Online Harms and Lawful Access: A Submission to the Government of Canada

Abstract

This submission responds to the Government of Canada’s invitation for feedback on its proposal for a new legislative and regulatory framework for addressing online harms. As Canadian academic researchers who specialize in either legal or technical aspects of privacy and security, we are concerned about the proposals to require the mandatory reporting of basic subscriber information (BSI) and transmission data without judicial authorization. We argue that the proposal for mandatory reporting of BSI and transmission data does not adequately protect Canadians’ privacy: - Both BSI and transmission data attract a reasonable expectation of privacy. - The mandatory reporting proposal would broaden who has the obligation, their role in determining whether a child pornography offence is evident, and would require much more information to be reported than is currently the case. - The proposal needs to provide clarification as to how service providers should determine when the reporting threshold has been met and provide additional safeguards against false positives and abuse of the system. - The purposes for requiring BSI are vague and the purposes proposed for requiring transmission data do not justify access to anything other than IP address. - The government should redesign, rather than jettison, independent oversight of police access to BSI and transmission data. - The current proposals for new regulatory bodies and current privacy legislation do not provide adequate independent oversight.