OpenMedia

Privacy Plan

Recommendation 1: Get a Warrant

RECOMMENDATION 1: GET A WARRANT

Canadians have a straightforward request for government agents seeking to obtain their personal information: get a warrant.

We presented participants with a range of options, asking in which circumstances government agencies should be able to access the sensitive, personal information of Canadians. The result was clear: Canadians overwhelmingly believe government agencies should require a search warrant based on evidence that a crime is soon to be, or has been, committed in order to access citizens’ personal information.

The traditional process of obtaining a warrant features a number of safeguards to protect the privacy of Canadians. Under the Charter, police must usually provide reasonable and probable grounds, established upon oath, to believe that an offence has been committed and that there is evidence to be found at the place of the search".90

The standard to obtain a warrant is therefore stronger than mere suspicion. The judge assessing the warrant application must be satisfied that evidence of an offence is reasonably likely to be found if a search is approved. This system ensures that Canadians are protected from law enforcement overreach, while also ensuring that law enforcement agencies can do their job.

93.8% of participants in our crowdsourcing said warrants should be necessary for police to conduct a search. Only 5.4% of respondents would allow police to conduct searches based merely on suspicion that an offence has been committed. Just 0.4% believed personal information should be generally available to government agents, and a further 0.4% said police should be allowed to access information based on broad demographic descriptions (e.g. “all middle-aged white females living in Hamilton”.)

When Canadians were asked to rank six key privacy priorities in order of preference, “require a warrant for government to spy on personal information” came top of the aggregate priority rankings. 22.7% of participants chose it as their top priority, and fully 68.9% chose it as one of their top three priorities, alongside “ending blanket surveillance of law-abiding people”, and “more transparency around govt collection of personal data.”

Internet Voice: “Follow democratic principles and protect Canadians from being watched without a warrant or justification.” - Soraya M.

Internet Voice: “Warrant, Warrant, WARRANT!” - Kay A.

These findings are broadly consistent with other studies. The federal Privacy Commissioner’s recent detailed survey of attitudes to privacy found that warrantless information requests topped the list of concerns.91 By a margin of 3.5:1 Canadians said they were “very uncomfortable” with the government requesting personal information from telecom companies without a warrant. A Forum Research poll found that 69% of Canadians disapprove of telecom companies handing over information to a public official without their knowledge or consent; only 18% of respondents approved.92

Internet Voice: “A judge must be consulted each and every time a government agency wants to invade the privacy of individuals, and the judge must be free from government influence or interference.” - David C.

Police require a search warrant to enter your home —but what about your digital home?

Based on these findings and the response to our crowdsourcing process, Canadians feel a strong attachment to the judicial safeguards inherent in a legal system that requires a warrant to search or obtain one’s personal information. This is unsurprising given the deep historical roots of this basic privacy protection in common law systems.

As far back as 1765, chief justice Lord Camden, presiding over the Court of Common Pleas in England, condemned the government’s use of an illegal warrant to “search, seize, and carry away” the papers of an allegedly seditious London writer named John Entick.93 Lord Camden’s ruling first established in common law the general principle that the state may not invade the privacy of a citizen unless expressly authorized by law.

The legal principle that “your home is your castle” goes back even further, to the days of Ancient Rome, and was first established as common law by Sir Edward Coke in 1628.

For a man's house is his castle, et domus sua cuique est tutissimum refugium [and each man's home is his safest refuge], for where shall a man be safe, if not in his house?”. - Sir Edward Coke, The Institutes of the Lawes of England (1628)

In Canada, government authorities have long been required in many circumstances to obtain a search warrant to access people’s personal information. In modern times, this requirement balances law enforcement’s needs with the privacy protections rooted in section 8 of the Charter:

Everyone has the right to be secure against unreasonable search or seizure.

  • Section 8. Charter of Rights and Freedoms

There are exceptions: for example, police can use diminished suspicion-based grounds to obtain information during the search of a motor vehicle. But when it comes to entering your home, the rules are clear. In all but a very limited number of cases, police require a search warrant to enter your bricks-and-mortar home.

