Concerns are growing over how the Liberal government’s new border security bill could be the “biggest overreach” into Canadians’ privacy in years by making it easier for law enforcement to access people’s online subscriber or client data — some of it without a warrant.
The Strong Borders Act, or Bill C-2, would let police demand subscription information and transmission data from internet providers and other online companies under “reasonable” suspicion of a crime or for information that will assist in a criminal investigation.
While the government insists the information collected will not include what’s in those communications — which will still be subject to a judge’s sign-off — legal experts, civil rights advocates and Opposition Conservatives say the bill could still violate Charter rights.
“I think this represents perhaps one of the biggest overreaches we’ve seen from any government when it comes to Canadian privacy,” said Michael Geist, a professor and Canada Research Chair in internet and e-commerce law at the University of Ottawa.
Much of Bill C-2 focuses on proposed changes to border security, combating fentanyl trafficking and limiting asylum rules, but it also seeks to update the Criminal Code to give police “lawful access” to internet provider information.
The legislation would allow a law enforcement officer to demand specific client subscription information from “a person who provides services to the public,” and whether the provider “possesses or controls any information, including transmission data, in relation to that subscriber, client, account or identifier.”
“Transmission data” refers to metadata that broadly describes communications (such as dates and times messages were sent or received), but not the content of those messages.
The demand for information — including dates of services provided, and where it was provided either within or outside Canada — would not require a judge’s sign-off.
Furthermore, the only requirement for demanding information is if they have “reasonable grounds to suspect” that “an offence has been or will be committed” under any law, and “if the information that is demanded will assist in the investigation of the offence.”
The problem, critics say, is that the language in the legislation is so broad that it doesn’t just apply to large tech companies like Google or Meta, or internet providers like Rogers or Bell.
“This applies to any provider of a service in Canada,” Geist said. “That means hotels, car rental companies, your gardener — it doesn’t matter.”
Get daily National news
Get the day’s top news, political, economic, and current affairs headlines, delivered to your inbox once a day.
If information demands are applied to anyone, he added, it will reduce the transparency typically provided by large companies on how many requests they’re receiving from law enforcement.
While larger tech companies or service providers generally have processes to disclose the number of requests like that in reports for tracking, Geist warns that smaller companies won’t — and the public likely won’t get a clear sense of how often those requests get made.
“We simply won’t know just how this is being used, and how this is being misused,” he said.
Tamir Israel, director of privacy at the Canadian Civil Liberties Association, says privacy is still at risk even if the data being collected is limited to “basic information,” as the government describes it.
“One scenario is if you donated to a particular political party using their online platform, the party could be compelled to reveal that you are one of the people it provided a service to,” he said in an interview.
“There are a number of dating sites and mobile dating apps that are very sensitive. Just the fact that someone is a subscriber to these could be very revealing of a range of things. There are prayer apps that would reveal your religious preferences.”
The government has said the information collected would be used “primarily in obtaining further search warrants or production orders” that would still require court approval.
But legal experts say there should be just as much scrutiny on the gathering of that initial information, which could be used to infer potentially suspicious connections.
“Let’s say police go to a gambling website and ask, does this person with these co-ordinates have a membership, and was he online on these Saturday nights … in these places,” said Robert Diab, a law professor at Thompson Rivers University in Kamloops, B.C., who studies constitutional rights and technology.
“If (police) know there was a (mixed martial arts event they are investigating) on these Saturday nights over the course of the fall, they don’t have to ask if he was watching MMA or gambling or whatever. They can immediately piece that together. And that applies to a lot of other cases.”
Although the proposed legislation allows a provider to challenge a demand for information in court, it only gives them five days from the time of receiving the demand to do so.
Unless a judge then revokes or alters the demand, the bill includes financial penalties for providers that refuse to hand over the requested information within the time frame.
“Some of the large players may try to challenge it, but if you’re just an average service provider and law enforcement comes knocking, are you really going to challenge it?” Geist asked.
The Canadian Association of Chiefs of Police said in June that Canada’s powers for law enforcement are “significantly outdated” and are lagging behind both international allies and the modern technology used by criminals.
Governments have tried to give police more “lawful access” powers for decades, particularly to allow law enforcement to gather subscriber and IP address information to combat online child pornography.
A 2012 Conservative government bill that sought to address the issue died after then-public safety minister Vic Toews urged Liberal MP Francis Scarpeleggia — now the Speaker of the House of Commons and at the time, the Liberal public safety critic — to either “stand with us or stand with the child pornographers,” leading to widespread condemnation.
In 2014, the Supreme Court of Canada ruled in R v. Spencer that online subscription information was protected by Canadians’ reasonable expectation of privacy under the Charter, but did not propose a law that would properly address the issue.
Liberal MPs have said Bill C-2 attempts to address the “challenge” created by the Spencer ruling — which has been upheld as recently as last year — by giving law enforcement the new information demand tool.
Conservatives now say they won’t support the current bill unless the privacy concerns are addressed or removed, while Liberal MP Ruby Sahota, the secretary of state for combating crime, is urging opposition MPs to support it in order to give police tools “to catch these child predators who are roaming free in our country.”
Scarpeleggia, as the Speaker, does not vote on any matters before the House unless there is a tie.
Canada’s privacy commissioner, under questioning from Conservatives during a briefing at the House ethics committee Monday, said he has concerns about the threshold for requesting potentially sensitive information.
“Certainly … we would have preference in it being ‘reasonable belief’ as opposed to ‘reasonable suspicion’ in some of those aspects,” Philippe Dufresne said.
“So there are areas where the standard, in my view, should be higher…. There’s appropriate places for suspicion, but (a threshold of) reasonable belief when we are talking about sensitive information is critical.”
Israel, the CCLA’s privacy director, and legal experts say they want the information demand to face the same judicial scrutiny that’s applied to warrant requests.
At the very least, Geist said, the provision should not be included in a bill ostensibly focused on border security.
“The notion that you need to have the right to require information from my hairdresser … has nothing to do with the border,” he said.