Proposed Privacy Law Would Allow Companies to Disclose User Information in Secret

A proposed law, currently making its way though the Senate, could strip Canadians of many online privacy protections, experts say, opening the door to so-called “copyright trolls.”

While the the Digital Privacy Act, also known as Bill S-4, would strengthen some elements of online privacy protection, requiring companies to tell customers and government privacy commissioners after a data breach where user information may have been stolen, other elements of the proposed law aren’t sitting well with privacy advocates.

The bill would allow companies to disclose user information to other companies and organizations without a court order or even having to tell users that their information has been shared as long as that information is “reasonable for the for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada or a province.” Michael Geist, a privacy advocate and Canada research chair in Internet and E-commerce Law wrote on his blog that this means “organizations will be permitted to disclose personal information without consent (and without a court order) to any organization that is investigating a contractual breach or possible violation of any law.”

Geist worries that because “the disclosure occurs in secret without the knowledge of the affected person,” those people who are affected won’t be able to “challenge the disclosure since they are not aware it is happening.”

According to him, that means that it would be a lot easier for rights holders that are trying to track down alleged copyright violators to get their hands on identifying information. He points to a recent case where a federal judge ordered independent ISP TekSavvy to release 2,000 customer names to filmmaker Voltage Pictures, who claims those customers may have illegally downloaded some of its films using BitTorrent.

While the judge did order TekSavvy to release the names, he set down a strict list of conditions in an effort to prevent what’s called “copyright trolling,” where a company sends letters to alleged copyright violators demanding payments, usually in the thousands of dollars, in an effort to trick the recipients into thinking they’re legally required to pay.

If the proposed law is passed, those sorts of protections won’t apply; “the court might never become involved in the case,” Geist writes. “Voltage could simply ask TekSavvy for the subscriber information, which could be legally disclosed (including details that go far beyond just name and address) without any court order and without informing their affected customer.”

Privacy advocates like Geist say they’re also worried about the combined impact of the bill and another proposed law, an “anti-cyberbullying” bill that would grant immunity from civil or criminal penalties to companies that disclose personal information about the customers to police without a warrant. It could be some time though before Bill S-4 becomes law. While the Senate usually looks at laws after they’ve been passed by the House of Commons, this bill originated in the upper house, meaning it still has to be approved by both chambers.

It’s unclear what the opposition’s stance is going to be on the law when it comes up for a vote. On April 9, the NDP’s digital issues critic Charmaine Borg praised the bill telling the CBC that “overall, these are good first steps.” Less than a week later she told the National Post that “once you connect the dots,” the two laws “could be quite worrisome.”