Privacy and Security: Disclosure

Remarks for the 6^th Annual Privacy & Security Workshop and the 14^th CACR Information Security Workshop

November 3, 2005
Toronto, Ontario

Address by Jennifer Stoddart
Privacy Commissioner of Canada

(CHECK AGAINST DELIVERY)

The conference web site indicates that the intended audience at this conference includes technology and security experts, CIOs, technology executives, health professionals, cryptographers, engineers, law enforcement representatives, practitioners, academics, private sector leaders, privacy experts and students. Our challenge is to find a common language to share our expertise and express our concerns about privacy and security. Otherwise we do no better than the proverbial locals who, in response to foreign tourists who can't speak the local language, simply speak more loudly. In the middle of this tumultuous decade, with important matters at stake in terms of both rights and security, we cannot afford to sit across the room shouting at each other — or talk past each other.

I would like to try to find a common language in discussing what may seem an esoteric topic — changes to Canada's legislation relating to the use of DNA in criminal investigations. However, the use of DNA for this purpose — forensic DNA analysis and DNA data banking, if you want to call it that — exemplifies within the criminal justice system the tug-of-war between privacy rights and physical security that we also encounter in the larger world.

The challenge with DNA, as with other applications of technology in the name of our physical or national security, is to address legitimate needs for security in a way that does not do a disservice to the fundamental rights that sustain our democratic society.

Once the agencies of the state — such as a national police force or a statistics warehouse — obtain new powers, they become jealous mistresses of them.

The ratchet turns only one way, leading, in my field of concern, to an ever-increasing diminution of this right we call privacy, increasingly seen by many as fundamental to other rights such as freedom of expression or liberty of movement. It's hard to imagine a situation where an agency possessed of intrusive powers will say to Parliament, "We don't really need this power anymore. We want to surrender it." If only life were like that, as they say in the TV commercial, we wouldn't need to be so concerned about protecting our rights.

But life is not like that, and we need to be concerned when the state gives one of its agencies the power to pry into our bodies, even for the noble cause of solving crime. We need to ensure that such powers are carefully circumscribed. The wholesale poking, prying and prodding into the bodies of Canadians for other than serious offences is not the mark of a society that professes respect for privacy.

As Canadians, we accept the need for certain intrusive police powers, but we also require that these powers operate within a framework of rights and within a system of "checks and balances." Police efficiency cannot be allowed to become the overriding goal of our democratic society — or, frankly, we will no longer be justified in calling our society democratic.

Let me explain my concern about state powers in relation to recent amendments to criminal law provisions dealing with DNA evidence — the forensic use of DNA.

Parliament first enacted forensic DNA provisions in Canada's Criminal Code just over 10 years ago. The goal of the legislation was to facilitate obtaining genetic samples from individuals suspected of having committed one of a clearly defined range of serious violent offences. Where a person was suspected of having committed a sexual assault, for example, and DNA from the presumed assailant was found at the crime scene, the legislation provided a scheme for obtaining a warrant to authorize taking a DNA sample from the suspect.

If the samples from the suspect and crime scene matched, this became powerful evidence that the suspect had been at the crime scene.

Further DNA legislation, the DNA Identification Act, was enacted in 1998 and came into force in 2000. The Act created a national DNA data bank.  The Act authorized the collection and storage, for DNA analysis, of biological samples from anyone convicted — as opposed to merely suspected — of a "designated" offence — generally a serious offence involving violence.  The RCMP retains the databank, and it is used to help law enforcement agencies in investigating serious crimes by comparing the database of samples linked to known offenders with samples found at crime scenes. 

The operation of the data bank is monitored by a DNA Data Bank Advisory Committee, which includes an official representative from my Office, Assistant Privacy Commissioner Raymond D'Aoust, as well as representatives of the police, legal, scientific, and academic communities. The Committee meets two to three times a year and provides a forum for discussing policy and operational issues. The National DNA Data Bank managers have gone to great lengths to remove the personal identifiers from the DNA sample so that only authorized investigative personnel would have access to the information to conduct criminal investigations.

