On June 3, the Canadian government tabled Bill C-2 in Parliament, called "An Act respecting certain measures relating to the security of the border between Canada and the United States and respecting other related security measures" but with a short title of "Strong Borders Act". As the name implies Bill C-2 is mostly about border measures, customs matters, fentanyl and immigration. But not completely. Included in the Bill are Part 14 and Part 15 – both of which should raise concerns for businesses that hold customer information.
Following in the footsteps of past governments, Part 14 of Bill C-2 contains a trojan horse that revives what has come to be known as "Lawful Access". The Bill contains a number of search, seizure and surveillance measures that have nothing to do with the border or fentanyl. In the past, governments have tried – unsuccessfully – to introduce similar measures under the guise of fighting terrorism, child abusers and cyberbullies. Part 14 of the Bill, creates new law enforcement authorities to get customer information, either without a warrant or court order, or with an order but based on a very low standard by amending the Criminal Code of Canada in five key ways:
New Information Demand. Part 14 creates a new police order or "information demand", without judicial oversight or control, to require service providers to hand over basic information about customers. It dramatically truncates the response time for production orders and gives service providers only five days to challenge a production order. It amends the law to clarify that police can just ask for information and service providers can just hand it over with impunity. It may also permit police to use illegally hacked and leaked data in their investigations.
New Production Order. Part 14 also creates a new production order for subscriber information that police can get with only "reasonable grounds to suspect" an offence has taken place. This is a lower threshold than the usual "usual grounds to believe" an offence has taken place. And it's broader than most general production orders for "basic subscriber information".
New Judicial Authorization For Requests of Transmission Data or Subscriber Information From a Foreign Entity. Part 14 also includes a judicial authorization to make a request for data from a foreign entity.
Exigent Circumstances. Clause 167 of Bill C-2 codifies the common law related to "exigent circumstances," addressing emergency circumstances where a police officer has insufficient time to obtain a production order. A peace officer or public officer can make a demand that has the force of law without a court order where "exigent circumstances" make seeking the order impracticable, as long as circumstances exist that would have authorized the issuance of a production order.
New Tracking Warrant. Part 14 creates a new tracking warrant.
Let's take a deeper dive into Part 14 and how these five key aspects will impact businesses holding customer information.
New Information Demand
Part 14 creates a new section 487.0121 of the Criminal Code authorizing a "peace officer or public officer", without judicial authorization, to make a demand of any person who "provides service to the public" requiring them to provide any of the following information in this list.
Information demand
487.0121 (1) A peace officer or public officer may make a demand in Form 5.0011 to a person who provides services to the public requiring the person to provide, in the form, manner and time specified in the demand, the following information:
(a) whether the person provides or has provided services to any subscriber or client, or to any account or identifier, specified in the form;
(b) if the person provides or has provided services to that subscriber, client, account or identifier,
(i) whether the person possesses or controls any information, including transmission data, in relation to that subscriber, client, account or identifier,
(ii) in the case of services provided in Canada, the province and municipality in which they are or were provided, and
(iii) in the case of services provided outside Canada, the country and municipality in which they are or were provided;
(c) if the person provides services to that subscriber, client, account or identifier, the date on which the person began providing the services;
(d) if the person provided services to that subscriber, client, account or identifier but no longer does so, the period during which the person provided the services;
(e) the name or identifier, if known, of any other person who provides services to the public and who provides or has provided services to that subscriber, client, account or identifier and any other information, if known, referred to in any of paragraphs (b) to (d) in relation to that other person and that subscriber, client, account or identifier; and
(f) if the person is unable to provide any information referred to in paragraphs (a) to (e), a statement to that effect.
Broad Reach. Paragraphs (a) and (b) are clearly intended to deal with the situation where the police have a phone number and want to go to a phone provider and ask "is this number serviced by you"? And if so, "where is the service provided" and "do you have customer records." That gives police enough information to refer the case to the local police where the customer is located. Regularly, RCMP in Ottawa receive information from a foreign police agency that's just associated with an IP address. They may know it's an "ABC Service Provider" IP address, but they don't know where the potential suspect is. Now ABC Service Provider will have to tell them, without a warrant or court order, "yes, that's our customer and they live in XYZ Town." No directly identifying information is supposed to be shared. While this is not particularly concerning, Paragraph (e), however, is:
(e) the name or identifier, if known, of any other person who provides services to the public and who provides or has provided services to that subscriber, client, account or identifier and any other information, if known, referred to in any of paragraphs (b) to (d) in relation to that other person and that subscriber, client, account or identifier;
So, if ABC Service Provider knows that the customer gets services from anyone else, it must also disclose that information. For example, if the ABC Service Provider customer has a Hotmail address on file, it appears ABC Service Provider must disclose that the person is also a Microsoft customer. What could be more problematic is if a company that supports OAuth logins (like using your Microsoft account to log into other services), this may require disclosing where those logins take place.
