Canada’s Research Chair of Internet and e-commerce law is concerned that the newly introduced Digital Privacy Act could actually result in the personal information of more Canadians being given away without their consent or knowledge, he writes in a new blog post.
Michael Geist combed over the legislation tabled in the Senate earlier this week and discovered this nugget of legalese that expands warrantless disclosure:
“an organization may disclose personal information without the knowledge or consent of the individual… if the disclosure is made to another organization and is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada or a province that has been, is being or is about to be committed and it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the investigation;”
That means that companies, for example an Internet service provider (ISP), will hand over personal details about customers without need for consent from that customer or a court order being provided. Not only could legal authorities take advantage of this new power, but so could any other organization that’s doing its own investigation of a possible contract breach or legal violation.
Currently in Canada, companies have the right to either cooperate with authorities when they are asked to provide information related to an investigation, or demand a court order be issued. If the bill were to pass into law as written, companies like Voltage Pictures could compel ISP TekSavvy to hand over the names of its subscribers that allegedly downloaded copyrighted material from torrent sites. Voltage had to go through the courts to get conditional access to this list from TekSavvy, a process it started in 2012.
Industry Minister James Moore announced the Digital Privacy Act last week during an announcement about Canada’s long-awaited digital economy strategy in Waterloo, Ont. last week. The bill was tabled this week with government messaging focus on the new powers of the office of the Privacy Commissioner of Canada and a new requirement for companies to report data breaches.