One of the challenging aspects of PIPEDA in recent years has been the new section 7(3)(c.1)(ii), which permits organisations to disclosure personal information to a government institution that has requested the disclosure for the purpose of law enforcement and has stated its “lawful authority” for the request. Organizations faced with such a request almost always ask the same question: What constitutes “lawful authority”?
Background on Lawful Access
On April 5, 2017, Patricia Kosseim, Senior General Counsel and Director General, Legal Services, Policy, Research and Technology Analysis for the Office of the Privacy Commissioner of Canada (the “OPC”), gave testimony before the Quebec Commission of Inquiry on protection of confidential media sources. Premier Philippe Couillard had announced an inquiry would be held after Montreal and provincial police admitted they collected data from the cellphones of several journalists. The inquiry’s mandate includes identifying best practices to protect the confidentiality of journalistic sources and the commissioners must report back with recommendations by March 1, 2018.
Ms. Kosseim was asked, at the request of Commission’s counsel, to provide an overview of the legislation for protecting privacy in Canada and to answer questions about lawful access issues from a federal perspective. Ms. Kosseim took the opportunity to present a clear view of the OPC’s position on how lawful access, as articulated in section 7(3) of PIPEDA, should be addressed. Of particular interest is how this position differs from the position taken by the federal government in recent years.
Section 7(3)(c.1)(ii) permits disclosure of personal information to a government institution that has requested the disclosure for the purpose of law enforcement and has stated its “lawful authority” for the request. As was articulated by the Supreme Court of Canada in R v. Spencer, “[t]he reference to “lawful authority” in s. 7(3)(c.1)(ii) must mean something other than a “subpoena or search warrant.” The Court went to suggest that “[l]awful authority” may include several things. It may refer to the common law authority of the police to ask questions relating to matters that are not subject to a reasonable expectation of privacy. It may refer to the authority of police to conduct warrantless searches under exigent circumstances or where authorized by a reasonable law.”
While this decision did clarify that s. 7(3) ought not to be used to indiscriminately justify police search and seizure powers, it provided little by way of concrete examples of what the section does authorize.
Parliament’s passing of Bill C-13 further complicated the matter as it added new lawful access powers to transmission data to the Criminal Code.
In her remarks, Ms. Kosseim reiterated that in each of the OPC’s intervener submissions to the SCC in R v. Spencer, the OPC’s advice to Parliament on Bill C-13, and in other government consultations, the OPC has warned against lowering the thresholds for authorizing new investigative powers and noted the lack of accountability placed on the use of the powers and the absence of conditions specific to their use.
OPC Position on Lawful Access
Ms. Kosseim went on to reiterate the position that the Privacy Commissioner of Canada, Daniel Therrien, has taken on the subject. Commissioner Therrien has been vocal about the impact of these surveillance powers and has suggested that the following be done:
- lawful access powers should be limited, not extended – particularly in light of the privacy risks, which are much greater than the much-used innocuous analogy to telephone directories would lead people to believe;
- the crucial role of judges in the process of authorizing investigative powers should be maintained in order to ensure the necessary independence of police forces, which will better ensure the protection of people’s most basic rights; and
- Parliament should consider legislating more specifically on the prerequisites for lawful access, as well as grant judges the ability to attach conditions, such as: the protection of citizens who are not targeted (but still captured) by these measures; the period for which the information can be retained; and the intentional destruction of non-pertinent data.
It is clear that the OPC would like to see the lawful access rights of government institutions, including police, be limited, clearly articulated, and supervised by the judiciary. Canadians have the right to be secure against unreasonable search and seizure under the Charter and have the right to have their personal information protected under PIPEDA. These rights must be balanced with the reality that circumstances will arise when personal information will need to be disclosed for purposes such as public safety.
This would also provide clarity to businesses which, faced with a non-judicially-supervised PIPEDA “lawful authority” request for personal information, find themselves having to make their own determination as to whether the government agency requesting access has a sufficiently bona fide reasons for doing so. Business are, quite understandably, generally reluctant to be put in that position lest they later be the target of a privacy breach lawsuit or class action by the individual or individuals whose personal information they disclosed.
It will be interesting to see if the OPC, and other interested stakeholders, can motivate Parliament to re-evaluate and clarify the powers under section 7(3) or if Parliament will simply wait for a case to come forward that challenges the scope of what exactly lawful access is.