OpenMedia

Privacy Plan

Introduction: Privacy Matters

INTRODUCTION: PRIVACY MATTERS

We wrote this report because privacy matters. With each new spying revelation, it has become clear that Canada faces an alarming privacy deficit, with dangerous and lasting consequences for the health of our democracy, for our liberty, and for our daily lives. Strong privacy rights need to be at the heart of any healthy democracy, because they are the foundation of many other democratic rights we hold dear.

Fears of government surveillance are already having a distressing impact on freedom of expression, for example, with PEN International reporting8 that 1 in 3 writers have either avoided speaking on a topic they feared would subject them to surveillance, or have seriously considered doing so. Experts estimate that over 700 million people have changed their online behaviour as a result of the NSA revelations.9 A Pew Research poll found that 30% of Americans have “taken steps to shield or hide their information from government digital dragnets” in the wake of the Snowden revelations.10

Privacy violations are also having more acute effects: in the last year over 200 Canadians have come forward to say their personal or professional lives have been ruined due to information disclosures, despite never having broken the law.11 Some have faced career limitations, while others have had to deal with travel restrictions. False charges that were subsequently dropped or dismissed, never resulting in criminal records, or even brief contact with the mental health system can create flags that send misleading and damaging messages to future employers on what should be private records.12

These stories in many cases point to the more banal threat regarding the government’s handling of our sensitive data; that without safeguards in place government bureaucrats will simply act recklessly and make life-impacting mistakes. In recent years federal government agencies have seen over 3,000 breaches of the highly sensitive private information of an estimated 725,000 innocent Canadians.13

These findings contradict the odd view that those who have nothing to hide have nothing to fear. We should all fear the chilling effect on free expression, lasting restrictions on our movement or career opportunities that could haunt any one of us, and the undermining of the human rights not just of Canadians, but of people all over the world.

Put simply, people who believe their words and activities are being monitored become less willing to speak out, to express views outside the mainstream, or to express dissent about government policy. Privacy violations lead to the hollowing out of our public space. It is precisely this type of free expression that democracies require to flourish, change, and adapt.

Privacy is about trust and security: ensuring people are free to be themselves, without fear that their every word and every move is being watched, logged, analyzed, and retained in secret databases for future use against them. This is all the more important given that lives have been ruined by data disclosures, as outlined in more detail below. Privacy is security in its most basic sense.

So there is little doubt that privacy matters. And there is little doubt that Canada is in the midst of an unprecedented privacy crisis. We’re at a tipping point where Canadians need to decide whether to continue to evolve into a mass surveillance society or take a stand and start reining in the government’s surveillance apparatus. A surveillance society is not inevitable,  and this report will outline a positive crowdsourced vision for how Canadians can take common sense steps to strengthen privacy safeguards.

 

A false choice

Canadians are clearly concerned. A detailed survey recently undertaken by the Privacy Commissioner found that 9 in 10 Canadians are worried about privacy, with 78% expressing concern about government surveillance, and a large majority opposed to warrantless searches.14

The same survey also revealed that Canadians feel a sense of powerlessness, with 73% of participants saying they believe they have less protection of their personal information than they had a decade ago. The government’s message to Canadians—that invasive mass surveillance and loss of privacy are somehow necessary in order to “keep us safe” — has deepened this sense of disempowerment.

This presents a false choice between privacy and security. In fact, experts have made clear that mass surveillance does nothing to make us safer. There is increasing evidence that it actually makes us less safe, by drowning our intelligence agencies in reams of useless data.15 In other words, when you collect the entire haystack, everything starts to look like a needle.

“We seek to overturn the view that in order to have security, we must effectively give up our right to privacy. Instead, we believe that what is needed are measures designed to provide for both security and privacy, in an accountable and transparent manner.” - former Ontario Privacy Commissioner Ann Cavoukian16 

Following a detailed study, the Council of Europe’s Legal Affairs Committee concluded that “mass surveillance is not even effective as a tool in the fight against terrorism and organised crime, in comparison with traditional targeted surveillance.”17 The same committee found that aspects of mass surveillance, such as deliberate weakening of encryption, “present a grave danger to national security.18

We do not dispute that targeted surveillance can be a necessary tool to tackle crime and protect national security. However, common sense safeguards are required to ensure that such surveillance is only conducted against specific targets in the event of a potential threat, and only in proportion to the risk. Such surveillance should be subject to judicial authorization, parliamentary oversight and due process,19 be consistent with the Charter of Rights and Freedoms,20 and be conducted in accordance with international principles of human rights.

This type of targeted, necessary, and proportionate surveillance is the opposite of the kind of mass, indiscriminate surveillance revealed by National Security Agency (NSA) whistleblower Edward Snowden. Blanket surveillance tactics invade our privacy, chill our freedom of expression, and undermine our most basic human and democratic rights.

