Poor protection

It's a plus to see Canada finally considering some available options to try to protect Canadians' privacy against the terms of the Patriot Act. But there's a problem that receives far too little attention in the story:

A federal proposal would allow government departments to immediately cancel a contract with an American firm if it hands personal information about Canadians to U.S. anti-terrorism investigators...

While the federal guidelines will be helpful, they might not be watertight, Lawson (executive director of the Canadian Internet Policy and Public Interest Clinic) suggested.

The contract cancellation proposal could leave American firms with the choice of respecting either U.S. or Canadian statutes, she said.

"They're going to have to break one law or the other. And I'm sure there are going to be cases where the business decides it's least costly to them to comply with the American law and breach the Canadian law."

It would be a serious enough problem if firms faced a mere choice between prosecution in either the U.S. or Canada. But keep in mind that under the terms of the Patriot Act, not only would an American firm with control of data be required to disclose it, but it would also be required not to inform anybody (including the government department in question) that a request had been made:

`(a)(1) The Director of the Federal Bureau of Investigation or a designee of the Director...may make an application for an order requiring the production of any tangible things (including books, records, papers, documents, and other items) for an investigation to protect against international terrorism or clandestine intelligence activities...

`(d) No person shall disclose to any other person (other than those persons necessary to produce the tangible things under this section) that the Federal Bureau of Investigation has sought or obtained tangible things under this section.

Under the proposed contract structure, a firm's choice would be between:

(a) violating Canadian law, secure in the knowledge that any person who disclosed that violation would be subject to U.S. prosecution, or
(b) violating U.S. law, with absolutely no chance of avoiding prosecution since any refusal to comply would itself be a contempt of court.

Needless to say, there isn't much reason to be confident that any firm would choose to protect Canadian information under those circumstances...no matter what the contract contains.

The article fairly points out that risk under the Patriot Act is a relatively minor issue...and that's particularly so compared to other privacy concerns of the Liberals' own making. But the proposed contractual changes are at best an incremental change in incentives. And that small change isn't likely to keep any information from being disclosed.

(Edit: cleaned up wording of last paragraph.)