However, when it comes to entering our digital homes, things are different. Although the Charter does establish safeguards on when the government can use electronic surveillance powers, the law has not kept pace with rapid technological advancements in recent years, especially when it comes to searching our personal electronic devices. For example, the Supreme Court recently ruled that police can, with some restrictions, search the smartphones of people they arrest.94

What is especially concerning is that our smartphones, laptops, and other digital devices store so much information on us, that searching them can, if anything, be even more revealing than a thorough search of one’s actual home. We also know from experts that our communications metadata can expose the most intimate details of our private lives - everything from our financial status, to medical conditions, political and religious beliefs, and even our sexual orientation.95

Internet Voice: “If I send a personal letter in the mail to someone I don't expect it to be opened and read by some government agent. The same privacy expectations should hold true for communication via the internet.” - James N.

Undermining trust in our digital security

 

A number of recent developments have made it far easier for government to obtain Canadians’ personal information either without a warrant or with a weak standard that is disproportionate and ignores the targeted approach adopted in traditional warrants. These developments have further undermined Canadians’ trust in the security of their digital homes:

Weak thresholds for obtaining a search warrant:

The government’s Bill C-13 received Royal Assent in December 2014 after over a year of fiercely contentious debate. As mentioned in our earlier case study, the new law makes it far easier for law enforcement agencies to obtain a transmission data warrant. Such a warrant allows police to obtain deeply revealing metadata about a surveillance target.96

Under Bill C-13, police now merely need to demonstrate a “reason to suspect” that a target is involved in criminal wrongdoing, rather than a “reason to believe”. This may not seem like much on the face of it - but legally, it means a great deal. This lower threshold makes it significantly easier for the government to sweep up many innocent people’s personal information, based merely on suspicion. As federal Privacy Commissioner Daniel Therrien points out:

The bulk of the new powers may be used where investigators have a mere suspicion of wrongdoing, as opposed to a higher threshold of reasonable belief that the search will provide evidence of a specific crime. The difference between these two thresholds represents a marked difference in privacy protection.97

Law professor and privacy expert Michael Geist underlined how revealing such transmission data can be. In testimony before the Senate’s Legal and Constitutional Affairs Committee, Professor Geist said:

There has been some confusion regarding how much metadata is included as ‘transmission data’. This is far more than who phoned who for how long. It includes highly sensitive information relating to computer-to-computer links. This form of metadata may not contain the content of the message, but its privacy import is very significant.98

The rapid pace of technological change over recent decades, in addition to the fact that Canadians increasingly store and transmit large quantities of sensitive information through their digital devices, means that there is now a very high level of privacy interest in this type of information.

These provisions of Bill C-13 show a worrying disregard for this privacy interest. The last thing Canadians want is even weaker safeguards protecting their metadata. Search warrant requirements should reflect the privacy significance of the information sought, and the new threshold set out in Bill C-13 wholly fails to do so.

Warrantless disclosure of personal information:

 

Bill C-13 granted full civil and criminal legal immunity for the voluntary disclosure by telecom companies of their customers’ personal information without a warrant . This provision has prompted a great deal of controversy, particularly given revelations from the Privacy Commissioner that Canadian telecom companies were asked to disclose personal information about their customers a remarkable 1,193,630 times, affecting 785,000 individual Canadians, in a single 12-month period.99

In fact, the Supreme Court of Canada definitively ruled in June 2014 that it is unconstitutional for law enforcement agencies to request subscriber information without a warrant, in R. v. Spencer.100 Despite this pronouncement by the highest court in the land, the government pressed ahead with the immunity provision in Bill C-13.

The ruling also showed that telecom providers have a duty of privacy toward their customers, meaning that it may even be illegal for them to voluntarily disclose such information without a request. Although some telecom companies have responded to this ruling by pledging to cease warrantless disclosure,101 others such as Bell have remained silent.102

This provision is a major concern, particularly given the often vast quantities of personal information held by telecom providers about their customers.103 Even handing over something as apparently innocuous as a name and address can be hugely revealing if also linked to an IP address - potentially exposing an individual’s entire digital trail.

