I was interviewed on CBC Radio's Maritime Noon about the effects of social media on the courts and the administration of justice. The audio is available below.
CBC.ca | Maritime Noon | Social Media and the Law, Plumbing Questions, Glass BanJuly 19, 2012 - A judge declares a mistrial after finding out about a juror post on Facebook. We discuss the implications with lawyer David Fraser.
The CBC has uncovered a briefing memo prepared on the day that Luka Magnotta was arrested in Europe designed to convince that the Magnotta investigation would have benefited from the police powers proposed in the government's lawful access internet surveillance bills.
Quite rightly, Michael Geist dismisses these assertions:
But Geist disputes the proposed internet surveillance legislation would have anything to do with a case like Magnotta's."By the time the evidence began to accumulate, he was already in Europe," Geist told CBC News. "The claim that C-30 would have made a difference is simply false — there is no evidence that law enforcement ran into problems tracking down his location to Europe and ultimately making the arrest."
Magnotta fled to Paris, then Berlin, after body parts were mailed to the Conservative and Liberal party offices in Ottawa. The torso, later confirmed to be the body of Jun Lin, was discovered earlier in a trash bin at a Montreal apartment building.
As for the specific four claims made in the documents, Geist says there is "far less than meets the eye." He notes:
- ISPs already disclose subscriber information 94 per cent of the time without a court order. For the remainder, there is no evidence that obtaining a warrant for this kind of case poses a problem.
- A preservation order still requires a warrant — it is not immediate as suggested in the Q&A documents.
- There is no evidence that there are delays in obtaining warrants
It really seems that those who wrote and promote the Bill don't understand it.
See: Magnotta case and online surveillance bill linked in memos - Politics - CBC News.
Luis Millan at Law In Quebec has a very interesting article on the Privacy Commissioner's recent calls for order making powers and the ability to levy fines.
In addition to my comments on how it may be problematic from a procedural fairness point of view, others have some very interesting comments.
The article refers to recent report that calls for increased powers to encourage compliance by small and medium sized businesses.
“The ombudsman model is based on finding solutions through consensus, and to fine a business that does not comply with the statute is contrary to the very foundation of the ombudsman model,” noted Houle, an administrative law scholar who, along with Sossin, is part of a team assisting the Privacy Commissioner with the review she is now conducting. “We believe that if Parliament agrees with the Commissioner that order-making power should be conferred to the OPC then the OPC should be transformed into another type of board like a regulatory board such as the Canadian Radio-television and Telecommunications Commission.”
Despite the report's findings, the Commissioner has mainly been talking about it to coerce very large, American internet companies that have very large compliance departments and expend significant resources on privacy.
Check it out: Canada’s privacy commissioner calls into question ombudsman model « Law in Quebec.
Once again, the Federal Court has shown that nominal or no damages will be paid for trivial breaches of PIPEDA. In Townsend v. Sun Life Financial, 2012 FC 550, the Applicant brought an application against Sun Life Financial for having misaddressed a piece of mail (which was returned unopened) and disclosing some medical information to the financial advisor involved in underwriting the policy.
The Applicant sought
(i) Payment of $352.56 for costs associated with the closing of the Investors Group retirement plans;
(ii) Declaration that the Respondent breached the PIPEDA and the fiduciary duties owed to the Applicant;
(iii) Declaration compelling the Respondent to publish notices of measures taken to avoid contravening the PIPEDA;
(iv) An award of $25,000.00 in damages;
(v) Costs before this Court; and
(vi) Any other relief this Court deems appropriate.
Though a (relatively trivial) breach was found, the application was dismissed.
