Chapter 1: Privacy and Security in the Digital World
Special Report on the Lawful Access to Communications by Security and Intelligence Organizations

13. The individual right to privacy is fundamental to Canadian society. ^{Footnote 10} It ensures that people can go about their lives without being subjected to the scrutiny of others, particularly the government. The government, therefore, has an obligation to protect this right while discharging its responsibility to ensure public safety and protect national security. ^{Footnote 11} This is critical because lawful access represents one of the most intrusive powers of the state. Notwithstanding the growing ability of commercial entities to collect personal information, only the state has the power to infringe on an individual’s personal liberty, including arrest, detention, prosecution, and imprisonment. This chapter seeks to provide a basic understanding of the concept of privacy in the context of lawful access and the intersection of privacy and security.

Understanding Privacy

14. Privacy is a multifaceted concept with several key principles. ^{Footnote 12} In the context of this review, it relates most strongly to informational privacy: a person’s right to safeguard their information and assert control over how this information is used by the state. It also relates to expectations of anonymity and confidentiality, emphasizing the protection of an individual’s ability to keep personal information hidden from public view. ^{Footnote 13}

15. Privacy is also highly contextual. The Council of Canadian Academies found that individuals’ views and decisions regarding privacy change according to varying factors, including their social, geographic, historical, and cultural circumstances. ^{Footnote 14}

16. While privacy is often framed in the context of individual rights, privacy has a collective dimension as well:

Privacy is also important because it provides the foundation for the exercise of other fundamental rights and freedoms, chief among them freedom of expression and freedom of association. By enabling individuals to limit who has access to their communications — and to choose with whom they share their ideas and information — privacy allows for the creation of spaces in which different opinions and beliefs can flourish. ^{Footnote 15}

17. According to the British Columbia Civil Liberties Association (BCCLA), privacy “is a psychological need and a foundational right that many other key rights rest upon. … Privacy therefore undergirds the fundamental freedoms protected by section 2 of the Charter of Rights and Freedoms: the freedoms of conscience, religion, expression, thought, belief, and opinion that lie at the very heart of liberal democracies like Canada, as well as the liberty rights enshrined in section 7 [of the Canadian Charter of Rights and Freedoms (the Charter)].” ^{Footnote 16}

18. The Supreme Court of Canada has described privacy as a “fundamental consideration in a free society,” asserting:

Though an individual’s privacy will be preeminently important to that individual, the protection of privacy is also in the interest of society as a whole. Privacy therefore cannot be rejected as a mere personal concern: some personal concerns relating to privacy overlap with public interests. ^{Footnote 17}

The Supreme Court’s stance reflects a normative approach to privacy protection. This approach focuses “not just on what privacy is, but what privacy should be,” using a “broader lens of how we want to live as a society.” ^{Footnote 18}

19. Defining what the norms related to privacy should look like has become increasingly challenging. Research suggests conceptions and expectations of privacy are evolving as digital technology ^{Footnote 19} reshapes Canadians’ day-to-day lives. ^{Footnote 20} While the degree of adoption and use may differ among individuals, the Canadian Council of Academies argues that the ubiquity of digital technologies is such that everyone in Canada can be considered “digital-by-default.” ^{Footnote 21} With growing amounts of personal information being collected by a host of entities, each with their own approach to protecting this data, ^{Footnote 22} considerations about privacy no longer centre on keeping information secret. Rather, they have expanded to include “regulating the flow of information to some, restricting it from some, and opening it up to others.” ^{Footnote 23}

Balancing Privacy and Security

20. Law enforcement and security agencies are tasked with safeguarding national security and public safety. ^{Footnote 24} To do this effectively, they may need to access private communications. Collection and surveillance techniques may generate leads, uncover threats, and help identify and investigate individuals or groups involved in threats such as terrorism, serious organized crime, espionage, and foreign interference. ^{Footnote 25} This access necessarily interferes with an individual’s right to privacy. ^{Footnote 26}

21. The collection of personal information by the state differs from the collection of personal information by commercial entities because of the coercive powers of the state, and because electronic surveillance conducted by national security and intelligence organizations happens mostly in secret. ^{Footnote 27} In addition to the privacy rights engaged directly by lawful access activities such as electronic surveillance, lawful access may lead to other intrusive or coercive state activities, such as the search and seizure of property, and the sharing of information with other states. In most likeminded democracies, such infringements must be prescribed by law, serve a legitimate purpose, and be necessary and proportionate. ^{Footnote 28} (Canada’s legal framework for lawful access will be described in the following chapter.)

