Commissioner requested that the Court not select specific amendments, requesting instead that the entire statute be declared invalid so that the legislature can consider the Act as a whole. The declaration of invalidity is therefore granted but is suspended for a period of 12 months to give the legislature the opportunity to decide how best to make the legislation constitutionally compliant.

Google updates transparency report; US government requests for user information double over three years

Google has today updated its industry leading transparency report and is reporting that user data requests by the US government have doubled over the past three years. (For Canada, the numbers have roughly held steady.)

Richard Salgado, Google's Legal Director, Law Enforcement and Information Security, writes in the Google Public Policy Blog:

Google Public Policy Blog: Government requests for user information double over three years

In a year in which government surveillance has dominated the headlines, today we're updating our Transparency Report for the eighth time. Since we began sharing these figures with you in 2010, requests from governments for user information have increased by more than 100 percent. This comes as usage of our services continues to grow, but also as more governments have made requests than ever before. And these numbers only include the requests we're allowed to publish.

Over the past three years, we've continued to add more details to the report, and we're doing so again today. We're including additional information about legal process for U.S. criminal requests: breaking out emergency disclosures, wiretap orders, pen register orders and other court orders.

We want to go even further. We believe it's your right to know what kinds of requests and how many each government is making of us and other companies. However, the U.S. Department of Justice contends that U.S. law does not allow us to share information about some national security requests that we might receive. Specifically, the U.S. government argues that we cannot share information about the requests we receive (if any) under the Foreign Intelligence Surveillance Act. But you deserve to know.

Earlier this year, we brought a federal case to assert that we do indeed have the right to shine more light on the FISA process. In addition, we recently wrote a letter of support for two pieces of legislation currently proposed in the U.S. Congress. And we're asking governments around the world to uphold international legal agreements that respect the laws of different countries and guarantee standards for due process are met.

Our promise to you is to continue to make this report robust, to defend your information from overly broad government requests, and to push for greater transparency around the world.

We strongly believe that the Electronic Communications Privacy Act (ECPA) must be updated in this Congress, and we urge Congress to expeditiously enact a bright-line, warrant-for-content rule. Governmental entities should be required to obtain a warrant—issued based on a showing of probable cause—before requiring companies like Google to disclose the content of users' electronic communications.

Important decision on constitutionality of privacy legislation to be released by Supreme Court on Friday

Hot off the presses:

(For more background, check out posts tagged UFCW Case (Alberta).)

Supreme Court of Canada - Decisions

Supreme Court of Canada / Cour suprême du Canada

JUDGMENT TO BE RENDERED IN APPEAL

November 12, 2013
For immediate release

OTTAWA – The Supreme Court of Canada announced today that judgment in the following appeal will be delivered at 9:45 a.m. EST on Friday, November 15, 2013. This list is subject to change.

Information and Privacy Commissioner et al v. United Food and Commercial Workers, Local 401 (Alta.) (34890)

34890 Information and Privacy Commissioner v. United Food and Commercial Workers, Local 401 ‑ and between ‑ Attorney General of Alberta v. United Food and Commercial Workers, Local 401

Charter ‑ Freedom of expression ‑ Privacy law ‑ Labour relations ‑ Administrative law ‑ Privacy legislation prohibiting Respondent Union from collecting, using or disclosing images of individuals at or near a picket line during the course of a lawful strike ‑ Do the Personal Information Protection Act, S.A. 2003, c. P‑6.5 and the Personal Information Protection Act Regulation, Alta Reg. 366/2003 violate s. 2(b) of the Canadian Charter of Rights and Freedoms insofar as they restrict a union’s ability to collect, use or disclose personal information during the course of a lawful strike? ‑ If so, is the infringement a reasonable limit prescribed by law, which can be demonstrably justified in a free and democratic society under s. 1 of the Canadian Charter of Rights and Freedoms? ‑ What is the administrative tribunal’s role when its enabling legislation is the subject of a constitutional challenge and it does not have the power to decide the constitutional question?

The respondent union recorded video and took still photos of individuals located near and/or crossing a picket line during a lawful strike. Certain images collected by the union were subsequently placed on posters displayed at the picket‑line and appeared newsletters and leaflets available to union members and the public. Complaints were filed with the appellant Information and Privacy Commissioner of Alberta pursuant to the Personal Information Protection Act, S.A. 2003, c. P‑6.5 (“PIPA”). An adjudicator appointed by the Privacy Commissioner held that PIPA prohibited the Union from collecting, using and disclosing such photos and recordings without the consent of the individuals in question.

Origin of the case: Alberta

File No.: 34890

Judgment of the Court of Appeal: April 30, 2012

Counsel:

Roderick Wiltshire for the appellant Attorney General of Alberta

Glenn Solomon, Q.C. and Rob W. Armstrong for the appellant Information and Privacy Commissioner of Alberta

Gwen J. Gray, Q.C. for the respondent

Yes, you can photograph or video police in public in Canada

An interesting discussion on Reddit brought a new Ontario case to my attention that has a lot to say about the right of a member of the public to video or photograph police officers in a public place in Canada.

