The Harper government is touting its proposed Digital Privacy Act for offering new protections to Canadians surfing the Internet, shopping online and making it mandatory for organizations covered under the law to report data breaches.
However, Ottawa Internet lawyer and University of Ottawa law professor Michael Geist has a more critical view.
In a blog Thursday he agrees that the act – actually amendments to the Personal Information Protection and Electronics Document Act (PIPEDA) – has positive points, including the disclosure obligation.
However, he believes the bill also includes language that “could massively expand warrantless disclosure of personal information” to not just to law enforcement agencies but any other organization.
The amendments, introduced in the Senate, says “an organization may disclose personal information without the knowledge or consent of the individual… if the disclosure is made to another organization and is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada or a province that has been, is being or is about to be committed and it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the investigation.”
It might be reasonable for an organization to hand over personal information to a second company if that firm thought there was a danger or jeopardy to individuals. But, argues Geist, there’s a whole raft of legal actions organizations launch where they would love to get their hands on consumers’ names and addresses — copyright, defamation or potential contract problems.
In short, he says, the act will result in “massive warrantless disclosure of their personal information.”
There will be Senate — and possibly Commons — hearings on the legislation this year. It will be interesting to hear from the government on whether it interprets the section the same way.