The Conservative government's widely criticized online surveillance legislation may be on the back burner, but another bill that would expand police access to Internet users' data is about to resurface.
Bill C-12 would make it easier for Internet service providers, email hosts and social media sites to voluntarily share personal information about customers with authorities, possibly including private security firms. The legislation could also effectively impose a gag on the Internet companies, preventing them from telling customers their personal details have been shared.
"It broadens the conditions under which law enforcement can resort to this voluntary sharing regime," said Tamir Israel, staff lawyer at the University of Ottawa's Canadian Internet Policy and Public Interest Clinic. "It definitely reduces even further any accountability for it."
Government House leader Peter Van Loan recently signalled the little-noticed bill could come up for second-reading debate as early as today.
Currently, under the federal privacy law covering businesses, Internet providers may voluntarily hand over information about subscribers without consent to assist police or intelligence officers with the enforcement of Canadian laws, as well as matters of national security, defence or international affairs.
Bill C-12 would expand the list of conditions under which such voluntary sharing is allowed to include cases where personal information is requested to perform "policing services."
Israel said that could allow an Internet service provider to hand over personal information about its customers to a curious private security firm.
A legislative summary of the bill prepared by the Library of Parliament says it is unclear what the provision means.
"This new exception for policing services appears to add an open-ended and undefined circumstance related to law enforcement to this list," says the legislative summary.
The term "policing services" is not defined in either the bill or the federal privacy law, the summary adds.
Israel said Bill C-12 also waters down an existing element of the law that limits the release of personal information to police to occasions when they have demonstrated "lawful authority" to request it.
The current provision obligates service providers to assess police demands for customer data with a bit of skepticism, he said. It means a request for vast amounts of data - such as all of a person's emails - would likely be refused.
Bill C-12 appears to broaden the concept of "lawful authority" to the point where simply flashing a police badge might be enough to meet the demands of the law, Israel said.