The court noted, in its discussion of damages:
[34] In fact, contrary to the Applicant’s bald assertions, I do not accept that the Respondent has acted in an intentional, callous or egregious manner or in any other way that would indicate a complete disregard for the Applicant’s privacy interests. The fact that the Respondent has never denied having committed the errors is commendable. Plus, there is no evidence that the Respondent acted in bad faith or benefited commercially from the error, as acknowledged by the Applicant. It is also duly noted that the Respondent has apologized to the Applicant on numerous occasions (Respondent’s Record, Affidavit of Rosemary Knez, Exhibit “B”, p 8; Exhibit “D”, pp 11-12; Exhibit “F”, p 14) and even informed the Applicant of the measures implemented to avoid the re-occurrence of such errors (Ibid, Exhibit “D”, p 11). In my opinion, the Respondent promptly and effectively corrected its errors. It may be, as alleged by the Applicant, that the Respondent should have put these measures in place before the error occurred. Nobody should be held to a standard of perfection, and the Respondent already had a detailed protocol before the occurrence of what can only be considered as a human error.[35] Moreover, the amount of damages sought is greatly out of proportion to the jurisprudence of this Court. Even in cases where the Court has found evidence of bad faith on the part of a respondent, the quantum of damages has been lesser than the order sought by the applicant. ...
[38] Taking into consideration the facts of this case, I am of the view that the disclosure of personal information was minimal and the inaccuracy in the Applicant’s address caused no injury. I accept that medical information is of the utmost sensitivity and should receive the highest degree of protection. In the instant case, and without diminishing the Applicant’s grief, the extent of the disclosure was minimal and was only disclosed to Mr. Townsend’s Advisor, who appeared not to have noticed the personal information and then promptly destroyed the letter upon request. Moreover, the Respondent genuinely apologized for the breach and promptly took steps to correct its policies and procedures. For those reasons, I do not consider it necessary to order the Respondent to correct its practices or to publish a notice of any action taken or proposed to be taken to correct its practices, or to award damages to the Applicant.
[39] Moreover, the Applicant has not provided any arguments or evidence for disbursing $352.56 for costs, associated with the closing of the Investors Group retirement plans. In any event, I see no plain and obvious link between these costs and the Respondent’s conduct. Accordingly, the Court exercises its discretion not to award these costs.
[40] For all of the foregoing reasons, this application is dismissed and each party shall bear its own costs.
Kudos to Twitter for following Google's example and releasing its first "Transparency Report", which summarises the number of government requests for user data and government demands to take down user data. You can find it here and they've blogged about it here: Twitter Blog: Twitter Transparency Report.
For the first half of 2012, Twitter received 11 requests from Canada related to 11 user accounts and complied with 18% of them.
After a full week of speculation about the reported plan of the Canada Border Services Agency to intercept the private conversations of travelers in Canadian airports, the CBSA has finally come out with information about the scope of the project. And it's not as bad as the speculation. (Lesson here for the government: Be proactive about disclosing projects and policies that potentially infringe on the privacy rights of Canadians. If the media scoop you, quickly come clean and be truthful. Waiting a week is a VERY BAD idea.)
According to a policy manual obtained by the CBC under the Access to Information Act, the surveillance plan would not be intercepting private communications of travelers while they are waiting to see a CBSA officer on entry, but would be used to record the interviews and interactions between travelers and those CBSA Officers. (See: Border agency policy spells out surveillance rules - Politics - CBC News.)
If that's the full extent of it, it's simply not as bad as speculated. A conversation between a vacationing couple in the line-up is a private communication that can only be intercepted with a warrant signed by a judicial officer. But a conversation with a government official can't be said to be a private communication and just doesn't have the same expectation of privacy.
However, I don't think this is the last we're hearing on this. But at least it's not as bad as it first appeared.
I have seen a few reports this weekend saying that the Canada Border Services Agency has been installing audio recording equipment at Canadian airports to eavesdrop on travelers. (See: Listening equipment 'will record conversations' at Canadian airports: CBSA or Canadian airport to bug travelers' conversations.
While details are sketchy, I can't help but wonder whether or how this is lawful at all.
In Canada, it is unlawful to intercept any private communications without a warrant. The Criminal Code of Canada makes that pretty clear:
Interception184. (1) Every one who, by means of any electro-magnetic, acoustic, mechanical or other device, wilfully intercepts a private communication is guilty of an indictable offence and liable to imprisonment for a term not exceeding five years.