22. Whether such intrusion is appropriate, and if so to what extent, is a matter of fierce debate, often reducing the tension between privacy and security to a zero-sum game. Some argue that such powers should not exist at all; others accept the powers but emphasize the need for robust safeguards on their use. ^{Footnote 29} Some also challenge the notion that judicial authorization for lawful access sufficiently addresses privacy concerns. Professor Goold notes,

While important, legal accountability via judicial oversight only goes part of the way towards ensuring that the police are properly subject to the rule of law. In addition, there needs to be transparency around the range of powers and investigative techniques available to them. ^{Footnote 30}

All sides have called for more nuance to the debate, arguing that both privacy and security are integral to Canadian democracy and that there are ways to respect both concurrently. ^{Footnote 31}

23. According to the BCCLA, the judicial authorization of lawful access is crucial yet not enough, particularly with respect to CSIS investigations where “the possibility remains that CSIS may not be sufficiently candid with the Court to allow full protection of the rights” when seeking a warrant. ^{Footnote 32} This concern stems from a landmark Federal Court decision in 2016 which ruled that CSIS had breached its duty of candour when seeking warrants in numerous warrant applications. ^{Footnote 33} In a subsequent decision, the Federal Court noted that repeated breaches suggested “a degree of institutional disregard for — or a the very least — a cavalier institutional approach to — the duty of candour and, regrettably, the rule of law.” ^{Footnote 34} CSIS notes that it has since adapted its practices with the Federal Court to better satisfy duty of candour obligations and believes that trust has been restored with the Federal Court. ^{Footnote 35}

24. The Privacy Commissioner has stated that transparency about how security and intelligence agencies consider privacy concerns can act as an “accelerator” of trust in government institutions. ^{Footnote 36} In other words, if these agencies put in place mechanisms and practices to demonstrate how they put privacy at the forefront of their deliberations and actions, the public is more likely to trust the necessity of the proposed investigative authorities and tools. This in turn fosters public consent and legitimacy when it comes to actions that may interfere with Canadians’ Charter rights.

25. As such, some privacy advocates have called for increased transparency by law enforcement and security agencies in carrying out lawful access activities. ^{Footnote 37} Transparency mechanisms include regular reporting on government requests and access to personal information, a greater involvement of privacy protection organizations in the development of lawful access capabilities, and legally mandating privacy impact assessments. ^{Footnote 38}

26. Professor Goold cautions against linking trust and transparency in this way:

[While] the promotion of trust serving as a justification for greater transparency — might appear to be unproblematic, the assumption that more transparency is always and inevitably a good thing is one that deserves further examination. This is particularly true when it comes to the use of surveillance technologies by the police and security services. Although transparency is often cited as a necessary prerequisite for institutional accountability, it can also play a role in the normalization of activities that should be seen as exceptional. ^{Footnote 39}

27. Similarly, Professor Goold calls for a shift in the way the government initiates legislative reform to address lawful access challenges so that Canadians who are concerned about privacy do not feel they need to “be on the defensive.” ^{Footnote 40} He argues the government needs to better justify the need for expanded surveillance powers and tools in a more transparent way. ^{Footnote 41} This is particularly important because once privacy is ceded as a consequence of new authorities or the adoption of a new technology, that ground is rarely ceded back:

Once granted, powers conferred to agents of the state like the police are rarely withdrawn or curtailed, and while we may not be concerned about the misuse of such powers in the current political climate, circumstances can change. Similarly, before expanding the surveillance capacities of the state to allow the police and security services to use [On-Device Investigative Tools or] ODITs or other forms of lawful hacking, lawmakers and the public should consider the risk that such capacities may be misused in the future. ^{Footnote 42}

28. The Committee intends to address these risks and those raised by the security and intelligence community in this report.