This paper discusses the methods Canadian law enforcement and national security agencies may use to intercept communications traffic and request the identification of online users from Internet Service and Content Providers under the current Canadian data preservation orders at the federal and provincial level.
The safeguarding of online privacy against state intrusion has been of particular concern to the Canadian courts in determining the validity of surveillance measures, due to the inequality of power in the relationship between citizens and the state, and the resultant vulnerability of individuals to state abuses of power. The Canadian Supreme Court has specified three types of privacy: territorial, physical and informational. The Court accepted that the idea of online privacy derives from the presumption that all online data about a person is in a fundamental way, his own.
'privacy, including online privacy, is grounded in man's physical and moral autonomy and is essential for the well-being of the individual'.1
In Lawson Hunter et al. v. Southam Inc., 2 the Supreme Court declared that a major purpose of the constitutional protection against unreasonable search and seizure under section 8 of the Charter of Rights and Freedoms 3 was the protection of the privacy of the individual.
The case included a constitutional challenge to a search ordered under the Competition Act4. The Court concluded that to validate the constitutionality of a search, it must investigate the search's reasonableness or unreasonableness in terms of its impact on the individual and not simply on its rationality in furthering a valid government objective.[1]
Mr. Justice Dickson of the Supreme Court stated in this case for the first time the precept of reasonable expectation of privacy as a standard against which government action should be scrutinized. Government objectives, no matter how apparently urgent or pressing, cannot avoid the reasonableness inquiry demanded in s. 8: "assessment of the constitutionality of a search and seizur… must focus on its `reasonable' or `unreasonable' impact on the subject of the search or the seizure, and not simply on its rationality in furthering some valid government objective."
Legalities of intercepting electronic mail
The leading case on the legal status of e-mails is the Alberta Court of Appeal decision in R. v. Weir3, where the Court found that e-mails fell objectively within the definition of “private communication” in Part VI of the Criminal Code4, and that prior judicial authorization was required to capture e-mails. Any legislational attempts at defining the legal status of e-mail must provide to e-mail a level of protection at least equivalent to that granted by the courts.
However, “intercept” is defined in the Criminal Code as “listen to, record or acquire a communication or acquire the substance, meaning or purport thereof.” The capture of an e-mail falls within that definition because capturing an e-mail captures its contents, whether or not it is in transit. Moreover, because of the “store and forward” nature of e-mail and other Internet communications, any rule that distinguishes e-mail in transit from stored e-mail would fail to protect communications privacy because law enforcement need only wait until the e-mail transmission ends.
[2]
Data Retention and Internet Subscriber Data
Canada’s current data retention law is found in the Personal Information Protection and Electronic Documents Act (PIPEDA) 4. PIPEDA was massively influenced by the European Union Council Directive 95/46/EC5 5. Data retention under PIPEDA is closely allied with the data conservation principle under the Directive.
Principle 4.5 states that:
“Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes.”6
It is the last sentence of section 4.5 that sets out the Canadian data retention principle under PIPEDA. The fundamental principle follows the terms of the European data retention principle closely. In particular, the Canadian data retention principle (1) applies a test of necessity to that retention; (2) focuses on data retention, rather than usage; and (3) is connected to the purposes or fulfillment of the purposes for which the data were collected. From the evidence of the Canadian Privacy Commissioner’s findings under PIPEDA,7 the Privacy Commissioner declared a reasonably strong link between the ongoing retention of data and the purposes for which the data was collected.8 [3]
PIPEDA’s explicit advice in relation to data retention are important as an area in which the act has failed to provide adequate protection for individual rights to online privacy in the storage and processing of their personal data. Criticism of the Canadian data retention principle has also been based on its failure to specify “strict standards” on minimum and maximum retention periods.9 The criticism of specific retention period setting is well founded as discussed above.10
Section 4.5.3 states that:
Personal information that is no longer required to fulfill the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.
The introduction of “substantially similar” laws in the provinces of British Columbia, Alberta, and Quebec has led to a growing number of forms for the data retention principle, each of which will be examined in the next section.
Data Retention in Canada’s Provincial Legislation
With reference to the substantial similarity of extant provincial privacy legislation, it is notable that only three provincial legislatures have enacted laws in this area since PIPEDA was enacted. On September 1, 1994, Quebec introduced the Protection of Personal Information in the Private Sector Act, 9 which has been approved by the Canadian federal government as being “substantially similar” to PIPEDA. In 2003, British Columbia (Personal Information Protection Act 10 introduced on October 6, 2003) and Alberta (Personal Information Protection Act 11 introduced on December 4, 2003) introduced pieces of legislation that were finally approved by the federal government as being compatible with PIPEDA on October 12, 2004.
