In 2014 a new provision was added to the Criminal Code which permits organizations to voluntarily preserve data or to provide it to police so long as they are not
prohibited by law from doing so:
487.0195 (1) For greater certainty, no preservation demand, preservation order or production
order is necessary for a peace officer or public officer to ask a person to voluntarily preserve
data that the person is not prohibited by law from preserving or to voluntarily provide a
document to the officer that the person is not prohibited by law from disclosing.
(2) A person who preserves data or provides a document in those circumstances does not
incur any criminal or civil liability for doing so.
77 [Emphasis added]
As a result, organizations are immunized from civil suit for voluntary disclosures
of personal information to law enforcement officials so long as they are not
prohibited by law from making these disclosures.
PIPEDA’s paragraph 7(3)(c.1), which permits the disclosure of personal information without consent to law enforcement and national security authorities, has
been the subject of considerable debate and litigation. Any disclosure by an organization under s. 7(3)(c.1) is voluntary—the organization may decline to share the
information. In such a case, the agency seeking the information would have to obtain
a court order to compel its disclosure.
Reliance by police upon the permissive disclosure provisions of paragraph 7(3)
(c.1) created uncertainty about the constitutionality of such requests. In particular,
issues arose around police requests to telecommunications service providers to link
IP addresses with customer name and address information. In R. v. Spencer
78 the
unanimous Supreme Court of Canada ruled that police requests for such information
without a court order violated an accused’s constitutional right to be free from
unreasonable search and seizure.
The Court also held that the provisions of both PIPEDA and the Criminal Code
that permit companies to voluntarily disclose personal information to law enforcement officials at their request do not displace any reasonable expectation of privacy.
One of the requirements of paragraph 7(3)(c.1) of PIPEDA is that police have a
lawful authority to obtain the information sought. If the information sought is of a
kind that triggers a reasonable expectation of privacy, then a warrant is necessary in
order to lawfully obtain it. If the circumstances require a warrant, then a request
made without a warrant is without lawful authority.
Nevertheless, Spencer leaves a considerable grey area when it comes to the
voluntary disclosure of personal information by organizations. The Supreme Court
of Canada accepted that the reasonableness of a person’s expectation of privacy in
their ISP subscriber information may depend upon the wording of their ISP’s Terms
of Service and privacy policy. In other words, if the company’s privacy policy states
that the organization may hand over customer data to police upon request, the
reasonableness of a customer’s expectation of privacy in this information would
77 Protecting Canadians from Online Crime Act, S.C. 2014, c. 31.
78 R. v. Spencer, [2014] 2 SCR 212, 2014 SCC 43.
Data Protection and the Internet: Canada
67
prohibited by law from doing so:
487.0195 (1) For greater certainty, no preservation demand, preservation order or production
order is necessary for a peace officer or public officer to ask a person to voluntarily preserve
data that the person is not prohibited by law from preserving or to voluntarily provide a
document to the officer that the person is not prohibited by law from disclosing.
(2) A person who preserves data or provides a document in those circumstances does not
incur any criminal or civil liability for doing so.
77 [Emphasis added]
As a result, organizations are immunized from civil suit for voluntary disclosures
of personal information to law enforcement officials so long as they are not
prohibited by law from making these disclosures.
PIPEDA’s paragraph 7(3)(c.1), which permits the disclosure of personal information without consent to law enforcement and national security authorities, has
been the subject of considerable debate and litigation. Any disclosure by an organization under s. 7(3)(c.1) is voluntary—the organization may decline to share the
information. In such a case, the agency seeking the information would have to obtain
a court order to compel its disclosure.
Reliance by police upon the permissive disclosure provisions of paragraph 7(3)
(c.1) created uncertainty about the constitutionality of such requests. In particular,
issues arose around police requests to telecommunications service providers to link
IP addresses with customer name and address information. In R. v. Spencer
78 the
unanimous Supreme Court of Canada ruled that police requests for such information
without a court order violated an accused’s constitutional right to be free from
unreasonable search and seizure.
The Court also held that the provisions of both PIPEDA and the Criminal Code
that permit companies to voluntarily disclose personal information to law enforcement officials at their request do not displace any reasonable expectation of privacy.
One of the requirements of paragraph 7(3)(c.1) of PIPEDA is that police have a
lawful authority to obtain the information sought. If the information sought is of a
kind that triggers a reasonable expectation of privacy, then a warrant is necessary in
order to lawfully obtain it. If the circumstances require a warrant, then a request
made without a warrant is without lawful authority.
Nevertheless, Spencer leaves a considerable grey area when it comes to the
voluntary disclosure of personal information by organizations. The Supreme Court
of Canada accepted that the reasonableness of a person’s expectation of privacy in
their ISP subscriber information may depend upon the wording of their ISP’s Terms
of Service and privacy policy. In other words, if the company’s privacy policy states
that the organization may hand over customer data to police upon request, the
reasonableness of a customer’s expectation of privacy in this information would
77 Protecting Canadians from Online Crime Act, S.C. 2014, c. 31.
78 R. v. Spencer, [2014] 2 SCR 212, 2014 SCC 43.
Data Protection and the Internet: Canada
67