Bill C-13, the Protecting Canadians from Online Crime Act and Bill S-4, the Digital Privacy Act, although different in scope, both address privacy rights in the digital age and establish rules for the non-consensual disclosure and use of personal information.
Royal Assent of Bill C-13, Protecting Canadians from Online Crime Act1
Bill C-13, An Act to amend the Criminal Code, the Canada Evidence Act, the Competition Act and the Mutual Legal Assistance in Criminal Matters Act (short title: Protecting Canadians from Online Crime Act) was introduced in the House of Commons by the Minister of Justice, Peter MacKay, on Nov. 20, 2013. Bill C-13 received royal assent on Dec. 9, 2014 and will come into force on March 9, 2015. Bill C-13 deals with the offence of non-consensual distribution of intimate images; offences committed by means of telecommunication; and one aspect of the area of law generally referred to as "lawful access", an investigative technique used by law enforcement agencies and national security agencies that involves intercepting private communications and seizing information where authorized by law. This enactment amends the Criminal Code to provide, most notably, for:
(a) a new offence of non-consensual distribution of intimate images as well as complementary amendments to authorize the removal of such images from the Internet and the recovery of expenses incurred to obtain the removal of such images, the forfeiture of property used in the commission of the offence, a recognizance order to be issued to prevent the distribution of such images and the restriction of the use of a computer or the Internet by a convicted offender;
(b) the power to make preservation demands and orders to compel the preservation of electronic evidence;
(c) new production orders to compel the production of data relating to the transmission of communications and the location of transactions, individuals or things;
(d) a warrant that will extend the current investigative power for data associated with telephones to transmission data relating to all means of telecommunications;
(e) warrants that will enable the tracking of transactions, individuals and things and that are subject to legal thresholds appropriate to the interests at stake; and
(f) a streamlined process of obtaining warrants and orders related to an authorization to intercept private communications by ensuring that those warrants and orders can be issued by a judge who issues the authorization and by specifying that all documents relating to a request for a related warrant or order are automatically subject to the same rules respecting confidentiality as the request for authorization.
The enactment amends the Canada Evidence Act to ensure that the spouse is a competent and compellable witness for the prosecution with respect to the new offence of non-consensual distribution of intimate images. It also amends the Competition Act to make applicable, for the purpose of enforcing certain provisions of that Act, the new provisions being added to the Criminal Code respecting demands and orders for the preservation of computer data and orders for the production of documents relating to the transmission of communications or financial data. It also modernizes the provisions of the Act relating to electronic evidence and provides for more effective enforcement in a technologically advanced environment. Lastly, it amends the Mutual Legal Assistance in Criminal Matters Act to make some of the new investigative powers being added to the Criminal Code available to Canadian authorities executing incoming requests for assistance and to allow the Commissioner of Competition to execute search warrants under the Mutual Legal Assistance in Criminal Matters Act.
Bill S-4 – Proposed Amendments to PIPEDA2
Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act (short title: Digital Privacy Act) was introduced in the Senate and received first reading on April 8, 2014. Following second reading in the Senate, Bill S-4 was referred to the Senate Standing Committee on Transport and Communications on May 8, 2014. The committee presented its report, containing one amendment to the bill, to the Senate on June 10, 2014. Bill S-4 amends PIPEDA in several ways, including by:
- permitting the disclosure of an individual's personal information without their knowledge or consent in certain circumstances, including Clause 6(10) which allows disclosure without consent to another organization – for example, from one business to another - in order to investigate a breach of an agreement or a contravention (or anticipated contravention) of a federal or provincial law where it is reasonable to expect that obtaining the consent from the individual for the disclosure would compromise the investigation;
- requiring organizations to take various measures in cases of data security breaches: Clause 10 creates a new Division 1.1 of PIPEDA, addressing "breaches of security safeguards" and containing new sections 10.1 through 10.3 of the Act. The new section 10.1 incorporates a test for breach reporting which emulates that found in Alberta's Personal Information Protection Act, the only legislation in Canada currently containing breach notification provisions. An organization must report a breach to the Commissioner and notify individuals if it is "reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual." The definition of "significant harm" is an open-ended definition that includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.
- creating offences for failure to comply with obligations related to data security breaches; and enabling the Privacy Commissioner, in certain circumstances, to enter into compliance agreements with organizations.
Enhanced Penalty Provisions
Clause 24 of Bill S-4 also modifies section 28 of PIPEDA to provide that every organization that knowingly contravenes the new sections of PIPEDA requiring organizations to record and report breaches of security safeguards or obstructs the Commissioner in the investigation of a complaint or in conducting an audit will now be liable for fines of up to $100,000 for indictable offences, or for fines of up to $10,000 for offences punishable on summary conviction. This provision would bring PIPEDA closer in line with Canada's Anti-Spam Legislation (CASL), which provides for administrative monetary penalties for violations of the Act in amounts of up to $1,000,000 for individuals and $10,000,000 for other entities.
Reactions to Bill S-4
The Office of the Privacy Commissioner supported the bill in its June 4, 2014 Submission to the Senate Standing Committee on Transport and Communication, stating that on the whole, the proposed amendments will strengthen the privacy rights of Canadians with respect to their interactions with private sector companies, improve accountability and provide incentives for organizations to comply with the law. On the other hand, stakeholders and witnesses before the Senate Committee raised various concerns for the privacy of individuals. Michael Geist of the University of Ottawa commented that the bill would expand the possibility of warrantless disclosure to anyone, not just law enforcement.
Footnotes
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
