Canada’s Privacy Commissioner’s Office Is Furious, and he’s Deleting…

Brenda McPhail
Director of Privacy, Technology & Surveillance Project
bmcphail@ccla.org

 

 

 

 

A blistering report issued by Canada’s and British Columbia’s Privacy Commissioners accuses Facebook of violating Canadian law following their joint investigation into the Cambridge Analytica scandal—and then refusing to comply with the Commissioner’s recommendations to make sure it doesn’t happen again.

Federal Privacy Commissioner Daniel Therrien states in a press release that Facebook’s “privacy framework was empty, and their vague terms were so elastic that they were not meaningful for privacy protection.”

The report finds that:

  • Facebook’s “superficial and ineffective safeguards and consent mechanisms” allowed third-party apps to inappropriately access information of millions of users;
  • There was a lack of meaningful consent collected from users of the app at the core of the Cambridge Analytica scandal, and from their friends whose information was shared as a result;
  • Facebook did not properly oversee the way apps on its platform complied with privacy requirements;
  • Facebook demonstrated an overall lack of responsibility for personal information under its control.

The Commissioners warn that “there is a high risk that the personal information of Canadians could be used in ways that they do not know or suspect, exposing them to potential harms.”

Both Commissioners are calling for legislative reform, including new powers of enforcement, in light of Facebook’s refusal to accept their findings or implement their recommendations.

It’s yet further evidence that privacy rights cannot be adequately protected through recommendations, voluntary compliance and organizational cooperation—as Facebook has just illustrated, that only works until they change their mind (because they’re not going to change their business model). It’s also worth noting that if Facebook had complied with earlier recommendations from the OPC in 2009, they might have avoided the Cambridge Analytica affair altogether—but they didn’t.

This report, and Facebook’s non-response, highlights the asymmetry of power between data goliaths, our Canadian privacy watchdog agencies, and us, the people of Canada. While Facebook’s CEO, Mark Zuckerberg, has been beating the privacy drum lately in an attempt to win back the trust of Facebook users, when faced with a series of concrete recommendations, Facebook has instead disputed the investigation’s findings and refused to comply. Granted, the recommendations, which included submitting to a voluntary audit of its privacy policies and practices over the next 5 years, were comprehensive and stringent, but surely compliance with privacy law should, in fact, be both of those things?

If governments were waiting for more evidence of the need to update Canada’s privacy laws to reflect the new value of data, the growing power of data collectors and aggregators, and the new risks—to individuals and groups—of ubiquitous, granular data collection, analysis and use, here it is. It’s time for our democratically elected officials to take the risks to their constituents seriously, starting by bringing political parties into a privacy law regime, and continuing with thorough reform of both our federal private and public sector privacy acts.

The next step for the federal Privacy Commissioner will be to take the matter to Federal Court. And for good measure, they’ve put their money where their mouth is in relation to their complaints and have taken down their Facebook page.

Read the full report

CCLA at the Supreme Court: Privacy Lost

Brenda McPhail
Director of Privacy, Technology & Surveillance Project
bmcphail@ccla.org

 

 

 

 

It’s a loss for privacy in a disappointing Supreme Court decision released April 18 in R v Mills. The Court issued four different reasons in this decision, a reflection of the complicated issues at stake in a case that combines a police sting operation, private messaging between an officer posing as a young girl and the accused over an online platform, and the use of screen capture technology to record ongoing electronic conversations, all without judicial warrant.

CCLA intervened in this case to argue that a zone of privacy for electronic conversations is essential in a free and democratic society. People in Canada should be able to conduct private one-on-one conversations, free of state interference. We also sought confirmation from the Court that the finding in R v Marakah that text messages may carry reasonable expectations of privacy also carries over to other forms of electronic conversations, such as the ubiquitous messenger applications that many of us use as an alternative to texting.

On that point, the Court agreed, with the plurality writing that the one-on-one electronic conversations in this case “have no legally significant distinction from text messages.” This confirmation of a technologically neutral approach, that focuses on the private nature of the conversations rather than the platform on which they occur, is a small battle won.

But Justices Abella, Gascon and Brown go on to conclude that the accused’s expectations of privacy in this case were not objectively reasonable, because “adults cannot reasonably expect privacy online with children they do not know.” While s. 8 Charter protection is generally content neutral, the fact that the relationship was engineered by police, and the socially abhorrent nature of child luring, weighed more heavily in the reasons written by Brown J.: “This appeal involves a particular set of circumstances, where the nature of the relationship and the nature of the investigative technique are decisive.”  