[4]
In relation to data retention, section 12 of the Quebec act states that “once the object of a file has been achieved, no information contained in it may be used otherwise than with the consent of the person concerned, subject to the time limit prescribed by law or by a retention schedule established by government.” 12
There is a clear parallel with the Quebec approach and the trend among European data retention laws to focus on restricting the ongoing use of information, rather than its storage or retention. In doing so, the Quebec legislation risks avoidance of the data retention principle by the passive use, storage or keeping of information unless a broad and potentially misleading interpretation of the term “use” is applied to the legislation. In British Columbia’s Personal Information Protection Act, section 35(2) states that:
An organization must destroy its documents containing personal information, or remove the means by which the personal information can be associated with particular individuals, as soon as it is reasonable to assume that: (a) the purpose for which that personal information was collected is no longer being served by retention of the personal information, and
(b) retention is no longer necessary for legal or business purposes. This broad retention principle is subject to section 35(1) which provides that “if an organization uses an individual’s personal information to make a decision that directly affects the individual, the organization must retain that information for at least one year after using it so that the individual has a reasonable opportunity to obtain access to it.”
The British Columbia approach to data retention clearly involves a narrow, document-specific approach. The reference to the destruction of documents is difficult to apply to electronic information, where concepts of erasure and deletion are by no means equivalent to destruction.
[5]
The legislation also revolves around concepts of reasonableness, which were at one time part of
European data retention thinking but which were omitted from the Directive, and of necessity for legal or business purposes. In relation to legal or business purposes, there would appear to be no need to link the purposes for which data retention is permitted with the purposes for which it was collected.
Section 35(1) develops the basic exception under section 4.5.2 of PIPEDA that, where personal information has been used to make a decision about an individual, it may be retained for a reasonable period of time.
Accordingly, the British Columbia legislature has designated a specific period of one year as a
retention period for such information. This undoubtedly provides more clarity than the PIPEDA equivalent. However, there is some doubt whether it will be appropriate in all circumstances, particularly where decisions have long-term implications or legal repercussions. In those circumstances, the retention period of one year will be vastly inadequate and potentially fatal to decision-making review and legal claims alike. In Alberta, the approach taken in the Personal Information Protection Act is contained in section 7(1), which provides that:
Except where this Act provides otherwise, an organization shall not, with respect to personal information about an individual, (a) collect that information unless the individual consents to the collection of that information…
…
(c) use that information unless the individual consents to the use of that information, or (d) disclose that information unless the individual consents to the disclosure of that information.
Given the approach to data retention under the British Columbia, Alberta, and Quebec legislation, which have been approved under PIPEDA, a failure to incorporate explicit data retention provisions may not be fatal to any provincial legislation. It is submitted that the Canadian government, in determining whether there is substantial similarity of provincial legislation with PIPEDA ought to consider data retention as one of the core principles that provincial legislation must include to protect fully the privacy of Canadian citizens and their personal information. A failure to do so will lead to the piecemeal introduction of inconsistent privacy legislation relative to the private sector across Canada. Such piecemeal inconsistencies among provincial legislation are likely to be significant in the context of any future European Commission review of the protection achieved under PIPEDA, particularly given the warning issued by the European Commission in relation to the process used to identify substantially similar legislation.
-----------------------
[1] La Forest J. wrote in R. v. Dyment , [1988] 2 S.C.R. 417, 426-427
2 Supreme Court of Canada Hunter et al. v. Southam Inc., [1984] 2 S.C.R. 145
3 Canadian Charter of Rights and Freedoms, PART I OF THE CONSTITUTION ACT, 1982
4 Competition Act (R.S.C., 1985, c. C-34)
3 [1998] A.J. No. 155, aff’d [2001] A.J. No. 869 (C.A.).
4 PART VI -- Sections 183-196 INVASION OF PRIVACY
4 S.C. 2000, c. 5 [PIPEDA], http://laws.justice.gc.ca/en/P-8.6/92607.html
5 EC, Council Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, [1995] O.J. L. 281/31, [the Directive]
6 Supra note 4, s. 4.5
7 The Privacy Commissioner’s findings under PIPEDA are available at http://www.privcom.gc.ca/cf-dc/2004/index2-4_e.asp
8 The Commissioner found that the information had not been collected for a proper purpose and therefore that the data had been retained for too long a period (see )
