[Editor's note: This is testimony given today (June 3) to the Parliamentary Standing Committee on Justice and Human Rights.]
Thank you for this opportunity to speak before the committee regarding Bill C-13. I am Steve Anderson, the executive director of OpenMedia.ca. OpenMedia.ca is a community-based organization working to safeguard the open Internet.
As you may know OpenMedia.ca worked with many other groups to lead the StopSpying.ca campaign which successfully convinced the government to shelve lawful access Bill C-30. Nearly 150,000 Canadians took part in the campaign.
Last year we started the Protect Our Privacy Coalition, which is the largest pro-privacy coalition in Canadian history with over 50 organizations from across the country and across the political spectrum.
You know you've hit on a common Canadian value when groups ranging from the Canadian Taxpayers Federation, to the Council of Canadians, to small businesses, to labour unions, join forces.
As it stands Canada has a privacy deficit, and I'm afraid Bill C-13 will only deepen that deficit. I believe that this privacy deficit is the result of a democratic deficit.
If the government, including members of this committee, were listening to the concerns of Canadians, there's no way you would be paving the way for a range of authorities to have increased warrantless access to our sensitive private information.
To help bring the concerns of Canadians to this committee, I've crowdsourced this presentation for you today. I asked Canadians online what they thought I should say today and I have done my best to incorporate their input into my presentation. I'll reference some of their input directly from time to time.
I'll confine my presentation to the lawful access portion of the bill as that is where Canadians have expressed the most concern.
The Canadians I heard from had three main concerns about Bill C-13:
1. Immunity for activities that victimize innocent Canadians 2. Accountability and oversight 3. Data security
1. Immunity for activities that victimize Canadians
Bill C-13 in its current form provides telecom companies who hand over sensitive private information about innocent Canadians with absolute immunity from criminal and civil liability.
Recent revelations show that government agencies made 1.2 million requests for customer data from telecom companies in just one year, and that the companies apparently voluntarily complied with these requests most of the time.
After learning of this, Canadians are increasingly calling for stronger safeguards against warrantless access to our private information, in contrast to the weakening of safeguards proposed in C-13.
At the moment, an unlimited swath of information can be accessed by a simple phone call to an Internet provider -- government agencies don't even need to provide a written request and we are told that some agencies even refuse to put their requests in writing to avoid leaving a paper trail.
This extrajudicial practice works because there is a loophole that allows authorities to obtain voluntary warrantless access to law-abiding citizens' sensitive information.
The disclosure immunity provided in C-13 will make this privacy loophole even bigger by removing one of the few incentives for telecom providers to safeguard our data from warrantless disclosures -- the obligation to act reasonably and in good faith.
Canadian citizen Gord Tomlin had this to say on the matter via Facebook, "If 'authorities' need information, they can get a warrant. It's not onerous, it's one of the checks and balances that are supposed to protect our system from abuse."
Danielle had this to say on our website,"If accessing an individual's private information is not arbitrary but is justifiable, then a warrant can be obtained. Otherwise, it is expected that the law [will] protect us from privacy violations [...]"
Louise had this to say, "Legislation that would grant legal immunity to telecom providers for handing over my private information to the government without a warrant […] assumes that we are all criminals and infringes on my rights to privacy[…]"
Providing telecom companies who engage in extrajudicial disclosure of Canadians' sensitive data is encouraging moral hazard -- it's encouraging reckless and irresponsible behaviour.
2. Accountability and oversight
Canadians find it troubling that Bill C-13 makes little effort to keep government agencies transparent and accountable. Most shockingly, there is no requirement that officials notify those innocent Canadians who have had their data stored in government databases.
The lack of knowledge and consent by those victimized through surveillance and warrantless disclosures is frustrating to many Canadians.
As one Canadian who wrote to me put it, "I would like to see a requirement that persons whose data has been accessed be informed of this fact, and that there be major penalty [...] if there is a failure to comply with this requirement."
The proposed lower "reason to suspect" threshold for transmission data warrants is of concern to many Canadians as well. We're talking about the collection of data that can reveal political and religious affiliations, medical conditions, what types of activities that we engage in both online and offline, who we socialize with -- it's incredibly invasive.
On the topic of accountability, several people also highlighted that there will be costs associated with these data transfers and some worried about the negative implications on small digital service providers and the erosion of trust in the digital economy in general.
