Why Canada needs ‘privacy by design’

Technology, it has been said, doubles every 18 months, clear evidence that technological progress occurs at breakneck speed.

The wheels of legal progress, on the other hand, grind exceedingly slowly. The law is constantly playing catch up with technology, and often falls further behind. And nowhere is that more evident than in our failure to regulate police use of surveillance technology.

The House of Commons privacy and ethics committee heard this week testimony regarding the RCMP’s little known Covert Access and Intercept Team which, since 2017, used sophisticated technology to hack 49 electronic devices in 32 separate investigations.

The “on-device investigative tools” (ODITS) technology allows the RCMP to collect numerous forms of electronic data including emails, text messages and images and sounds from cellphones and other devices.

The Mounties contend that the technology is necessary given their inability to decode most forms of encrypted messages. In a statement, they stressed that they only used ODITS under judicial authorization, and only when other techniques had failed to access the information.

That might be true, but the statement still provides cold comfort given the culture of secrecy that seems to surround the RCMP.

Indeed, the Mounties only revealed the use of the technology in June — and only in response to a request for info from a member of Parliament — some five years after it was first used. And federal Privacy Commissioner Philippe Dufresne said he learned of the program through a media report rather than from the RCMP.

The Mounties did say that they started a privacy impact assessment in 2021, but Dufresne, testifying before the committee on Monday, said he hadn’t been informed of its status.

The fact that the privacy commissioner has been kept completely in the dark reveals the degree to which the law has failed to keep pace with the advances in technology, and with police use of that technology. And that failure presents a threat to the rights of every Canadian.

Now to be sure, law enforcement needs to keep up with technology just as surely as the law does. And as Public Safety Minister Marco Mendocino stressed before the committee on Monday, we don’t want to hamstring the police in their efforts to combat serious criminal, terrorism and other national security threats.

New surveillance technologies will inevitably become necessary, but it shouldn’t be up to the RCMP — or any police service — to decide, with no proactive oversight, what, when, where and how they’re going to use the technologies. On the contrary, it’s up to the law — as crafted by lawmakers and interpreted by the judiciary — to tell police what they can and can’t do. It’s therefore incumbent on Parliament to ensure oversight of the RCMP’s use of surveillance measures before those measures are implemented.

At his testimony on Monday, Dufresne said the law should create an environment of “privacy by design.” To that end, he urged Parliament to amend the Privacy Act to ensure organizations complete a privacy impact assessment before employing new technologies.

It’s also important that the privacy commissioner be advised of the assessment at the outset and to give his approval prior to implementation. This would effectively prevent what happened in June, when former commissioner Daniel Therrien found the RCMP’s use of facial recognition technology violated the Privacy Act.

Therrien told the committee on Tuesday that he had not been informed of the RCMP’s use of ODITS. He also testified that since the technology is “extremely intrusive” there “needs to be an extremely compelling public interest to justify” its use.

Experts have also advised that given the level of intrusiveness, the technology should be used only as a last resort, after all else has failed. Although the RCMP and Mendicino stated that the Mounties do limit the use of ODITS to such situations, it’s worth incorporating that requirement into the regulatory framework.

Even with such changes, the law might not keep pace with technology. But it should allow the law to keep technology in its sight.