So, when we get judicial authorizations (Production Orders, generally) to hand over data or information, we have to do so pretty precisely. Recall that we have to articulate grounds to suspect or believe a particular criminal offence has been or will be committed, and that the documents or data sought will specifically afford evidence of that. These judicial authorizations aren’t big data vacuums where we can indiscriminately harvest, say, subscriber or bank data for a whole bunch of people. We’re going to have an identifiable offence (so that rules out ‘merely shameful personal habits’ that are not a crime), and will seek documents or data very discriminatory, based on specific identifiable individuals, or account numbers, or other specific unique identifiers. So the data gathering is quite self-limiting in that regard. We’re also implicitly limited by section 8 in how we can use information gathered under the auspices of one investigation for other purposes.A risk of increased access to confidential data is that eventually some government may want to compile dossiers using AI-enabled tools to scrape and synthesize publicly accessible anonymous or pseudonymous content, and use access powers to de-anonymize it. Those who openly self-attribute obviously aren't concerned, but there certainly are Canadians who deem themselves subversive in some sense who feel otherwise. This risk probably already exists in illiberal countries.
Prudence demands not merely considering the ideal uses of a tool, but what its potential abuses are. There have to be some hard stops.
"It can't happen here."
When we receive results from such orders, they get added to the individual criminal investigation, which, while held on one or another records management system, doesn’t mean they’re all ingested into some comprehensive database.
None of the new provisions in C-2 give us new access to data we couldn’t previously get. It just clarifies, modernizes, and/or simplifies some of the processes, adjusts the threshold in the case of subscriber data, and should speed the process up somewhat. There’s some streamlined data seizure authority particularly in the case of an investigative exigency but we’ll need to be prepared to defend it in court. It’s also still not completely new; we could do it already via an exigent warrantless physical search and systems access, so actually by creating an exigent data production provision where the service providers will pick it out and provide it for us, it actually should serve to reduce inadvertent overexposure of private data to law enforcement in the worst case scenario.
Anyway, my two cents. I obviously have my bias, but it’s very grounded in reality at the coal face.