Telecom Trends

Mark,

Your contact's assertions in points #1-3 didn't really accord with my understanding, so I forwarded your post to a friend who is one of the country's top privacy lawyers. He expressed - um, surprise - at the assertion in points #1-3. Actually, he said flatly "Incorrect."

Perhaps David could provide you with the case cite in #1, the source of the obligation in #2 and the PIPEDA section in #3 to which he refers.
 

David responds to Rob's questions with:

#1: R. v. Plant, [1993] 3 SCR 281

#2: This engages the moral calculus of social, not legal obligation. Simply put, fighting child abuse is more important than "protecting" the confidentiality of basic subscriber information that is widely recognized as not engaging core privacy values. In other words, I [David] challenge any business to state publicly that they would rather hamper child abuse investigations than voluntarily surrender upon request non-intimate basic customer information for which a search warrant is not necessary.

#3: PIPEDA s.7(3)(c.1)(ii) Based on the comfort provided by this section, the letter of authority endorsed by CAIP is a commendable step taken by the industry to address internet based child abuse.

Readers should bear in mind that despite the comments by CAIP above, CAIP cannot agree to provide information without a search warrant, or otherwise in violation of privacy law, merely because obtaining a warrant is “impractical”. The release of information must also be lawful. The fact that CAIP has endorsed providing this limited information based only upon a "letter of authority", which is not a search warrant, demonstrates the widespread understanding and acceptance that a warrant is not needed and the release of such information is otherwise permitted by law.
 

Mark,

I'm hoping that you'll have another comment on this over the next few days from my contact. For now, I'll make the major points he passed on to me, and leave it to him to comment further if he wishes. Before I do I'll note that I hadn't originally appreciated that David's comments were really opinion about an unclear area in the law, suffused as they were with flat statements such as "clearly", "must", etc. But at heart this is about an issue that is still undecided by the Courts. To the specifics:

#1 - Plant is a pre-PIPEDA case. The law of the land is of course now different - privacy rights have been expressly established by Parliament. If one is covered by PIPEDA or other laws like it, protected information cannot now be disclosed without consent, a warrant or court order, or lawful authority or some other expressly listed grounds. Note also that in Plant the Chief Justice issued a strong dissent based on privacy. But it doesn't matter - Plant would be decided very differently now simply because there are now specific statutory protections in place for the information. And see below with respect to the issue of what the Courts have said about what legal authority is sufficient to require disclosure.

#2 - David's point is not a correct statement of the law. See above and see PIPEDA. David now says his point #2 was based on "moral calculus" and not legal obligation. His point was:

"Every other business in Canada must supply this kind of bare bones customer information to the police upon request. There is no principled reason why ISPs should be exempted from the rules that apply to every other business."

I see nothing in those words to discourage the reader from the conclusion that he was describing a legal obligation (indeed if anything it is clearly written to drive the reader to precisely that conclusion: "must", "the rules that apply"), and there is nothing there to suggest he was instead inviting the reader to take it as his opinion based on his own moral choices.

But as to that: David asks us to accept that since child sexual exploitation is an evil, personal information ought to be divulged when investigators ask. I suppose the moral calculus is that since the evil is *very evil*, the information ought to be disclosed. The second does not follow from the first, either legally or morally. If investigators can show cause, they can get a warrant and stop the evil. The issue concerns what should be shown before the information must be produced. This issue is not a debate over whether child sexual exploitation is evil. It's a debate over what authority the state ought to have to seize our personal information - for whatever reason.

On a separate point, David's challenge is, frankly, hyperbole. It's easy to challenge people to say they don't support child sexual exploitation investigations. That's theatre, not debate. The moral issue is of course easy to answer on easy cases (I challenge you to say publicly that if you knew someone was going to explode a nuclear device in a city, you would withhold basic subscriber information). But this is not a discussion about personal moral choices in morally unambiguous situations - or, if it is, it's not a discussion worth having. It's a discussion about whether David's assertions were correct.

#3 - "Lawful authority" in that PIPEDA section has no defined meaning. It's up to the courts to interpret it. A recent Ontario case makes it pretty clear that an ongoing criminal investigation is not, in and of itself, "lawful authority" for such a disclosure without consent or court order.

So -

#1 - "clearly said so". Not authority for the statement made. The law is now different.

#2 - "must supply". Incorrect - see PIPEDA.

#3 - "specific section in it whose purpose is to authorize the granting ...". Case law states the lawful authority must be more than an investigation. Precisely what more - probably unclear.