 

Human consequences

We must not forget the grave practical dangers to individuals of overly weak privacy safeguards. Canadians’ lives are already being turned upside down by the government’s privacy deficit. Businesses have been ruined, familial connections broken, and people’s ability to travel undermined by the improper disclosure of Canadians’ personal information to foreign governments, for example.21

And that’s just scratching the surface: according to the federal Privacy Commissioner, in recent years there have been over 3,000 breaches of sensitive citizen data, affecting approximately 725,000 individuals.22 In just a single 12-month period, the personal information of over 780,000 Canadians was casually handed over to the government by telecom companies - without a warrant or due process.23

With numbers like this, people in every village, town, and city block in the country have been affected. Given the current government’s policy direction, this situation will continue to get worse unless Canadians come together to turn things around.

 

Let’s get started

The issue of privacy is a rich and nuanced topic, and not a week goes by without a significant new development. We’ve tried to keep things simple by dividing the core of this report into three key areas - first, setting out the problem; second, identifying solutions; and third, looking at the international context.

  • We’ll start by laying out some background, to outline precisely how our privacy deficit has widened alarmingly in recent years. Our case studies of recent proposed and passed legislation, and of the activities of the Communications Security Establishment (CSE), will make clear the extent of the privacy challenges this country faces.
  • We’ll then identify solutions: three key recommendations, shaped by crowdsourced input from Canadians, that aim to systematically address our privacy deficit. Taken together, these recommendations would put a stop to warrantless searches, end mass surveillance (including the bulk collection of metadata),24 and place government agencies responsible for surveillance under much stronger oversight.
  • Finally, we’ll look at the international context and at how Canada can play a leadership role on the world stage in tackling the global privacy crisis.

This report will focus primarily on the government’s handling of Canadians’ personal data. This is not a report about commercial privacy policies and the practices that govern private companies. Similarly, this report does not deal with technological workarounds to protect privacy, such as the use of encrypted services like Tor. While use of these tools can be an important way for people to speak out about government surveillance, nobody should be forced to resort to technical measures to safeguard their privacy from their own government.

These proposals are not intended to be a precise or detailed roadmap. In a report of this nature, we know it’s impossible to cover every angle and unwise to attempt to create model legislation. Our intention is to set out a high-level outline of what Canadians want to see done to address our privacy deficit. Our hope is that experts and decision-makers will use this to guide more detailed legislative work that’s clearly needed to translate these ideas into real change.

In that sense, this report and crowdsourced plan marks the end of one process, but the beginning of another. There is much work to be done if Canadians are to win back the strong privacy protections that older generations took for granted. This is a debate that will determine the shape of our democracy and impact our daily lives for decades to come.

Footnotes: 

[8] PEN International: Chilling effects: NSA surveillance drives writers to self-censor. Source: http://www.pen-international.org/read-pen-american-centres-report-chilling-effects-nsa-surveillance-drives-writers-to-self-censor/

[9] Bruce Schneier: Over 700 million people taking steps to avoid NSA surveillance. Source: https://www.schneier.com/blog/archives/2014/12/over_700_millio.html

[10] Pew Research Center: Americans’ privacy strategies post-Snowden. Source: http://www.pewinternet.org/2015/03/16/Americans-Privacy-Strategies-Post-Snowden/

[11] Toronto Star: 420,000 in police database never convicted (Analysis). Source: http://www.thestar.com/news/canada/2014/05/24/420000_in_police_database_never_convicted_analysis.html

[12] Ibid.

[13] CBC News: Data breach protocols deficient in 9 federal departments, watchdog finds. Source: http://www.cbc.ca/news/technology/data-breach-protocols-deficient-in-9-federal-departments-watchdog-finds-1.1341017

[14] Office of the Privacy Commissioner: 2014 Survey of Canadians on Privacy. Source: https://www.priv.gc.ca/information/por-rop/2015/por_2014_12_e.asp

[15] CBC News: CSE's Levitation project: Expert says spy agencies 'drowning in data' and unable to follow leads. Source: http://www.cbc.ca/news/canada/cse-s-levitation-project-expert-says-spy-agencies-drowning-in-data-and-unable-to-follow-leads-1.2934942

[16] Office of the Ontario Privacy Commissioner: A Primer on Metadata - Separating Fact from Fiction. Source: https://www.privacybydesign.ca/content/uploads/2013/07/Metadata.pdf

[17] Parliamentary Assembly of the Council of Europe: Committee on Legal Affairs and Human Rights Mass Surveillance Report, para. 126. Source: http://www.scribd.com/doc/253848295/Mass-Surveillance-Report

[18] Ibid.

[19] Specifically including a requirement to get a warrant. For more on this, see Recommendation 1 of this report.

[20] Henceforth referred to as the Charter.

[21] Huffington Post: Peter MacKay’s privacy deficit turned these lives upside down.  Source: http://www.huffingtonpost.ca/david-christopher-/mackay-privacy-deficit_b_5597417.html

[22] CBC News: Data breach protocols deficient in 9 federal departments, watchdog finds. Source: http://www.cbc.ca/news/technology/data-breach-protocols-deficient-in-9-federal-departments-watchdog-finds-1.1341017

[23] Michael Geist: Canadian Telcos asked to disclose subscriber data every 27 seconds. Source: http://www.michaelgeist.ca/2014/04/telco-disclosures/

[24] Metadata is data that describes other data. When collected in bulk, such as by the NSA and CSE, it can reveal a great deal of personal information about individuals.