On the matter of accountability, I think it's notable that none of the privacy commissioners were invited to recommend reforms. If the final bill is to have legitimacy, I think the government office holders that we pay to be experts on these matters should weigh in.
3. Data security concerns
Many Canadians are also concerned with how secure our data will be once authorities expand their collection through the measures in C-13.
Given recent breaches at federal offices (CRA and student loans, for example), many Canadians question if we can trust government authorities to properly protect our data once they've collected it, and worry that their data will fall into the hands of cybercriminals and identity thieves.
Eavanr put it well on reddit saying, "The federal government, and indeed the vague category of 'public officials,' has a poor track record of protecting private information already. It's common occurrence in the Canadian news environment to hear about some government agency or officials losing the confidential information of Canadians such as last March's revelation the government had lost the student loan information of nearly 600,000 Canadians. Broadening the powers of officials to access this information only increases the danger that confidential information will end up in the wrong hands."
C-13 also problematically expands the number of bureaucrats and agencies who can access our private information, including CSEC and CSIS, which are currently facing their own crisis of accountability given the recent Snowden leaks.
Bill C-13 does not in its current form provide effective measures to increase transparency, accountability or even reporting on warrantless access to our private data. Mandating subscriber notifications, record keeping of personal information requests, and the regular release of transparency reports by both government officials and telecom companies is a common sense reform to this bill that Canadians would broadly support.
In sum, I recommend that this committee remove the telecom immunity and weakened warrant standards provisions, while adding new reporting and accountability measures to this bill.
I also want to join the growing numbers calling for you to split this bill up so that we can move the cyberbullying portion forward and have a proper debate on lawful access legislation.
As one person on reddit put it: "Any expansion of government powers needs to be linked to a compelling societal need. This goes to the heart of the matter of linking cyber bullying to lawful access. You can have the provisions regarding cyber bullying without the sections covering lawful access."
I also think it's worth repeating what Carol Todd, the mother of cyberbullying victim Amanda Todd told this committee. She said, "I don't want to see our children victimized again by losing privacy rights. I am troubled by some of these provisions condoning the sharing of the private information of Canadians without proper legal process [...] A warrant should be required before any Canadians' personal information is turned over to anyone."
I think both those on the front lines of law enforcement and Canadians want authorities to have tools tailored to bringing a variety of criminals to justice. What this bill does at the moment is unnecessarily combine some of those tools with unpopular mechanisms that encourage mass disclosure of the sensitive information of innocent Canadians.
I implore the committee to consider that just one database -- the RCMP's Canadian Police Information Centre (CPIC) -- has sensitive data on over 420,000 people who have no criminal record of any kind. Many Canadians have their information stored in this database because they have simply suffered from mental health issues.
'Disbelief, shock and a lot of anger'
Also consider that a citizen named Diane is one of more than 200 Canadians who have come forward in recent weeks to say their personal or professional lives have been ruined, despite never having broken the law. Why? Because information about them has been wrongfully disclosed to third parties -- in Diane's case, to her employer.
Now consider the fact that in recent years federal government agencies alone have seen over 3,000 breaches of the highly sensitive private information of Canadians. Consider also that a low estimate puts the number of innocent Canadians affected by these data breaches at 750,000.
In Diane's case, she was the victim of a false accusation, which was withdrawn years ago. Diane's response after being victimized by this privacy intrusion and having her professional life unfairly curtailed was, unsurprisingly, "disbelief, shock and a lot of anger."
Now imagine that Diane was a family member or someone you know. You don't need to put them at risk like this -- you can choose to split up the bill and make the the necessary reforms.
Why should Canadian victims be re-victimized by violations of their privacy? Why should those with mental health issues need to live in fear?
The presumption of innocence represents a fundamental pillar of our legal system -- I'm sure you would all agree. Now we know that information is being collected on innocent Canadians without our consent or knowledge, and that in many cases there is a new presumption of guilt based on data alone. We also know that the presumption of guilt has real life implications as we've seen with Diane's story.
Canadians, including some of the government's biggest supporters, are wondering why this government is deepening our privacy deficit when other countries are beginning to rein in surveillance; they're wondering why you're mismanaging our data security.
As Jesse Klein wrote in the National Post last week, "when the Canadian public, parents of victims of cyberbullying, privacy commissioners and former cabinet ministers all voice serious concerns about a bill, it is a sure sign that something is wrong, and the government should listen."
Thank you. I welcome your questions.