Privacy Commissioner Not Consulted on Bill Allowing Government to Block Internet Access for ‘Specified’ Persons

Privacy Commissioner Philippe Dufresne says he has not been consulted on a cybersecurity bill that would allow Ottawa to secretly block individual Canadians from accessing telecommunications or internet networks.

“We’re not consulted on specific pieces of legislation before they’re tabled,” Dufresne said at an Oct. 6 House of Commons ethics committee meeting, which was first covered by Blacklock’s Reporter.

Bill C-8, also known as An Act Respecting Cybersecurity, has non-disclosure provisions that would allow cabinet to, “on a case-by-case basis,” block “any specified person” from accessing any telecommunications or internet network it believes necessary to protect the nation without disclosing the order or the reasons behind it. Public Safety Minister Gary Anandasangaree introduced the bill on June 18.

If enacted, the legislation could be invoked if the government believes “on reasonable grounds” that it’s necessary to do so to secure Canadian telecommunications systems against “any threat.”

Dufresne said protecting national security needs to be done in a manner that is not at the expense of privacy.

Conservative MP Michael Barrett raised concerns at the Oct. 6 committee meeting about the “sweeping and secret powers” that the legislation would give cabinet over individuals’ internet and telephone access, noting that no warrant would be required to use these powers and that the actions would be concealed from the public.

“Without meaningful limits, bills like C-8 … can hand the government secret warrantless powers over Canadians’ communications,” Barrett said. “This is a serious setback for privacy. It’s also a serious setback for democracy.”

Dufresne said criteria on necessity and proportionality need to be added to the legislation to ensure the bill achieves the result it aims to achieve. Regarding secrecy, he said it can be necessary in “certain instances” but noted that absolute secrecy should be challenged.

He said that while the actions taken don’t necessarily have to be made public, there should be confidential reporting to an authority who could raise questions about it, such as his office.

Barrett said that since privacy impact assessments are not required before legislation is passed, Parliament can grant “sweeping powers of surveillance” to the government without a formal review by the privacy commissioner.

Dufresne responded that a review by the privacy commission is not a legal obligation in the Privacy Act, but that he believes it should be.

“This is one of the recommendations that I have made to Parliament, and I continue to make. It should be an obligation,” Dufresne said. “There should be the opportunity for my office to give input before the fact when there’s a major change, including legislation.”

Engaging in earlier consultation to provide feedback before legislation is tabled would make the feedback more meaningful, he said.

“I expect to be called specifically on this bill to address it, but as a general proposition, I recommend necessity and proportionality be in the legislation made explicit so that there’s a strong test,” Dufresne said.

Bill C-8 passed second reading in the House of Commons on Oct. 3 and was referred to committee. The bill still needs to go through several stages in the House and Senate before becoming law.

Protect Against Foreign Interference

Opposition MPs raised concerns about the bill during its second reading in the House of Commons on Oct. 3. Conservative MP Leslyn Lewis said the “sweeping powers” the legislation aims to grant the federal government would contravene sections 7 and 8 of the Charter of Rights and Freedoms.

By amending the Telecommunications Act, the legislation would allow the industry minister, with permission from cabinet, to direct telecommunications service providers to block specific services for users or shut down a person’s legal right to access the internet or phone networks in certain circumstances.

The Liberals have said the bill is necessary to protect Canada from foreign interference and misuse of the telecommunications systems, such as threats from hackers and ransomware fraudsters.

Liberal MP Jacques Ramsay argued that the bill is “essential to protect Canadians,” noting the legislation is being proposed to counter cyber threats from adversaries such as Iran, Russia, China, and North Korea.

“Orders and directions cannot and will not be used to conduct surveillance activities or intercept private communications,” Ramsay said. “Rather, these powers are intended to be used in rare and serious circumstances where there is an urgent need to respond to a known threat or vulnerability.”

Meanwhile, Bloc Québécois MP Alexis Deschênes said the bill raises “concerns related to individual freedoms and the right to privacy.” NDP MP Gord Johns said he agreed that the bill presents significant risks of infringing on the rights of Canadians. “Simply having the minister’s judgment on what is necessary as a standard is vague, subjective, and wide open to abuse,” Johns said.

Liberal MP Kevin Lamoureux disagreed with opposition MPs saying the bill could be used to infringe on the rights of Canadians. He said the legislation is “all about protecting Canadians and protecting the economy.”

Paul Rowan Brian contributed to this report.