Internet Voice: “If the privacy rights of law-abiding Canadians are compromised we will have broken with perhaps the best descriptors a country can proudly bear: Strong & Free. Government in Canada needs to implement measures that raise awareness around our privacy rights and freedoms.” - Rachel C.

 

Steps to Implementation:

 

This recent trend toward weaker privacy safeguards is not unstoppable. It’s clear that Canadians want to see this trend reversed: a Forum Research poll revealed that 79% expect their online personal information to remain “private and confidential”.

What steps need to be taken to restore Canadians’ trust in their system of warrant safeguards? What needs to be done to ensure that law enforcement practices are brought back into compliance with the letter and spirit of the Charter?

Based on research and consultations with Canadians and experts from across the country, Canada's privacy deficit should be addressed by implementing the following recommendations:

 

1. End legal immunity for ‘voluntary’ warrantless disclosure of personal information:

Bill C-13 granted telecom providers legal immunity for ‘voluntarily’ handing their customers’ private information to the government without a warrant. This clause (now section 487.0195 (1) and (2) of the Criminal Code) should be repealed.

Although R. v. Spencer prohibited law enforcement from requesting personal information without a warrant, ambiguities remain regarding its application to a number of voluntary information-sharing contexts. With major telecom conglomerates like Bell Canada refusing to confirm whether or not they have ceased the warrantless handover of information,105 Canadians have little cause for confidence that any remaining ambiguities will be resolved in favour of their privacy. Canadians should have the right to seek legal recourse if their telecom provider discloses their personal information without a warrant.

 

2. Strengthen transmission data warrant thresholds to “reasonable belief”:

In order to obtain the personal data of Canadians at home or overseas, police and other government agencies must be required to obtain a warrant. For reasons outlined above, the “reason to suspect” threshold enshrined in Bill C-13 is far too weak,  effectively allowing for these intrusive searches to be self-authorized by law enforcement.

Suspicion alone is not enough to place a Canadian’s private online life under a government microscope. There should be a meaningful threshold in order for the government to monitor any Canadian’s private online activity or obtain their personal information.106

As recommended by the federal Privacy Commissioner, police should need to meet the much stronger “reason to believe” threshold in order to obtain someone’s personal online information. A judge would then need to consider whether the proposed surveillance is necessary, legitimate, and proportionate. This common sense step would also be in line with the Supreme Court’s unanimous R. v. Spencer ruling and would significantly strengthen online and offline privacy protections for Canadians.

 

3. Mandatory reporting of subscriber data requests:

We’ve already seen that 1.2 million requests for private subscriber data were submitted to telecom companies within just 12 months. However, the federal Privacy Commissioner had to work hard to bring these alarming statistics into the public domain, battling against delaying tactics by the telecom firms.107

In early 2014, the NDP’s Digital Issues critic Charmaine Borg directed a number of questions to government agencies including the RCMP about these warrantless subscriber data requests. The RCMP’s response revealed108 that they failed to even keep records of how often they collected subscriber data without a warrant, a fact subsequently confirmed by the Privacy Commissioner.109

Clearly, both law enforcement agencies and telecommunications companies should be more attentive to and transparent about what they do with Canadians’ private data. Federal and provincial government agencies should have a statutory duty to report to the public on a regular basis as to the number of subscriber data requests they process. These reports should be made available online in an accessible format, and include not just overall numbers, but also data retention periods and relevant law enforcement agency guidelines. This is the only way for Canadians to gain a clear understanding of the scope of this issue.110

 

4. Require greater transparency from telecom companies:

Telecom providers have a crucial role to play in working for stronger data privacy protections for their customers. They should have a statutory duty to report to the public about the number of subscriber data requests they receive, the number of such requests they approve, and their reasons for doing so.

All telecom providers should also be required to implement the expert recommendations of Professor Andrew Clement and Dr Jonathan Obar’s recent Keeping Internet users in the know or in the dark? report, including publishing annual transparency reports in addition to detailed information on their websites about their data privacy and transparency practices.111 Legislators should update PIPEDA (Canada’s private sector privacy law) to include proactive transparency around privacy policies, and to require proactive notification of third party disclosure requests.

