Lawful Access Consultation
Criminal Law Policy Section
5^th Floor, 284 Wellington Street
Ottawa, Ontario
K1A 0H8

Dear Minister:

RE: Lawful Access Consultation Paper

I am writing in response to the "Lawful Access" proposals that have been put forward by the Minister of Justice and Attorney General of Canada, the Solicitor General of Canada and the Minister of Industry.

I support the views of my federal colleague, Mr. George Radwanski, the Privacy Commissioner of Canada, who has prepared a lengthy and detailed response to the Lawful Access consultation paper. While I have a number of concerns with the proposals, I shall restrict my comments to a few key issues.

From the outset let me state that, absent both a clear demonstration of why these broad measures are necessary, together with a strong plan for oversight and protection of civil rights, I cannot and do not support the proposed legislative initiatives as currently described.

My concerns for the protection of privacy from unnecessary erosion extend beyond the "Lawful Access" proposals outlined in the consultation paper. In the past year, Canadians have been faced with an array of legislation that has been unprecedented in the scope and breadth of its capacity to diminish the privacy of individuals. The legislative juggernaut began with the omnibus Bill 36 that became the Anti-terrorism Act, followed by the equally vast omnibus Bill 42. Later, Bill 42 became Bills 44 and 55 (now C-17). Next came the privacy-invasive provisions of the Canada Customs and Revenue Agency's traveller-surveillance database. All of this legislation, together with ancillary regulations, has been introduced in pieces without a clearly articulated context and with very little discussion. The consultations, when provided, are narrowly defined and do not demonstrate a clear link between identified concerns and tailored solutions which can be supported and justified in a society such as ours.

Turning specifically to the Lawful Access Report (the “Report”), I am concerned that a number of provisions pose significant negative privacy implications.

Limited Oversight

The Report demands high levels of citizen trust towards the law enforcement and intelligence communities. It argues for the need to narrow individual citizen's boundaries for informational self-determination, suggesting this will increase collective public security. The request for trust comes without parallel evidence of the need for this kind of legal change. I suggest that broad judicial or other oversight mechanisms be built into the lawful access proposal to ensure public accountability, transparency and scrutiny. This oversight body should require routine reporting on measures undertaken in the name of law enforcement and an accounting of the efficacy of these measures. This reporting requirement should enhance public confidence.

Determination Test

Last year, I suggested an approach to achieving both privacy and security. I recommended that a determination must first be made as to whether new powers being introduced were actually necessary, or whether a full deployment of existing investigative tools, already available to law enforcement and intelligence agencies, would suffice. If extended powers are indeed believed to be necessary, then we must ensure that they are used and deployed in a manner consistent with specific law enforcement objectives. The power to deploy new methods of surveillance must only be used to meet legitimate law enforcement goals. The information collected through these powers must only be used for identified law enforcement purposes and not for other purposes unrelated to public safety. Further, there is also a responsibility on the part of law enforcement officials, as counter-intuitive as it may sound, to protect the confidentiality of that information, particularly if it proves to have no relevance to law enforcement.

My colleague, the Privacy Commissioner of Canada, also proposed an excellent analytical and determinative test. I believe that these tests are now relevant more than ever.

Old Standards Applied to New System

In viewing the impact and effect of new technologies, we cannot simply impose old standards of surveillance on new systems without recognizing that digital infrastructures complicate the application of dated analogue surveillance capabilities and legal rules. Wiretapping on an analogue telephone system is not comparable to the interception or monitoring of wireless communications or digital and Internet systems, which can provide more personal information and be more privacy invasive. We must re-think our approach rather than simply extending existing procedures to new technology.

There are also significant privacy and economic implications in developing the required surveillance infrastructure. While recognizing that interception capabilities are a necessary tool for law enforcement purposes, we would seek adequate safeguards to avoid any long-term data retention strategies and monitoring. If specific interception capabilities are mandated, there should also be parallel mandates regarding the access, use, disclosure, retention, security and disposal of data, together with effective oversight.

Mandating that Internet Service Providers (ISPs) track all online activities of their clients, so that this information could potentially be used for evidentiary purposes, would require a massive investment in storage capacity for all ISPs. Many of them would face significant business repercussions and/or cause them to raise fees substantially, impeding the penetration of online services in our society. This could well result in industry consolidation that would have negative implications for privacy and free speech as well as the overall growth and development of the Internet as a communications medium. Furthermore, this massive aggregation of data will be of little use to law enforcement agencies unless they have the adequate resources to review and analyze the vast amounts of data that would be generated daily.

I continue to have grave concerns about the resulting massive surveillance initiative that has the potential to significantly diminish the privacy of all Canadians. While certain privacy-invasive measures may be necessary for anti-terrorism purposes, it is unacceptable to use the guise of anti-terrorism to develop broad-based law enforcement powers that routinely diminish the rights and freedoms that Canadians hold dear.

I urge you to reconsider the scope and direction of the lawful access provisions and urge you to address the important concerns identified by the Privacy Commissioner of Canada. Thank you for your consideration.

Sincerely yours,

Ann Cavoukian, Ph.D.
Commissioner