In R. v. Zarafonitis, 2013 ONCJ 570, the Court was considering the appropriate sentence for a police officer who pled guilty to using excessive force in arresting a photographer who was recording an altercation outside a crowded, noisy bar. The police arrested the individual with the camera for public intoxication, which was admitted to be justified, but used grossly disproportionate force when the photographer resisted and injured the man significantly. The man had been singled out and ordered by the officer to stop taking pictures:

While the noise investigation was ongoing in the restaurant, Mr. Farkas took pictures of Mr. Zarafonitis and another officer inside the restaurant. When Mr. Zarafonitis expelled a performer onto the street, Mr. Farkas followed them and tried to photograph the event. The scene outside the restaurant was noisy, with agitated restaurant patrons screaming and yelling at the officers; the crowd was drunk, aggressive and confrontational. Mr. Farkas stood on the sidewalk taking photographs and Mr. Zarafonitis told him to stop photographing and to leave the area. Mr. Farkas declined to leave, feeling he was entitled to continue taking photographs. Mr. Zarafonitis responded to the refusal by arresting Mr. Farkas for public intoxication under the Liquor Licence Act, an arrest that Mr. Zarafonitis believed to be valid.

The Court made some important observations about the right of the public to photograph police and the lack of justification for an officer to direct an individual to either move, leave the scene or stop photographing:

Police-citizen interaction typically involves a significant power imbalance. Just as judges should be hesitant to second-guess police decisions often made under stress without time for long reflection in back alleys late at night, we have to recognize that the citizen on the other side of that interaction, who may or may not have committed an offence and who is entitled to the protection of the rule of law, is also often alone in a back alley late at night. In the absence of an overarching and tangible safety concern, such as telling a photographer at a fire scene to back away if there is a danger that the building will collapse on him, telling people not to record these interactions, whether they be a bystander or the person the police are dealing with, is not a lawful exercise of police power. An officer who conducts himself reasonably has nothing to fear from an audio, video or photographic record of his interaction with the public. The public has a right to use means at their disposal to record their interactions with the police, something that many police services themselves do through in-car cameras and similar technology. The officer’s powers exist to allow him to protect the public and himself and to enforce the law; they do not extend to controlling the public record of what happened. The maintenance of that public record plays a significant role in the maintenance of the rule of law. The existence of this form of objective “oversight” has great potential to minimize abuses of authority and to maintain peaceable interaction between police and the citizenry, all of which is very much in the public interest. Interference by a police officer in the public’s exercise of that right is a significant abuse of authority.

Update: For further discussion on this topic, with lots of comments, check out: Canadian Privacy Law Blog: Photographing and filming police officers in Canada.

Computers should be treated as "separate places" for search warrant purposes, Supreme Court of Canada says

The Supreme Court of Canada just released its decision in R. v. Vu, 2013 SCC 60. The issue under appeal was whether police could search a computer that was seized pursuant to a warrant that did not specifically authorize the search of the computer.

I haven't had a chance to read the entire decision (the electrons are still warm), but the summary in the headnote is very interesting:

The traditional legal framework holds that once police obtain a warrant to search a place for certain things, they do not require specific, prior authorization to search in receptacles such as cupboards and filing cabinets. The question in this case is whether this framework is appropriate for computer searches. Computers differ in important ways from the receptacles governed by the traditional framework and computer searches give rise to particular privacy concerns that are not sufficiently addressed by that approach.

... The second issue is whether the warrant authorized the search of the computers and cellular phone. Section 8 of the Charter — which gives everyone the right to be free of unreasonable searches and seizures — seeks to strike an appropriate balance between the right to be free of state interference and the legitimate needs of law enforcement. This balance is generally achieved in two main ways. First, the police must obtain judicial authorization for a search before they conduct it, usually in the form of a search warrant. Second, an authorized search must be conducted in a reasonable manner, ensuring that the search is no more intrusive than is reasonably necessary to achieve its objectives. The privacy interests implicated by computer searches are markedly different from those at stake in searches of receptacles such as cupboards and filing cabinets. It is difficult to imagine a more intrusive invasion of privacy than the search of a personal or home computer. Computers potentially give police access to an almost unlimited universe of information that users cannot control, that they may not even be aware of, may have tried to erase and which may not be, in any meaningful sense, located in the place of search. The numerous and striking differences between computers and traditional receptacles call for distinctive treatment under s. 8 of the Charter. The animating assumption of the traditional rule — that if the search of a place is justified, so is the search of receptacles found within it — simply cannot apply with respect to computer searches.

In effect, the privacy interests at stake when computers are searched require that those devices be treated, to a certain extent, as a separate place. Prior authorization of searches is a cornerstone of our search and seizure law. The purpose of the prior authorization process is to balance the privacy interest of the individual against the interest of the state in investigating criminal activity before the state intrusion occurs. Only a specific, prior authorization to search a computer found in the place of search ensures that the authorizing justice has considered the full range of the distinctive privacy concerns raised by computer searches and, having done so, has decided that this threshold has been reached in the circumstances of a particular proposed search. This means that if police intend to search any computers found within a place they want to search, they must first satisfy the authorizing justice that they have reasonable grounds to believe that any computers they discover will contain the things they are looking for. If police come across a computer in the course of a search and their warrant does not provide specific authorization to search computers, they may seize the computer, and do what is necessary to ensure the integrity of the data. If they wish to search the data, however, they must obtain a separate warrant. In this case, the authorizing justice was not required to impose a search protocol in advance with conditions limiting the manner of the search. While such conditions may be appropriate in some cases, they are not, as a general rule, constitutionally required. [emphasis added]