Digital Privacy Act not so good for privacy, critics say

It's funny how laws proposed by Prime Minister Stephen Harper's Conservative government sometimes have titles that critics say mean the exact opposite of what they claim to do.

The Fair Elections Act is being slammed on all sides as being anything but fair, and now the, government's Digital Privacy Act is also being nominated for the doublespeak roll of honour.

Bill S-4 actually amends the Personal Information Protection and Electronic Documents Act, but Digital Privacy Act has a more consumer-friendly ring to it. It aims to crack down on identity theft by making it a criminal offence to traffic in someone's identity documents.

[ Related: Data privacy shapes up as a next-generation trade barrier ]

The law, which is receiving first reading in the Senate, requires businesses and other organizations to tell consumers when their personal information has been lost or stolen via hacking. Failure to do so can result in fines of up to $100,000 under the new legislation.

All that's good, but critics are attacking the bill as a threat to the very privacy rights it purports to protect, the Huffington Post reports. Provisions of the proposed law would allow organizations to share personal data with companies investigating alleged copyright infringement without first asking a court.

The current version of the law allows companies to share that data only with government and police as part of a criminal investigation, the National Post said.

Digital advocacy group OpenMedia said it opens the door for media companies to target someone who they suspect of illegally downloading content to get their personal information simply by asking the Internet service provider, the Post reported.

A post on Vice's Motherboard blog likened Bill S-4 to the U.S. Cyber Information Sharing and Protection Act "on steroids." That proposed law was quashed by the U.S. Senate.

Law professor Michael Geist, one of Canada's foremost authorities on Internet freedom, said the bill offers some teeth to allow organizations that breach personal privacy to be held to account.

But Geist writes on his blog that "the bill also includes a provision that could massively expand warrantless disclosure of personal information."

"The government is already working to expand warrantless disclosure of subscriber information to law enforcement with Bill C-13 [the 'cyber-bullying bill'] including an immunity provision from any criminal or civil liability (including class action lawsuits) for companies that preserve personal information or disclose it without a warrant," he wrote.

That's already a problem, given telecoms and Internet service providers now hand over subscriber information tens of thousands of times a year without a court order, Geist wrote.

"Yet it pales in comparison to the Digital Privacy Act, which would expand the possibility of warrantless disclosure to anyone, not just law enforcement," he said.

"Unpack the legalese and you find that organizations will be permitted to disclose personal information without consent [and without a court order] to any organization that is investigating a contractual breach or possible violation of any law.

"This applies both past breaches or violations as well as potential future violations. Moreover, the disclosure occurs in secret without the knowledge of the affected person [who therefore cannot challenge the disclosure since they are not aware it is happening]."

[ Related: TekSavvy ordered to release names of subscribers ]

Geist referred to the recent Federal Court copyright case involving ISP TekSavvy and Voltage Pictures, which wanted the names of thousands of subscribers it thought might be downloading movies illegally. It had been firing out so-called "demand letters" to people threatening them with legal action but offering to drop the case if they paid a penalty.

The February decision by the court ordered TekSavvy to hand over the names of some 2,000 subscribers, but under strict, court-supervised limits.

"If Bill S-4 were the law, the court might never become involved in the case," said Geist. "Instead, Voltage could simply ask TekSavvy for the subscriber information, which could be legally disclosed [including details that go far beyond just name and address] without any court order and without informing their affected customer."

OpenMedia communications manager David Christopher told the Post Bill S-4 would make it open season for so-called "copyright trolls."

“It also opens the door to telecom firms handing our private data to U.S.-style copyright trolls, without any court order or judicial oversight,” he said.

“Worst of all, we’d never know when we’d been a victim of these privacy breaches as the disclosures would be kept secret.”

Digital law expert David Fraser, a partner at McInnes Cooper, told the Post large media companies that operate cable, satellite or web content systems and also produce content likely would have few qualms about handing over such data.

“I would be worried in a scenario where one [Internet service provider] does it, then the [movie] studio says, 'well, Bell does it, so why don’t you?’”said Fraser.

No one is prepared to go to bat for chronic web pirates but NDP digital affairs critic Charmaine Borg said any legislation addressing copyright needs to strike a balance between protecting copyright and privacy.

“Any time we play with that balance, it’s important that we put our thinking caps on and think of the repercussions of this," she said.