Low Threshold. Furthermore, the threshold for making such a demand is that the peace officer or public officer have "reasonable grounds to suspect" – a very low threshold – that (a) an offence has been or will be committed under any Act of Parliament and (b) the information demanded will assist with the investigation of the offence. It is not limited to seeking information to identify a particular suspect. The peace officer or public officer can impose a non-disclosure order.
Tight Timing. The person receiving the order has only five days to seek to have the demand varied or revoked and must give notice to the peace officer or public officer of its intent to have the demand varied or revoked. This is a very short window. The threshold for varying or revoking a demand is if "(a) it is unreasonable in the circumstances to require the applicant to provide the information; or (b) provision of the information would disclose information that is privileged or otherwise protected from disclosure by law." Given that these demands can be served on anyone who provides services to the public and not just telecommunications companies, there's a higher likelihood that the service provider does not have legal counsel on stand-by to assist with the demand.
New Production Order for "Subscriber Information"
The second significant aspect of Part 14 is a "production order for subscriber information". Unlike in previous "lawful access" attempts, this does require judicial authorization – the threshold is very, very low: it's just above the police having a "hunch".
Low Threshold. A new Criminal Code section 487.0142 creates a new production order for subscriber information with a very low threshold of simply "reasonable grounds to suspect" that (a) an offence has been or will be committed under the Criminal Code or any other Act of Parliament; and (b) the subscriber information is in the person's possession or control and will assist in the investigation of the offence.
487.0142 (1) On ex parte application made by a peace officer or public officer, a justice or judge may order a person who provides services to the public to prepare and produce a document containing all the subscriber information that relates to any information, including transmission data, that is specified in the order and that is in their possession or control when they receive the order.
"Reasonable grounds to suspect" is the lowest threshold in our legal system, since our system doesn't recognize "hunches" or "spidey senses". This is in direct response to the Supreme Court of Canada's 2014 decision in R. v. Spencer where the Court said the police can't just ask for subscriber information; it must be on the basis of exigent circumstances or in accord with a "reasonable law". The government clearly thinks Bill C-2 is a "reasonable law" that gets them there.
Broad Reach. Unlike a General Production Order, this order requires the production of "all the subscriber information" in the recipient's possession. Typically, General Production Orders name the specific data being sought that will advance the investigation; these orders are for "all subscriber information", which Bill C-2 broadly defines as:
subscriber information means, in relation to any client of a person who provides services to the public or any subscriber to the services of such a person,
(a) information that the subscriber or client provided to the person in order to receive the services, including their name, pseudonym, address, telephone number and email address;
(b) identifiers assigned to the subscriber or client by the person, including account numbers; and
(c) information relating to the services provided to the subscriber or client, including
(i) the types of services provided,
(ii) the period during which the services were provided, and
(iii) information that identifies the devices, equipment or things used by the subscriber or client in relation to the services.
Subsection (a), for example, likely also includes billing information. If it's a paid service, like a cell phone, bank account or credit card information would have been provided when the account was set up. This is not typical in current general production orders for subscriber information. Again, these can be presented to any person who provides services to the public, such as a bank, a medical clinic or a hotel. And it's also worth pointing out that these orders can be obtained to investigate any "offence" in any Act of Parliament. This isn't limited to the Criminal Code or the Controlled Drugs and Substances Act or the Customs Act. This includes, for example, the Canada National Parks Act.
New Judicial Authorization For Requests of Transmission Data or Subscriber Information From a Foreign Entity
The new Criminal Code section 487.0181 is a bit unusual because it creates a power to authorize a "request" (not an order) directed at a "foreign entity that provides telecommunications service to the public." The request is approved by a judge on an application by a peace officer or a public officer.
487.0181 (1) On ex parte application made by a peace officer or public officer, a justice or judge may authorize a peace officer or public officer to make a request to a foreign entity that provides telecommunications services to the public to prepare and produce a document containing transmission data or subscriber information that is in the foreign entity's possession or control when it receives the request.
Limited Scope. The request is limited to transmission data or subscriber information.