Justices Wagner and Karakatsanis presented different reasons for finding no s. 8 breach occurred. They found that when undercover officers are communicating in writing with individuals, there is no search or seizure because the officer is the intended recipient of the messages. Similarly, in written communication, they found that the screen capture of the message did not require judicial authorization because the sender, by engaging in written conversation, must have understood the recipient would have the ability to keep a copy of that conversation.

Only Justice Martin advanced the position that the state surveillance of the private conversation was, in fact, a search that violated s. 8, absent judicial authorization, and further, that the screen capture software did, in fact, constitute an interception within the meaning of the Criminal Code.

The ultimate effect this decision has on police sting operations will be something to watch—will it be applied only to investigations involving sexual predators and children, or will police read it as mitigating the need for judicial authorization more broadly in online sting operations? Will police attempt to extend the reasoning to apply to surveillance of other vulnerable populations, such as racialized persons or groups? The reasons of Wagner C.J. and Karakatsanis J. did speak to narrow that possibility, noting that just because they found s. 8 was not engaged in this case “does not mean that undercover online police operations will never intrude on a reasonable expectation of privacy.”

Section 8 Charter protections require a balance between the public’s interest in being left alone and the government’s interest in law enforcement. But that balancing should occur after, not within, the reasonable expectation of privacy analysis. Justice Martin’s reasons lead ultimately to the same decision as the rest of the bench, with a very different analysis. She states the question to be answered cannot focus solely on adults who communicate online with children for an evil purpose, but must recognize the broader implications (that CCLA similarly identified) that are core to the case, namely, do “members of society have a reasonable expectation that their private, electronic communications will not be acquired by the state at its sole discretion”?

CCLA will continue to advocate for the latter.

We are grateful to our pro bono counsel Frank Addario and James Foy of Addario Law Group LLP for their work on this case.

 

Read the Court’s decision here

Read CCLA’s factum here 

Letter to Prime Minister Regarding Refugee Measures in Budget…

Letter from Amnesty International Canada (English Branch), British Columbia Civil Liberties Association, Canadian Association of Refugee Lawyers, Canadian Civil Liberties Association and Canadian Council for Refugees

11 April 2019

The Right Honourable Prime Minister Justin Trudeau, P.C., M.P.
Prime Minister of Canada
80 Wellington Street
Ottawa, Ontario
K1A 0A2

Dear Prime Minister Trudeau,

We are human rights and refugee-serving organizations and we strongly object to the inclusion of an unexpected, substantial and deeply troubling reform affecting the human rights of refugees in the omnibus Budget Implementation Act, Bill C-97.

The measure itself – depriving certain refugee claimants of access to full and independent refugee hearings – is harsh and unnecessary. Furthermore, stripping crucial and hard-won human rights protections from people in a budget bill is undemocratic and means that Parliamentarians will be deprived of the ability to properly consider the effects of the change on vulnerable people, and its unforeseen consequences on the refugee determination system.

We consider that removing the protections of an independent refugee determination hearing from refugee claimants as proposed in the Budget Implementation Act is likely to result in legal challenges, and will create further inefficiencies, delay and confusion in the system. These cases involve incredibly high stakes for the claimants, including questions of persecution and torture, of being able to live life freely in accordance with one’s identity and culture with protection for fundamental human rights, and even of questions of life and death. That is why Canada has long ensured that refugee claims are determined in a fair hearing before an independent tribunal. It is unacceptable to consider removing this protection in a budget process, in which it is impossible to give the proposed change its due consideration, whether or not this particular measure is considered separately in committee or in tandem with the rest of the budget.

The government’s claims that this measure combats some form of “country shopping” by refugees are simplistic and inaccurate. In the recent words of the Honourable Lloyd Axworthy, himself a former Minister of Immigration, on CBC’s Power and Politics, “it is offensive.” We know from our collective experience that there are a wide range of legitimate reasons why refugee claimants may seek Canada’s protection after having filed a claim elsewhere. They must be given the opportunity to do so.

We urge, in the strongest possible terms, that the government withdraw this measure from the Budget Implementation Act.. Significant changes to our refugee determination system impacting Canada’s international human rights obligations have no place buried in a budget bill.