Saving provision
(2) Subsection (1) does not apply to
(a) a person who has the consent to intercept, express or implied, of the originator of the private communication or of the person intended by the originator thereof to receive it;Use or retention(b) a person who intercepts a private communication in accordance with an authorization or pursuant to section 184.4 or any person who in good faith aids in any way another person who the aiding person believes on reasonable grounds is acting with an authorization or pursuant to section 184.4;
(c) a person engaged in providing a telephone, telegraph or other communication service to the public who intercepts a private communication,
(i) if the interception is necessary for the purpose of providing the service,(d) an officer or servant of Her Majesty in right of Canada who engages in radio frequency spectrum management, in respect of a private communication intercepted by that officer or servant for the purpose of identifying, isolating or preventing an unauthorized or interfering use of a frequency or of a transmission; or(ii) in the course of service observing or random monitoring necessary for the purpose of mechanical or service quality control checks, or
(iii) if the interception is necessary to protect the person’s rights or property directly related to providing the service;
(e) a person, or any person acting on their behalf, in possession or control of a computer system, as defined in subsection 342.1(2), who intercepts a private communication originating from, directed to or transmitting through that computer system, if the interception is reasonably necessary for
(i) managing the quality of service of the computer system as it relates to performance factors such as the responsiveness and capacity of the system as well as the integrity and availability of the system and data, or(ii) protecting the computer system against any act that would be an offence under subsection 342.1(1) or 430(1.1).
(3) A private communication intercepted by a person referred to in paragraph (2)(e) can be used or retained only if
(a) it is essential to identify, isolate or prevent harm to the computer system; or(b) it is to be disclosed in circumstances referred to in subsection 193(2).
The Office of the Privacy Commissioner of Canada has said they've seen no mandatory privacy impact assessment about this initiative and the CBSA has essentially said nothing about this. Hopefully the Canadian media will pursue this and we'll get more details shortly.
I was interviewed yesterday by Sarah Schmidt of Postmedia News about why the Harper Government appears to be dragging their heels on implementing Bill C-12 or kicking off the next mandatory five year review of PIPEDA.
Her interview with the Commissioner, Jennifer Stoddart, and me also focused on the Commissioner's apparent abandonment of the ombudsman model in favour of the ability to issue orders and to levy fines.
Feds dragging their heels on fixing privacy law: StoddartOTTAWA — Canada's privacy watchdog says she's "very, very disappointed" by the federal government's failure to update a law meant to protect the personal information of consumers.
Jennifer Stoddart's annual report on the private-sector privacy law, tabled Tuesday in the House of Commons, highlights how evolving technologies are creating new privacy risks for youth.
The report also flags how Parliament is required, every five years, to review the Personal Information Protection and Electronic Documents Act (PIPEDA), but the latest review, which was scheduled for 2011, but has yet to be launched. Meanwhile, amendments to the law, tabled last fall, are outdated already, says the report calling for new powers for the Office of the Privacy Commissioner.
"I am very, very disappointed that we're not moving ahead with privacy reform issues. They're long overdue," Stoddart said in an interview after the tabling of the report.
Under the current law, Stoddart has no power to impose any fines and companies are not required to report breaches to her office.
The proposed amendments tabled last fall do not include powers to impose fines, but do include a provision for mandatory reporting to the privacy commissioner if a company experiences a material breach. The bill, known as C-12, has not moved beyond first reading, which took place on Sept. 29, 2011.
"What is put there, I think, was current about three years ago, but in the meantime the world has moved on. I really think, like in most jurisdictions now, we need some sanctions for egregious data breaches." said Stoddart.
"We have to have powers that will be respected by these huge multinational corporations that are doing business online and you need a strong voice to be heard by them."
Pointing to the fact that the government's anti-spam law is still not in effect, despite its passage last year, Stoddard added: "There's a slowness that is hard to understand in this digital age."
David Fraser, a Halifax-based lawyer specializing in privacy laws, said it's "puzzling" the recommendations arising from the 2006 PIPEDA review process have not been enacted.
"They really come up with something that by all measures is a bit of a no-brainer."
Fraser said the government's decision to not begin the second PIPEDA review in 2011 makes more sense if the Tories aren't interested in discussing Stoddart's push for more powers, given how "significant" the proposal is.