 

5. Bring Canada’s 35 year old Privacy Act into the digital age:

For some time, the Office of the Privacy Commissioner has pushed for reform of the federal Privacy Act, which sets out how federal government departments and agencies should safeguard the privacy of Canadians. Former Privacy Commissioner Jennifer Stoddart made the case for the “urgent need” for reform in a speech at the Library of Parliament in 2013.112 Her office has also published twelve ‘quick fix’ reform recommendations,113 which the government has to date ignored. These common sense recommendations deserve to be implemented as soon as possible.

The need for reform has grown all the more urgent given the sweeping expansion of information sharing proposed by Bill C-51. As we have seen, these provisions threaten to overturn the core principle of the Privacy Act - that government agencies should use personal information strictly for the purpose for which it is provided, and should not share that information with other agencies, except in tightly restricted circumstances. The government has failed to make the case for the necessity of these extreme new powers. These provisions in C-51 should be rejected by Parliament. If passed these provisions will certainly need to be repealed by a future Parliament.

 

6. Mandatory notification of surveillance targets:

Individuals subjected to surveillance should be notified after the fact, unless there is a risk that such notification would jeopardise the initial purpose of the surveillance. Where there is such a risk, notification should be delayed until that risk is lifted. This would afford surveillance targets the opportunity to take legal action and seek remedy for any illegal violation of their privacy. These measures should be in addition to the existing after-the-fact notification regime for warranted wiretaps.

 

7. Require a warrant to search cell phones and other digital devices:

The Supreme Court’s R. v. Fearon ruling significantly weakened Canadians’ digital privacy, by granting police the power to search cell phones without a warrant pursuant to arrest. The court ruled that such searches are supposed to be limited, but the ‘test’ they proposed opens up a great deal of legal uncertainty, not least for the police officers responsible for interpreting and applying the test.

Given the huge amount of deeply personal information many Canadians entrust to their digital devices, this is a worrying development. As the dissent written by Justice Karakatsanis points out: “The fact that a suspect may be carrying their house key at the time they are arrested does not justify the police using that key to enter the suspect’s home. In the same way, seizing the key to the user’s digital life should not justify a wholesale intrusion into that realm.”114

Professor Michael Geist concluded in response to the ruling: “In trying to establish the legality of some warrantless cellphone searches, [this decision] has replaced the important safeguard of a judicial authorization with conditions that do little to protect privacy while complicating the obligations of law enforcement.”115

Put plainly, being under arrest does not mean somebody is guilty of a crime. People under arrest should not have their privacy rights stripped away without judicial authorization or oversight. Also of concern is that the Canadian Border Services Agency routinely conduct warrantless searches of the cell phones of people entering Canada, including devices owned by Canadian citizens and permanent residents.116

Post-Fearon, it seems Canadians can no longer rely on the privacy protections afforded by Section 8 of the Charter to safeguard the security of their digital devices. For this reason, legislation is required to make clear that a warrant is necessary for police, or any other security or law enforcement agency, to search somebody’s digital device. This is the only way to ensure that the privacy safeguards around digital devices match Canadians’ inherent privacy interest in them.

 

8. Prohibit the ‘voluntary’ disclosure of personal information by organizations:

Canadians deserve legislative protections that prohibit organizations, such as telecommunications service providers, from disclosing Canadians’ personal information to authorities or private litigants without a court order or demonstrated case of exigent circumstances.

There should also be a comprehensive review and reform of any federal law or regulation that permits, encourages, enables, or requires warrantless voluntary disclosure of online activity to police, the Canadian Security Intelligence Service (CSIS), the Communications Security Establishment (CSE), or private litigants.

 

9. Safeguard privacy in emergency situations:

In 2013, during the Alberta floods, the RCMP seized over 600 legally-owned firearms from over 100 homes in the town of High River. The RCMP forcibly entered the homes, many of which has already been evacuated, and seized residents’ property without a warrant, including guns that had been properly secured and were not in plain view. The RCMP also failed to notify a judge about their actions, as the RCMP watchdog later found they were required to do by law. In an emergency situation, there needs to some reasonable leeway for police and first responders to, for example, enter someone’s home without a warrant for the purpose of searching for survivors. The recommendations of the RCMP watchdog for stronger guidelines, education of police officers, and better record keeping should be implemented to ensure that future emergencies do not grant police a blank cheque to search and seize private property.