Sincerely,

 

Alex Neve
Secretary General
Amnesty International Canada (English Branch)

 

Josh Paterson
Executive Director
British Columbia Civil Liberties Association

 

Lobat Sadrehashemi
President
Canadian Association of Refugee Lawyers

 

Michael Bryant
Executive Director and General Counsel
Canadian Civil Liberties Association

 

Janet Dench
Executive Director
Canadian Council for Refugees

 

cc:       Hon. Bill Morneau, Minister of Finance

2019-04-11_letter_to_pm_re_refugee_measure_in_budget

Mass surveillance challenge proceeds to Europe’s highest human rights…

Brenda McPhail
Director of Privacy, Technology & Surveillance Project
bmcphail@ccla.org

 

 

 

 

CCLA and 9 partner organisations have made another step forward in our attempt to stop mass surveillance of the world’s networked communications systems.

Today, our request for a referral to the Grand Chamber of the European Court of Human Rights has been granted. This means that the highest European Human Rights Court will consider our argument that the routine, daily surveillance of millions of communications around the world for national security purposes is incompatible with human rights law and unjustifiable in a democracy.

CCLA is participating in this fight because laws that allows bulk collection of communications data impact us all. Messages we send at home in Canada flow with those from every other nation across the internet and are subject to bulk interception, without any suspicion that we’ve done anything wrong.  

We have been fighting this fight for a long time, building on each success. In 2013, whistleblower Edward Snowden revealed the incredible scope and reach of mass surveillance affecting us all. CCLA joined with our international colleagues to challenge the UK regime, which was extensively documented in the Snowden revelations. We asked the U.K. Investigatory Powers Tribunal (IPT) – the highly secretive UK court which hears claims against GCHQ, MI5 and MI6 –  to examine whether the British signals intelligence agency’s (GCHQ) was intercepting emails to and from 10 rights and liberties organisations (including CCLA), whether such interception was lawful, and whether it was a breach of the right to privacy under Article 8 of the British Human Rights Act.

In 2014, the IPT found that UK intelligence agencies had unlawfully spied on the communications of Amnesty International and South Africa’s Legal Resources Centre. The tribunal also found that UK intelligence sharing with the US, which had been governed under a secret legal framework, was unlawful until disclosed during the proceedings. Disappointingly, however, the IPT ruled that these practices may in principle comply with the UK’s human rights obligations. This was the finding challenged in the ECtHR.

We disagree that mass interception can ever, in principle, comply with human rights obligations, and so we launched a case at the European Court of Human Rights to argue that position. On 13 September 2018, the ECtHR ruled that UK laws enabling mass surveillance violate rights to privacy and freedom of expression.

That was another important victory. However, the judgment did not go far enough with regard to the unlawfulness of bulk interception powers and the fundamental shortcomings in inter-state intelligence sharing based on communications intercepts. Our argument is simple and principled: “the fact that it is now possible for the state to retain private information about the population of a whole nation (or even many nations) … and that retaining such information may be operationally useful, does not justify the intrusion of doing so.”

Requests to the Grand Chamber are accepted on an exceptional basis; it is a testament to the public importance of the issue of mass surveillance that our case was accepted.

This opens up the opportunity for CCLA and our partners, the American Civil Liberties Union (ACLU), Amnesty International, Bytes for All, the Egyptian Initiative for Personal Rights, the Hungarian Civil Liberties Union, the Irish Council for Civil Liberties, the Legal Resources Centre, Liberty, and Privacy International to continue pushing for the Court to hold that bulk powers can never be justified in a rights-respecting democracy.

It’s a long fight. It’s an important fight. And we continue to press forward.

 

Related links:

Back to the beginning: British Spies Violated Privacy of Rights Organisations Worldwide,

A win at the U.K. Investigatory Powers Tribunal : https://www.ipt-uk.com/judgments.asp?id=27

We move the fight to the European Court of Human Rights for another win:  https://ccla.org/ccla-inclo-others-welcome-historic-win-mass-surveillance-u-k/ 

We ask to be allowed to continue to fight: https://ccla.org/mass-surveillance-inclo-case-continues/

And we win again: our case is accepted by the Grand Chamber of the European Court of Human Rights: Grand Chamber Panel’s decisions – February 2019