Submission: Bill S-4

Bill S-4 would amend the Personal Information Protection and Electronic Documents Act (PIPEDA). FIPA calls for political parties to be covered by the law and makes other recommendations. Click here to download FIPA’s submission to the Committee on Industry, Science and Technology on Bill S-4, delivered in Ottawa on March 10, 2015.


Don’t Tackle Increasing Access to Information Complaints by Silencing the Watchdog

Originally posted in Huffington Post

Flags of Canada and Australia
Imagine shared under CC license by jasohill on Flickr

The federal Access to Information system has been in crisis for a number of years, and last week the crisis deepened.

Information Commissioner Suzanne Legault told the Commons Access to Information, Ethics and Privacy committee (ETHI) that the number of complaints her office receives from people being denied access to documents by the federal government has shot up 30 percent over the past year, and that her budget has been reduced by 11 percent over the past four years. Without more resources to deal with this surge in complaints, delays will inevitably result.

In fact, she stated that if she did not get additional funding, “Canadians’ quasi constitutional right of access will be increasingly denied.”

Any delay in the Commissioner’s office means information requesters will have to wait even longer to get their documents. It also means that if the government digs in its heels, requesters can’t even get their day in Federal Court until the Commissioner’s office finishes its review of the file.

Commissioner Legault says she has repeatedly requested additional funding from the government, with no results to date.

Interestingly, the Australian government (which enjoys very close relations with the Harper ™ Government) is setting a worrying precedent by going much further in undercutting their Information Commissioner. They are actually in the process of abolishing the office entirely.

The Abbott government claims axing the Commissioner will save AUS$10.2 million over four years. Part of this seems to be based on a predicted drop in the number of complaints.

When the Australian Commissioner’s office was created in 2010, the cost of a complaint dropped from AUS$816 to zero. With this financial barrier removed, the number of complaints subsequently rose from 110 to more than 500.

Unsurprisingly, with funding for the Commissioner’s office based on an anticipated 110 complaints, it couldn’t keep up with the increased volume of complaints, with delays being the result. The Abbott government was critical of these delays and, rather than increasing funding, used this as a justification for abolishing the office.

Presumably, their move to resume charging $800 plus to file a complaint should considerably reduce the number of complaints.

Funding has been cut, offices closed and staff laid off in anticipation of the law abolishing the Commissioner passing parliament. However, they have run into some roadblocks in running the Commissioner out of town; the government has declined to move the bill forward for debate and a vote, probably because the Australian Senate is not controlled by the government, and they know they would lose. The Senate has now finished its activities until the new year.

The very strange result is that the Australian Commissioner lives on, but has no budget or office. The Commissioner put a notice up on his website earlier this week saying they would continue in operations while “…liaising with the Australian Government about transition arrangements for freedom of information matters.”

Although the Harper Government is unlikely to axe the Information Commissioner in an election year, the Australian government does set a bad example, and our government could follow suit by using the increasing delays and frustration from years of underfunding the Commissioner’s office to argue for abolition in Omnibudget 2016 or 2017.

If they get re-elected…

Second online spying bill goes to committee

Image shared under CC license by Ministerio TIC Colombia

Our online privacy rights are coming under intense scrutiny this month, as two bills threaten to expand the ability of law enforcement agencies (and others!) to access our personal information without a warrant. The highly unpopular C-13 is currently making its way through the Senate, and facing fierce opposition. Meanwhile Bill S-4, the Digital Privacy Act which amends the federal private sector privacy law (PIPEDA), was referred to committee before its second reading, opening it to much more extensive amendments than is normally the case.

This is important because as it currently stands, there are some serious questions about the constitutionality of this bill. Its referral to the House of Commons Standing Committee on Industry, Science, and Technology provides a unique opportunity to fix these problems.

The question of whether S-4 is unconstitutional stems from a landmark Supreme Court of Canada ruling in R. v. Spencer in June of this year. Currently, section 7(3)(c.1)(ii) of PIPEDA allows Internet Service Providers to voluntarily disclose metadata to a government institution if it has “made the request for the purpose of law enforcement and has stated its “lawful authority” for the request.” So the question considered in the SCC case, and which makes S-4 of questionable constitutionality, is what constitutes “lawful authority” to obtain metadata?

The court ruled that, contrary to the statements by a number of government officials and lawyers, the collection of IP address information and other metadata does constitute a “search,” and a person does have a reasonable expectation of privacy online. This means that a “simple request” from law enforcement is not enough; a warrant is required in order to allow ISPs to give that information to the authorities.

And this is where Bill S-4 runs into trouble, because it includes a provision that “allows organizations to disclose personal information without consent (and without a court order) to any organization that is investigating a contractual breach or possible violation of any law” (emphasis added). This includes law enforcement and other state agencies, but it also allows non-government organizations (or even individuals) to take advantage of warrantless access. This flies in the face of the SCC ruling.

Professor Michael Geist has highlighted the huge range of uses this new exception might have; from copyright conflicts to defamation claims, commercial battles, and consumer disputes. Protections that have been developed by the courts to create oversight and approval procedures would be replaced by the provisions of S-4 , which give immunity to ISPs that hand over our personal information without being shown a warrant, and without us ever knowing what they did.

There are several good things about S-4 (particularly the breach notification requirements) but the expansion of private organizations’ ability to disclose our personal information is not one of them. We want to see the Committee take advantage of its expanded scope to amend the bill and make it into a real improvement to PIPEDA.