Our office did not oppose establishing this limited warrant scheme to allow DNA to be obtained from those suspected of crimes of serious violence where DNA had been found at the crime scene. Nor did we oppose creating a DNA data bank of samples taken from those convicted of serious offences involving violence.

We argued for clear controls and conditions for collecting DNA samples from suspects to help determine their culpability. We also advocated clear rules and limits on the taking of DNA from convicted offenders. In large part, our concerns were met in both the 1995 and 2000 legislation.

However, we are concerned about the apparent shift in focus of the DNA legislation. Both the original 1995 law that allowed samples to be taken from certain suspects and the later amendments that established a DNA databank, show that the central focus of these provisions was serious offences involving violence.

If the offence was not of this nature, there would generally — there were a few exceptions — be no power to compel the production of DNA from a suspect, and no power to include a convicted offender's DNA in a criminal database.

Let me explain this in more practical terms. An accountant who is suspected of fraud is not going to have his or her DNA taken for forensic purposes. An accounting fraud is not the sort of offence where DNA is likely to be useful in solving the crime. Nor is there any reason to believe that taking a DNA sample from the convicted accountant for a DNA databank is going to greatly enhance public safety.

On the other hand, a person suspected of a serious sexual assault where DNA was left at the scene of a crime would be an appropriate candidate for a warrant to obtain DNA from him for comparison with the crime scene sample. Similarly, a person with a history of sexual offending would be a legitimate candidate for the DNA databank, since such offences often result in DNA being left at the scene of the crime.

The databank could be used to help solve previously unsolved cases and, if the offender is released, it could be used to determine his possible ties to future offences. The intrusion represented by the taking of a DNA sample for a data bank would be justified.

However, Bill C-13, which received Royal Assent in May, takes us very close to the edge of a dangerous slope by enlarging, in some cases without clear justification, the types of offences for which it will be possible to obtain DNA samples from a suspect. That same law expands — again, without a clear justification in every case — the circumstances where DNA samples can be taken from those convicted of criminal offences. With Bill C-13, we are a long way from evidence-based policy making.

Bill C-13 makes the process obtaining DNA less selective — and less respectful of privacy. Bill C-13 adds 28 Criminal Code offences — including administering a noxious substance, being unlawfully in a dwelling house, intimidation and criminal harassment — to the list of offences for which an order compelling an offender to submit a sample for inclusion in the national DNA databank can or, in some cases, must be made. It adds several new offences to the list of offences where DNA is permitted to be taken, with a warrant, from a suspect.

I was even more troubled when I heard calls from some police officials in Canada after Bill C-13 was introduced to move towards the UK approach to the use of DNA. In the UK, the police are allowed to take DNA samples after any arrest, whether the offence involved violence or whether DNA would in any way be useful in solving that crime. The mere fact of an arrest for even a non-violent wrong (welfare fraud, or failing to pay for gasoline at a gas station) would enable the police to force an individual to surrender DNA. This approach has been advocated in that country since the late 1980s. It is not one we should emulate in Canada.

One justification given for this massive compulsory use of DNA technology is that it would help to acquit the innocent. However, the innocent do not need DNA legislation to be acquitted.

They can — and almost certainly will — volunteer their DNA to show that it did not match that found at a crime scene. It is misleading to argue that a legislative scheme to compel the taking of DNA is helpful in showing one's innocence.

Some of you here might sing the praises of a comprehensive law allowing widespread DNA testing and data banking to assist criminal investigations. You will not hear my voice among that chorus.

At a time when, in spite of sensational media stories, official tabulations show that many violent crimes have declined substantially, we are hearing calls for ever greater intrusions into the lives of individuals.

The thinking behind this is not complex. It goes something like this: "We have the technology to intrude. Let's use it," followed by the simplistic proposition: "If you have nothing to hide, you have nothing to worry about."

But do we really want technology to be the determinant of the basic human rights, including the right to privacy, that democracies profess so loudly and nobly to want to protect? I do not recall seeing in any of the great international human rights instruments, nor in our Charter of Rights, a statement to the effect that we have rights only until technology is able to eliminate them.