Low Threshold. The threshold for issuing such a request is again "reasonable grounds to suspect that (a) an offence has been or will be committed under this or any other Act of Parliament; and (b) the transmission data or the subscriber information is in the foreign entity's possession or control and will assist in the investigation of the offence." These are the same thresholds as for the new subscriber production order.
Potential for Confusion. This is completely unusual in that the police go to a judge to get an authorization to make a non-compulsory request to a foreign entity. This is likely in response to the controversy surrounding the B.C. Court of Appeal's 2018 decision in British Columbia (Attorney General) v. Brecknell that authorized a court to issue a production order against a foreign entity, which may be contrary to international law and offend comity. By making it non-compulsory, that issue is solved. By making it subject to approval by a Canadian judge, the question of admissibility in a Canadian court is also solved. While it's a clever solution to a real problem, this could cause a lot of confusion. A large number of non-Canadian service providers will respond to general production orders, particularly where the investigation relates to a person they identify as being in Canada. For some such entities, their privacy policies say they'll only disclose information where "required by law", and if they are following the the Personal Information Protection and Electronic Documents Act (PIPEDA) with respect to Canadian customer data – as they should – "required by law" is one of the exceptions that allows a disclosure to police. But these requests don't trigger the "required by law" exception in PIPEDA. Also, some U.S. service providers require that the thresholds largely align with the American "probable cause" standard; "reasonable grounds to suspect" doesn't meet that threshold.
Exigent Circumstances
Clause 167 of Bill C-2 codifies the common law related to "exigent circumstances." By way of background, "exigent circumstances" exist where (a) there is imminent threat to the public or public safety; or (b) a risk of loss or destruction of evidence." Section 487.11 of the Criminal Code has generally permitted peace officers to search and seize in "exigent circumstances" if the conditions for obtaining a warrant exist, but exigent circumstances mean it would be impracticable to obtain a warrant.
Expanded Scope. Section 487.11 is being replaced to scope in powers that are available under certain production orders. The underlined portions have been added to the existing section 487.11.
Exigent circumstances
487.11 A peace officer or public officer may, in the course of their duties,
(a) exercise any of the powers described in section 487, 492.1 or 492.2 without a warrant if the conditions for obtaining a warrant exist but by reason of exigent circumstances it would be impracticable to obtain a warrant; or
(b) seize any subscriber information that may be the subject of an order made under subsection 487.0142(1) or any data that may be the subject of an order made under subsection 487.016(1) or 487.017(1) if the conditions for obtaining an order exist but by reason of exigent circumstances it would be impracticable to obtain an order.
Essentially, this means a peace officer or public officer can make a demand that has the force of law without a court order where exigent circumstances make seeking the order impracticable. It's unclear whether a demand under (b) would have the same force and effect as a production order for the same data, and whether non-compliance could result in the same penalties.
Tight Timing. Bill C-2 amends Criminal Code section 487.0193 to dramatically and problematically truncate the window of time to commence a review to revoke or vary all production orders issued under Criminal Code. The new timeframe is five days after the date of the Order; previously, it was prior to the deadline referred to in the order, which is generally 30 days. This seems completely unworkable for most service providers. Production orders are frequently delivered to the service provider days after they were issued. Sometimes, police already have an order and want to know where to send it. This amendment means the clock is ticking very loudly. Not only can there be delays in delivery, but the decision to challenge a production order isn't usually made by the person in corporate security who first reviewed it. Such decisions are made up a chain of command and by the time a decision-maker gets their eyes on it, the window may have closed.
Immunity for Voluntary Disclosure. For some time, section 487.0195 of the Criminal Code has contained provisions saying a police officer can always ask for information that would otherwise be subject to a production order, and can obtain that information where the person is not prohibited by law from disclosing it. Clause 164 of Bill C-2 amends this section to add subsections that clarify that this includes data that could be the subject of an information demand under the new section 487.0121. The section appears intended to provide immunity to a service provider who voluntarily provides information that would otherwise be subject to a production order.
Public Information. The new section also says that police officers can always use information that is "available to the public." Some have raised concerns that this would include data that is publicly leaked via hacking or other nefarious means.
New Tracking Warrant
Part 14 creates a new warrant that allows a judge to authorize a peace officer or public officer to obtain tracking data or transmission data that relates to any thing that is similar to a thing in relation to which data is authorized to be obtained under the warrant and that is unknown at the time the warrant is issued. If police get a warrant to track a certain thing – such as a particular phone – and then discover it's related to another thing that can also track the person – such as an AirTag – data from the second thing can be collected under the authority of the original warrant.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