"During the last review, the privacy commissioner was fine with being an ombudsman, not have order-making powers and using persuasiveness and co-operation and collaboration to get companies to change their practices," said Fraser.
"More recently, and including in her annual report, she's making noises about looking for additional powers, particularly the ability to levy fines and perhaps issue orders. And that is a significant change — not only a significant change in the approach of her office, which has consistently advocated the ombudsman position for 15 years, but it would make a significant change in the legislation. It may not be a discussion the government wants to have right now," added Fraser, who leads McInnes Cooper's Privacy Practice Group.
Industry Minister Christian Paradis declined to answer questions put to him about why C-12 has stalled in Parliament, the delay in the 2011 PIPEDA review, and Stoddart's push for more powers.
In a statement, Paradis said the government is "building a modern legal framework that will enhance consumer confidence in the online marketplace and support the growth of Canada's digital economy. The Personal Information Protection and Electronic Documents Act underwent a review that led to the drafting of Bill C-12, which is currently before Parliament."
The Privacy Commissioner of Canada has just released her annual report to Parliament related to her duties under PIPEDA for 2011.
Here's the media release:
News Release: Evolving technologies creating new privacy risks for youth: annual report - June 5, 2012The Privacy Commissioner’s 2011 annual report on private-sector privacy issues, tabled in Parliament today, examines some of the concerns facing what some have called the “Internet generation.” At the same time, the Commissioner is launching a new graphic novel to help youth better understand and navigate the privacy risks of the online world.
OTTAWA, June 5, 2012 –Young Canadians are facing a host of privacy risks that previous generations never had to worry about – from “nanny cams” to cell phone monitoring to a permanent trail of their online communications, says the Privacy Commissioner of Canada.
Youth privacy issues have emerged as a significant concern and are highlighted in the Commissioner’s 2011 Annual Report to Parliament on the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law. The report was tabled in Parliament today.
“While the young show agility in using any new kind of digital communication, and recognize the importance of protecting their privacy, they are also often unsuspecting about the potential privacy intrusions that can accompany novel technologies,” says Commissioner Jennifer Stoddart.
“All of that online communication creates a permanent record – and that could carry risks to their privacy and to their reputations. Not just today, but perhaps even more in the future.”
The Office of the Privacy Commissioner of Canada (OPC) has made youth issues a major focus of its outreach and public education initiatives. The OPC has developed a number of education materials, including presentation packages for school and community use, a teen-oriented video and a tip sheet for parents.
Graphic Novel
Today, the Privacy Commissioner is also launching another important tool – a graphic novel called Social Smarts: Privacy, the Internet and You, which will help younger Canadians to understand and navigate privacy issues in the online world.
“This graphic novel – a first for our Office – was developed with feedback from youth. We hope it will help young people to understand the risks to privacy when it comes to social networking, gaming and texting,” says Commissioner Stoddart.
The new graphic novel can be downloaded from the OPC’s youth website.
Investigations
The annual report also describes an OPC investigation into a complaint about a daycare’s use of webcam monitoring. A parent objected to the fact that the webcam feed was being recorded and felt that appropriate privacy safeguards were not in place.
During the investigation, the daycare centre agreed to take steps to add privacy safeguards. The centre also deleted its saved video files and modified its systems to no longer record the video stream. It implemented a privacy policy requiring all parents to sign a form consenting to the webcam monitoring and required parents using the webcam service to sign a contract agreeing to not record the webcam feed and to keep confidential their password allowing access to the video. As such, the OPC concluded that the complaint was resolved.
The annual report also details findings related to investigations of three complaints against Facebook, as well as a wide-ranging complaint against a youth-oriented social networking site, Nexopia. The investigation results were announced earlier this year.
The OPC accepted 281 formal complaints under PIPEDA in 2011, a 35 percent increase from the previous year.
Moments before issuing her annual report to Parliament, the Office of the Privacy Commissioner of Canada has released a batch of new findings under PIPEDA. Findings are few and far between these days and you'll note that most of them are from last year.