The other points David made are essentially assertions that requiring search warrants is excessively burdensome. That's a policy debate for others, not for me. But I will note that to the extent the issue is whether search warrants are burdensome, there is an "easy" answer - more resources for police. If as a society we believe that search warrants ought to be required and that this is an evil that justifies the allocation of resources, we can allocate them and satisfy both needs. Implicitly, therefore, the view or fact that search warrants are burdensome to get does not address the issue of whether we ought to require them before this information is disclosed. It only raises a further question - what is more important to us as a society - the resources that would be required to provide that level of protection or the privacy of the information?
 

Rob suggests that Plant would be decided differently now that PIPEDA has been passed. This is a mistake. Plant interpreted the Charter of Rights. The Charter is the supreme law of the land. Parliament cannot change it by the simple expedient of passing a statute. The Supreme Court has not overruled Plant. It remains good law.

Rob suggests that PIPEDA section 7(3)(c.1)(ii) has “no defined meaning” and that “it is up to the courts to interpret it”. A simple reading of s.7 makes the meaning very easy to discover. Section 7(3) authorizes disclosure of information in various defined circumstances. Section 7(3)(c) authorizes disclosure of information in compliance with a warrant. Section 7(3) (c.1)(ii) follows s.7(3). It authorizes disclosure to law enforcement investigators. Because it is a separate ground of disclosure, distinct from s.7(3)(c), the only logical interpretation of it is that it authorizes disclosure to law enforcement without a warrant. Otherwise the section serves no useful purpose at all. By suggesting there is no defined meaning to s.7(3)(c.1)(ii), Rob is ignoring the simple logic of statutory interpretation.

Every lawyer has a responsibility in rendering legal advice to give a statute a purposive interpretation that will best achieve the objectives of the statutory regime. Lawyers interpret and apply statutes in rendering advice every day of their working lives, whether courts have interpreted them or not. Clients depend on their lawyers to do just that. To suggest that a statute has “no defined meaning” until a court pronounces upon it, and then make no attempt to sensibly interpret it is, in the context of rendering advice, a dereliction of duty. It is of course very easy to say a statute has no defined meaning and then do nothing. But that course of action by a lawyer is intellectually indefensible.

It is noteworthy and commendable that all of the many lawyers who no doubt had their hand in preparing the letter of authority approved by CAIP, surely did not do nothing. It appears they took a close look at the Plant case and s.7 of PIPEDA, and decided it authorized the release of information without a warrant. Once again, I commend them for taking this legally principled and socially principled stand.

An important subtext in Rob’s latest response seems to be that we must focus fastidiously on legal correctness to the exclusion of the underlying moral and policy imperatives. He has dismissively rejected the child abuse dimension in this discussion by suggesting that it is nothing but a personal moral choice, a debate not worth having, “hyperbole”, and “theatre not debate”. I might respectfully ask how many cases dealing with the interplay between law enforcement powers and individual rights Mr. Hyndman has litigated before Canada’s highest courts. In the many dozens I have litigated before the Court of Appeal for Ontario and the Supreme Court of Canada, the moral dimensions of such activities as the fight against child abuse figure prominently in the analysis that seeks to achieve a workable balance. Were this debate to come before a court, far from ignoring internet child abuse, the court would draw on the long tradition of according the interests of children top priority. The court would look closely at the appalling extent to which child abuse infests the internet regardless of who is the ISP, and would look closely at the challenges law enforcement faces in addressing this huge tragedy. And of course the court would also look at the privacy dimension. Accordingly, Rob’s attempt to eradicate the reality of child abuse from this discussion misconceives the legal debate. And it is one sided because it eliminates the child abuse dimension but not the privacy dimension.

The law is all about achieving workable balances between competing objectives in real life scenarios, which it is impossible to do without understanding fully the competing practical objectives on both sides. PIPEDA s.7(3)(c.1)(ii) is itself all about achieving a workable balance. Whitewashing one side of the balance out of the picture completely with denigratory assertions not only disserves abuse victims. It is also flawed legal analysis.
 

Interesting debate ...

I've written some of my thoughts here: Canadian Privacy Law Blog: More on warrants for ISP records.

Of course the Charter has not changed and remains the supreme law of the land. But you will note that an important factor in the analysis made by both the majority and the minority of the Court in Plant is that the reasonable expectation of privacy is fundamental to the outcome. So while the Charter has not changed, the reasonable expectation of privacy has undergone a transformation since Plant was decided over ten years ago. Another factor was the seriousness of the offence under investigation, so it is possible that the Court today would find that to be an overriding factor in a child exploitation investigation.

But at least on Justice of the Peace would disagree with respect to 7(3)(c.1)(ii) in the only reported judicial interpretation of "lawful authority" (cited in my post above), who clearly decided that an ongoing criminal investigation into child exploitation investigation is not "lawful authority" to obtain subscriber info from an ISP.

Taken alltogether, I am not convinced that it would be lawful for an ISP to provide subscriber information in response to a "letter of authority".