The recent high-profile arrest of an St. Thomas, Ontario man allegedly busted abusing a child online has revived the discussion related to lawful access (or the Modernization of Investigative Techniques Act). While nobody can question the horror of child abuse, the debate over expanding police powers and privacy rights is a legitimate debate that needs to take place.

I found it interesting to learn that ISPs in Canada regularly disclose information about subscribers without search warrants, as discussed in the Canoe.ca article:

CANOE Money: Sectors - Police hope ISPs will do more to help in fighting child exploitation:

Tom Copeland, head of the Canadian Association of Internet Providers, said in most cases ISPs will co-operate if presented with a search warrant or a so-called letter of authority, but acknowledged it's not always the case.

"It's going to be a management decision by each and every ISP but I think the trend, especially when it comes to child exploitation, is to co-operate with law enforcement - subject to them providing some basic lawful authorization," he said.

The industry - which is made up of between 300 to 400 ISPs nationwide - has worked with law enforcement agencies to come up a letter of authority, a form that police can fill out and fax to ISPs to get information. It was developed after coming to a consensus that needing to obtain a search warrant was impractical for a number of reasons.

I have never seen one of these, so I am making an assumption that these are meant to invoke section 7(3)(c.1) of PIPEDA:

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is ...

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;

I also found it interesting that some are of the view that name and address (combined with the individual's IP address) are categorically non-sensitive and perhaps are not personal information:

"The notion that a search warrant is needed for simply a customer's name and address is a little bit far-reaching, it's really overkill based on what Canada's privacy laws dictate," Copeland said.

"There is a general naivety about what Canada's privacy laws will and won't allow us to do, what information is to be kept private subject to more rigorous requests by law enforcement, versus what a reasonable person would expect to be private or not private."

He said a customer's name and address - which can usually be found in the phone book or in an online database - wouldn't normally be considered personal or private information, and often that's all police need.

Labels: ip address, lawful access, lawful authority, privacy