 

10. End the use of drones to conduct warrantless surveillance:

A number of recent reports make clear that Canadian law enforcement agencies are now using drone technology to conduct surveillance. For example drones were deployed last year to monitor peaceful Mohawk protesters who were calling for an inquiry into missing and murdered indigenous women.118 A 2013 Queen’s University report119 revealed that the Ontario Provincial Police were operating at least four drones in Northern Ontario, and that drones were also in use by the RCMP.

Some police drone usage is perfectly sensible— for example when they are used to take aerial photos of traffic collisions to map out what happened. However, there is not adequate regulation of the continued expansive use of drones for surveillance and other purposes by law enforcement agencies. Nor is there sufficient knowledge of how long audio or written surveillance records are kept and used, or even knowledge of whether some drones could become weaponized. There is a need for a proper independent review of uses of unmanned aerial vehicles for surveillance purposes by law enforcement agencies or by private sector entities.

The Privacy Commissioner has pointed out that drones are “a powerful surveillance tool” capable of carrying advanced surveillance technologies. As with all surveillance activity, spying conducted by advanced technology should require a warrant. Such a warrant should only be granted in carefully circumscribed situations— for example if a judge is satisfied that its use is necessary, targeted at a specific individual, proportionate (the least intrusive way to obtain the information), and based on a reasonable belief that a crime is soon to be, or has been, committed.

In light of the rapid expansion and development of these kind of technologies, the Canadian government must adhere to lawful practices of surveillance by maintaining the necessity for a search warrant in order to exploit any current or future technology for surveillance purposes.

Footnotes: 

[90] Hunter v Southam Inc. Source: http://www.canlii.org/en/ca/scc/doc/1984/1984canlii33/1984canlii33.html

[91] Office of the Privacy Commissioner: 2014 Survey of Canadians on Privacy, Fig. 37. Source: https://www.priv.gc.ca/information/por-rop/2015/por_2014_12_e.asp#fig36

[92] Forum Research: Three-quarters disapprove of Bill C-13. Source: http://poll.forumresearch.com/post/68/three-quarters-disapprove-bill-c13/

[93] Entick v. Carrington (1765). Source: http://web2.uvcs.uvic.ca/courses/lawdemo/DOCS/ENTICARR.HTM

[94] Toronto Star: Supreme Court allows police to search cellphones without warrants. Source: http://www.thestar.com/news/canada/2014/12/11/supreme_court_allows_police_to_search_cellphones_upon_arrest.html#

[95] Office of the Ontario Privacy Commissioner: A Primer on Metadata - Separating Fact from Fiction. Source: https://www.privacybydesign.ca/content/uploads/2013/07/Metadata.pdf

[96] CBC News: Cyberbullying bill draws fire from diverse mix of critics. Source: http://www.cbc.ca/news/politics/cyberbullying-bill-draws-fire-from-diverse-mix-of-critics-1.2803637

[97] Office of the Privacy Commissioner of Canada: Bill C-13— Submission to the standing senate committee on legal and constitutional affairs. Source: https://www.priv.gc.ca/parl/2014/parl_sub_141119_e.asp

[98] Michael Geist: Choosing between privacy and cyberbullying. Source: http://www.michaelgeist.ca/2014/11/choosing-privacy-cyberbullying-appearance-bill-c-13-senate-legal-constitutional-affairs-committee/

[99] Full details of this are set out in the Canadian Wireless Telecommunications Association’s response to the federal Privacy Commissioner. Source: http://www.scribd.com/doc/221023222/Telecom-Disclosures

[100] Supreme Court of Canada: R. v. Spencer. Source: http://scc-csc.lexum.com/scc-csc/scc-csc/en/item/14233/index.do

