The Communications Security Establishment (the CSE), Canada’s equivalent to the US NSA, recently acknowledged that it inadvertently shared information about Canadians with its foreign partners. A CBC News internal investigation also recently exposed Blackberry in helping to intercept user data “for years” to help in hundreds of police investigations in dozens of countries.
The CSE downplayed the incident by stating that the metadata shared with Canada’s partners “did not contain names or enough information on its own to identify individuals” and that the privacy impact “was low.” Blackberry, on the other hand, maintains that it is doing “what is right”.
While Blackberry has been handing over actual personal data (including BBM messages), the fact that the CSE only revealed metadata is not particularly comforting. In fact, metadata contains so many bits of information, that when linked together can tell a complete story. And the amount of metadata that the CSE has access to is massive. Canadians generate metadata on a constant basis, even while asleep, because our devices are almost always connected to the Internet.
The CSE has not yet provided any clarifications on the laws under which it operates, notwithstanding that this information has been requested. This is in direct contrast to several large technology companies who have recently volunteered information about how much data they disclose to the police by publishing transparency reports (Blackberry is not one of them).
A Supreme Court of Canada ruling in 2014 held that Canadians’ Internet activities are presumed to be private and collection of this information can only occur with a court’s permission. It appears that neither the CSE nor Blackberry is operating under this authority. So what does this mean for Canadians’ privacy rights? The Office of the Privacy Commissioner of Canada is expected to weigh in on the matter in the fall. We hope it will take this opportunity to provide Canadians with some clarity and give strict guidance to everyone who is ‘listening’.