Sections 7 and 8 of the Charter should not be limited by the tools of scientific police and the legislative scheme that supports crime fighting. But that is what I fear is happening. We have a powerfully intrusive technology that allows us to use DNA for forensic purposes. Despite the lure of the technology, we use it only under carefully limited circumstances.

Critics of my concern about forensic DNA sometimes argue that the taking of DNA is no more intrusive than taking a fingerprint. True, taking DNA may involve taking a swab or oral fluid and cells from inside a person's mouth — a relatively minor intrusion in a physical sense, just as fingerprinting involves a relatively minor physical intrusion. But the information that can be generated from DNA is vastly greater than that available from fingerprints.

Thankfully, both the Supreme Court of Canada and Justice Minister Irwin Cotler have rejected the argument that taking a DNA sample is akin to taking a fingerprint.

I hope that in Bill C-13 we are not witnessing a slow creep to a scheme for taking DNA from suspects on arrest, and placing that DNA in a national data bank even if the suspect is completely innocent. Fortunately, Minister Cotler spoke out against such a process, but I am concerned that the relentless drive for security at all costs may persuade a future Minister of Justice to be less respectful of the right to privacy.

We should insist that there be both a demonstrable justification and firm criteria before adding new offences to the list of those warranting inclusion of a DNA sample in the data bank.

There is also an apparent lack of documented research demonstrating a clear correlation between the commission of some of the less serious offences that are being added to the list of "designated offences" and the subsequent commission of more serious and violent offences.

For example, it may be true that many offenders who commit violent or sexual offences also commit offences such as break and enter. However, it is clearly not the case that everyone who commits a break and enter offence goes on to commit more violent offences. Currently, the tool of DNA data banking is being used in some provinces to dismantle break-and-enter organized crime networks.

We believe that, in principle, the number of offences for which DNA samples can be taken and included in the data bank should be kept to a minimum, and that the identification of offences for which such measures are to be allowed must be based on a clearly articulated and demonstrably justifiable rationale.

Conclusion

Bill C-13 has been enacted. It will come into force once it receives Royal Assent, so the immediate debate is over for now. But the larger debate is far from over. Maybe it's time to stop kidding ourselves that the answer to crime lies in greater powers of enforcement and greater powers of intrusion. If that were the case, the United States, with its massive criminal justice apparatus, would be an infinitely safer place than Canada. It is not.

We reach too easily for the power to intrude. There are other measures besides enforcement that produce safer societies, without forcing us to trade our fundamental privacy rights in the faint hope that we will be better protected.

I fear that we will move away from the DNA scheme that was set out in the original legislation creating the data bank. I fear that we will move away from a limited data bank that only contains DNA samples from those convicted of the most serious violent and sexual offences where the nature of the crime is such that it is likely to leave DNA at the crime scene.

I fear that we are moving towards a registry of all convicted offenders. And we are doing this without regard to the original rationale for the legislation and without any compelling evidence that would justify the inclusion of these new offences.

In doing so, we will open a new realm of surveillance in our society. Will we introduce a scheme to collect a DNA sample from convicted offenders at the point of arrest? From that point, where will we end up — with a DNA sample at the crib? There is a real risk that what was originally designed as a forensic tool for investigating the most serious crimes will become a salient feature of society dominated by eugenic considerations — a society that maps and sorts individuals by their genetic make-up.

Where will we stop? DNA banking has already proven to be an effective tool for post mass disaster management, allowing the identification of human remains. What role will it play in a society ridden with fears about the next pandemic or the next natural catastrophe? What argument will serve to extend the scheme to all of us — from public safety and emergency preparedness perspectives?

In a world where actions are now frequently driven by fear, our rights are ripe for the plucking. That is not a situation that honours those who have fought so hard to promote and protect the fundamental human rights of which we have so long been proud. Nor is it a situation that serves the interests of Canadians, the vast majority of whom, I believe, do not want to see their rights whittled away. That is too high a price for democracy to pay.