Section 7 of the PIPEDA says that an organization may reveal personal information without a person’s consent, to someone who has “legal authority,” if it is for the purpose of enforcing a Canadian law.
In court testimony, Paul Krawczyk, an officer with the Toronto Police Service, recalled that the RCMP sent an e-mail advising other police forces about using PIPEDA.
Eventually, major Internet providers such as Bell, Telus, Shaw and Sasktel joined police and other stakeholders and formalized the process. It would only be used when investigating child abuse cases. And there was even a form that officers could fill to expedite their requests.
“For files that are related to abuse against children, we co-operate with the police without a warrant from a court of justice but the request must be made by virtue of PIPEDA. For other requests, we need a warrant to provide the information unless a person’s life is in danger,” said Élodie Girardin-Lajoie, a spokeswoman for Videotron.
A concern, first raised by the federal government’s now-defunct Bill C-30, is that Ottawa is keen to expand warrantless access beyond child-abuse investigations to include intelligence-gathering or non-criminal probes.
Even in child-abuse cases, it is not the job of businesses to help expedite the work of police, says privacy lawyer David Fraser. “If the issue is the paperwork and the delays, then remedial efforts need to focus on the paperwork and delays – not removing the safeguards that we have and that protect Canadians’ privacy.”
HOW IT WORKS: OPERATION PENALTY
In the spring of 2006, the operator of a Web portal in the sleepy southern German town of Radolfzell noticed 28 of his online forums had been used to trade images of child sexual abuse. He called the police.
The German investigation, codenamed Operation Penalty, found that nearly a million suspicious IP addresses had retrieved illegal files on the website.
The German state criminal office in Baden-Wuerttemberg eventually announced that there were 4,700 suspects around the world. Their IP addresses, which came from 107 different countries, were transmitted to Interpol, which began alerting local police forces.
By September, the RCMP’s National Child Exploitation Co-ordination Centre in Ottawa received from Interpol 229 Canadian IP addresses alleged to have accessed the German website, Carookee.com.
RCMP officers identified which Internet company used each of those IP numbers, then began sending them PIPEDA requests.
According to the Association of Police Chiefs, Internet providers only denied 47 of the 229 PIPEDA requests related to Operation Penalty.
One batch of requests for example was faxed on Nov. 22, 2006, by RCMP Constable Jason Tree.
The reply from Bell Sympatico: three of the IP addresses had been used on specific dates by the account of Mr. Ward in Sudbury.
The RCMP forwarded the information to Sudbury Regional Police.
In Sudbury, Sgt. Burtt first reviewed the photos to make sure they were illegal. (This was necessary because Germany and Canada have different cutoff ages in their definition of child pornography.)
Over the next months, Sudbury police did background checks on Mr. Wade, to make sure no one was piggybacking on his account. “You still got to verify if that address is there. Is that person associated with that address? We did a door knock,” Sgt. Burtt said.
Meanwhile, across Canada, the German information also trickled to local authorities. Ontario’s Peel Regional Police investigated a resident in suburban Brampton. In northern B.C., the RCMP detachment in Surrey, B.C., closed in on an elementary-school principal in Fort Nelson. The Sûreté du Québec had 27 suspects.
THE CONSTITUTIONAL ISSUE
The PIPEDA requests in Operation Penalty took place at a time when the process was being challenged in court.
Nine days before the information came from Germany, in September, 2006, justice of the peace Mark Conacher refused to recognized the PIPEDA process in a probe against a Toronto firefighter.
The Toronto police reapplied successfully before a judge. Afterward, Toronto police and the RCMP in Ottawa had discussions but decided to keep using the requests.
By January, 2008, a number of Operation Penalty suspects were already before the court while 27 were still to be arrested in Quebec, when a judge invalidated the PIPEDA requests system.