Unduly restrictive?

A Senate public bill that would prevent youth from accessing explicit material online is overbroad and poses risks to privacy, say critics. It would also force internet service providers (ISPs) into a role they are not suited for.

Independent Senator Julie Miville-Dechêne introduced Bill S-210. A former journalist and Radio-Canada ombudsman, Miville-Dechêne hopes the bill will go some way to protect children's innocence and mental health. A nearly identical bill passed the Senate in the previous parliament but was did not make it to the House of Commons before the election.

The CBA's criminal justice section has proposed changes in a letter to the Senate's Legal and Constitutional Affairs committee. It notes that the bill aims to protect individuals under 18 years, whereas the baseline age of consent to sexual activity in Canada is 16. It also expresses concerns about the defence of "legitimate purpose" 

and the impact tools used for age verification can have on privacy rights.

"As a section, we are completely supportive of the goal, and in many respects, the mechanism of this bill," says Kevin Westell, principal at Pender Litigation in Vancouver, and secretary of the CBA's criminal justice section. "We really want to ask the government to make sure that the technology is in the place it needs to be to fulfil what this bill wants to do, and is able to go forward in a way that doesn't unfairly compromise the privacy rights of Canadians who are of the legal age to make choices around legal pornography."

Westell says they are sounding a note of caution because the "legitimate purpose" clause could face a constitutional challenge due to its vagueness.

"The list of qualified descriptors—science, medicine, education, arts— cover a pretty wide swath of human experience," Westell says. "A document can be both artistic and pornographic. Anytime the standard is so vague that the law really becomes the eye of the beholder is an interpretive problem."

Westell brings up the Little Sisters ruling on freedom of expression by the Supreme Court of Canada as illustrative of how it isn't always easy to distinguish between art and obscenity. Placing that burden onto ISPs could lead them to adopt a conservative approach that unduly imposes restrictions on art that might have high social value.

"ISPs are private entities, and now they're becoming the arbiters of what is pornography, what is art, and what is legal and non-legal behaviour, without much help in the interpretation department," Westell says. "They're just not qualified to do it. They are big corporations who have to answer to a board with regard to profit and loss—they're not there to focus on moral rights and wrongs, and to be law enforcement officers.

Chantal Bernier, former interim Privacy Commissioner of Canada, and now of counsel at Dentons Canada LLP in Ottawa, says that she agrees with the aim of the bill, speaking from the fact that she also spent six years as an assistant deputy minister at Public Safety Canada. She also believes that the bill's goal constitutes a justified breach of Charter rights, including privacy rights.

She adds that privacy issues raised in the bill are manageable. "How do you make sure that you collect the information that is only appropriate to your objective?" Bernier asks. "That means you may be able to use age-fencing technologies, but that doesn't mean you can use identification technologies. You don't need to know who the person is—all you need to know is this person is over 18."

Bernier says there are accuracy issues with age-fencing, particularly with tools like facial scanning (which is different from facial recognition), and is looking forward to what proposals come forward. She is adamant that we should not want to allow for facial recognition in this context. Also, any tech solution must be monitored to ensure it's effective, and not gathering any additional information.

"The bill puts a marker down for technologies that will verify age without impinging upon the right to privacy," says Bernier. "I believe that it is possible to implement that, but it will have to respect the very tight framework of proportionality, effectiveness, and the minimization of the gathering of personal information."

Bernier likes that the bill is technology neutral. She is also keenly aware of how sensitive the information is, which is why she wants the bill amended to include oversight by the Office of the Privacy Commissioner.

"I've pinned my hopes on the obligation [in the bill] to report on the implementation of the Act," says Bernier. "I believe that the bill would benefit from some form of monitoring structure in relation to privacy."

Emily Laidlaw, the Canada Research Chair in cybersecurity law at the University of Calgary, is especially worried about the feasibility of giving website blocking powers to ISPs. It all depends on how narrow the scope of those powers are, she says — whether they are used to block only what is necessary or as a tool of last resort, and if there has been due process.

"How is an ISP going to a level of granular blocking of sexually explicit material just to young persons?" asks Laidlaw. "Pornography is legal for adults to consume."

Laidlaw, who appeared at the Senate committee on the previous iteration of the bill, says that internet regulation needs to tread lightly in this area. There is enormous potential for infringements of freedom of expression and privacy. There are also implications around equality, particularly for groups like the LGBTQ+ community or sex workers being made more vulnerable by not having access to platforms.

"If the objective is to protect children, a lot of the most common ways that they are exposed to this material is the inadvertent ways, like pop-ups or embedded in a video that is otherwise innocent," says Laidlaw. "It might be through video game platforms or private chats—there are all kinds of ways that this content is shared, and one thing I am concerned about is the scope of to whom this applies."

Laidlaw is particularly concerned about the phrasing around making material available for commercial purposes.

"That potential brings within scope the YouTubes of the world, which I don't think was the goal, and they make money from advertising—it's a commercial platform," says Laidlaw. "If a child is inadvertently exposed to explicit material and YouTube has not implemented an age verification system, then there is a risk that they would fall foul of this Act."

Laidlaw worries the bill fails to address a particular issue online, while changing the entire structure of the internet ecosystem.

"The way it's drafted right now poses a lot of risks," says Laidlaw. "There are some real privacy vulnerabilities, and it's not easy to preserve privacy and maintain age verification. And I know the Privacy Commissioner's office provided commentary on the things they should be looking for, but I think it's hard to uncouple age verification from ID systems, and many providers of explicit materials might take the easy way out."

Laidlaw cites the investigation into Clearview AI, who Canadian privacy authorities ordered to stop collecting images of people from across the internet. Clearview was offering its facial recognition services to help law enforcement and financial institutions identify people.

"The second that we invite a system that is supposed to be scan and categorize an individual, it creates a privacy risk," Laidlaw says. "Who has oversight of that, and who has control of what uses are made of it? As much as this [bill] maybe wants to leave those details to a later date, those are core questions in order to make the age verification system privacy-preserving."