[101] Toronto Star: Rogers, Telus won't give customer info to police without a warrant. Source: http://www.thestar.com/news/canada/2014/07/16/rogers_says_it_wont_hand_customer_info_to_police_without_a_warrant.html

[102] Michael Geist: Why has Bell remained silent on its subscriber information disclosure practices? Source: http://www.michaelgeist.ca/2014/07/bell-remained-silent-subscriber-information-disclosure-practices/

[103] Digital Stewardship Initiative: The importance of easily accessing your personal information. Source: https://digitalstewards.ca/tools/importance-easily-accessing-personal-information/

[104] Forum Research Poll: Three quarters disapprove of Bill C-13. Source: http://poll.forumresearch.com/post/68/three-quarters-disapprove-bill-c13/

[105] Toronto Star: Supreme Court ruling hasn’t stopped police from warrantless requests for data. Source: http://www.thestar.com/news/canada/2014/09/17/supreme_court_ruling_hasnt_stopped_police_from_warrantless_requests_for_data.html

[106] Office of the federal Privacy Commissioner: Submission to the Standing Senate Committee on Legal and Constitutional Affairs. Source: https://www.priv.gc.ca/parl/2014/parl_sub_141119_e.asp

[107] Michael Geist: Canadian Telcos asked to disclose subscriber data every 27 seconds. Source: http://www.michaelgeist.ca/2014/04/telco-disclosures/

[108] For a detailed overview, see Citizen Lab: Mapping the Canadian Government’s Telecommunications Surveillance. Source: https://citizenlab.org/2014/03/mapping-canadian-governments-telecommunications-surveillance/

[109] Toronto Star: RCMP failed to keep records on warrantless access, watchdog says. Source: http://www.thestar.com/news/canada/2014/10/30/rcmp_failed_to_keep_records_on_warrantless_access_watchdog_says.html

[110] Citizen Lab’s Dr. Christopher Parsons looks at this issue more closely in his report Telecommunications Transparency in Canada. Source: https://www.christopher-parsons.com/draft-do-transparency-reports-matter-for-public-policy/

[111] A full copy of this report can be downloaded from OpenMedia’s website at: https://openmedia.ca/intheknow

[112] Office of the Privacy Commissioner: The Necessary Rebirth of the Privacy Act, remarks by Commissioner Stoddart at the Library of Parliament, November 29, 2013. Source: https://www.priv.gc.ca/media/sp-d/2013/sp-d_20131129_02_e.asp

[113] Office of the Privacy Commissioner: Recommendations for Privacy Act reform. Source: https://www.priv.gc.ca/parl/2008/parl_080429_02_e.asp

[114] Supreme Court of Canada: R. v. Fearon, source: https://scc-csc.lexum.com/scc-csc/scc-csc/en/item/14502/index.do

[115] Michael Geist: Supreme Court’s Privacy Streak Comes To End: Split Court Affirms Legality of Warrantless Phone Searches Incident to Arrest. Source: http://www.michaelgeist.ca/2014/12/supreme-courts-privacy-streak-comes-end-split-court-affirms-legality-warrantless-phone-searches-incident-arrest/

[116] Toronto Sun: Cellphone search at border raises legal, civil liberties questions. Source: http://www.torontosun.com/2015/03/06/cellphone-search-at-border-raises-legal-civil-liberties-questions

[117] CBC News: RCMP watchdog raps Mounties over High River gun seizures during 2013 flood. Source: http://www.cbc.ca/news/politics/rcmp-watchdog-raps-mounties-over-high-river-gun-seizures-during-2013-flood-1.2954483

[118] Vice: The RCMP Is Spending Nearly $100 Million to Spy on the Mohawks’ Black Market Tobacco Trade. Source: http://www.vice.com/en_ca/read/the-rcmp-is-spending-nearly-100-million-to-spy-on-the-mohawks-black-market-tobacco-trade

[119] Queen’s University Surveillance Studies Centre: Surveillance Drones: Privacy implications of the spread of Unmanned Aerial Vehicles in Canada. Source: http://www.sscqueens.org/sites/default/files/Surveillance_Drones_Report.pdf