Privacy improvements in Bill C-59, but some concerns remain: experts

In their initial impressions of the government’s biggest attempt to reform national security legislation in decades, privacy experts said they have some worries about the new bill, including data sharing and the handling of publicly-available information. The legislation, Bill C-59, was unveiled Tuesday. It seeks to create a national security and intelligence review agency, establish an independent intelligence commissioner position, further empower the Communications Security Establishment (CSE) and facilitate the seamless sharing of information across agencies and organizations within the government. “I think it’s certainly better than what we have now, without a doubt,” Ann Cavoukian, executive director of the Privacy and Big Data Institute at Ryerson University, said in a phone interview, referring to the proposed oversight bodies. “I just want to make it clear to them that you don’t stop here—there are many unanswered questions which must be addressed.” Some of those questions include murkiness regarding how the government will handle data. For example, the bill stipulates that the CSE can acquire, analyze, retain or disclose publicly available information. “We haven’t had a proper conversation about social expectations around what exactly is public,” Brenda McPhail, director of privacy, technology and surveillance at the Canadian Civil Liberties Association (CCLA), said in a phone interview. “So some people may say, ‘if I put it on , it’s public.’ Other people will say, ‘no, if you put it on Facebook…you can limit it .” “It has really serious implications for privacy that could potentially open up great, vast swaths of personal information that we put online about ourselves” that the government can collect for national security, McPhail said. Cavoukian, for her part, said it’s hard to argue against the review of publicly available information. “I’m not suggesting that I agree with it, but I think it is defensible on their part to say it’s public,” adding she’s pleased that organizations like the CSE require a warrant for non-public information “because up until now, they’ve been going through collecting tons of data without a warrant.” McPhail added that while the new legislation adds more checks and balances to the vast information-sharing powers granted to government under current legislation, she hoped that the scope of sharing between departments would be narrowed and there be a “justification of necessity” requirement for sharing. “What we’re missing there is a rationale for the necessity of those powers,” she said. Before it was adopted, information-sharing powers included in Bill C-51 were criticized by the privacy commissioner and Internet advocates. University of Ottawa law professor Michael Geist noted in a blog post Wednesday that the fact the new legislation did not address the scale of information sharing is a “disappointment that leaves a major privacy concern largely intact.” Christopher Parsons, managing director at the Citizen Lab at the University of Toronto, said in a phone interview that while the new legislation is “putting on a clear legislative footing, practices and activities” that the government had already been engaging in, that doesn’t mean it’s great for privacy. He said one concern is how the various agencies will handle datasets that are predominantly non-Canadian, as the legislation stipulates activities will not be directed at Canadians. Previously, documents leaked by former Central Intelligence Agency employee Edward Snowden revealed the CSE used airport WiFi to track Canadian travellers, according to a 2014 CBC/Radio-Canada report. CBC also reported in 2015 that the CSE tracked millions of downloads daily to find extremist plots and suspects. Parsons wondered whether the government could effectively pay to gain total access to the Twitter Inc. datasets — which he said is considered public in the American, but not necessarily Canadian, sense — and whether because most Twitter users are not Canadian, it would meet the not-predominately Canadian test. “How exactly you can then collect data that you know, or strongly suspect a lot of Canadians’ data in it, and say that you’re not collecting Canadians’ data” will require some “creative thinking” of the Privacy Act of Canada, Parsons said. The legislation also provides the government with the ability to engage in “active” cyber activities against foreign states and individuals. Cavoukian also said she would have liked to see IMSI catchers, or Stingrays, addressed in the legislation. “I think it’s utterly outrageous that the RCMP would be allowed to employ Stingrays without a warrant and continue to use and then not delete the data relating to the law abiding citizens.” Public Safety Minister Ralph Goodale said during a technical briefing on Tuesday that he expects that kind of technology will be investigated by the review agencies included in Bill C-59, as well as the creation of a committee of parliamentarians that will act as an oversight committee for national security and intelligence. That committee was created by a separate bill, C-22, passed by the Senate this week. On Tuesday, Minister of Defence Harjit Sajjan said during a briefing with media that the CSE will be able to provide direct assistance to telecommunications companies to protect their networks. Likewise, Parsons said the Canadian telecoms could be enlisted to provide assistance for security. “That’s not inherently a bad thing, but there are some worries, because it means you are taking private infrastructure and you’re adding government analysis on top of it that will probably be very secretive,” he said. Parsons added it will be interesting to see whether the companies will reveal that they are engaged with the government for security purposes. Spokespeople for BCE Inc. and Rogers Communications Inc. declined comment, saying the companies are still reviewing the legislation. Despite concerns, Parsons said “there is some good stuff there,” pointing to how the legislation tries to be more transparent with the legality of the current practices of the government. “Legislative analysis, policy analysis can take place whereas in the past, it was sort of like shadow boxing with the government…because authorizing tools were kept secret.” That, as well as the national security review body and the formation of the intelligence commissioner are steps in the right direction, Parsons said. And while Cavoukian also said the new review bodies are a positive development, she said she hoped the intelligence commissioner would be given order-making power, rather than just the ability to approve or disapprove activities. She also said the intelligence commissioner, which the legislation says must be a retired judge, should have digital knowledge. “I think what we can say is, there are provisions here that have serious privacy implications and we need to do a deep dive and figure out just whether or not they are appropriately balanced and restricted and authorized,” McPhail said. “That’s what’s going to happen over the next weeks and months.” — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Privacy improvements in Bill C-59, but some concerns remain: experts

News | 06/22/2017 5:16 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Related Stories

Feds give $675k for UWaterloo cybersecurity project

Briefs | 08/16/2022 5:03 pm EDT

CSE discovers more than 2000 cyber security incidents last year

News | 06/29/2022 5:01 pm EDT

ISED contributes $80M to fund cyber security project

Briefs | 02/17/2022 5:16 pm EST

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us