(Version française disponible ici)

After years of waiting and cybersecurity policy focusing on infrastructure security , the federal government has at last turned its attention to the digital security of people with the introduction of the Online Harms Act. Fortunately, the worst fears for the bill born of years of poorly thought-out digital policy do not seem to have materialized.

Because the bill is so complex, it will require extensive analysis and democratic debate to ensure the right balance is struck between protecting Canadians against harmful online content and safeguarding fundamental rights such as freedom of expression and privacy. But for the first time in a long time, the government seems, at first glance, to be following the right path. The proposed framework appears to be balanced and to address the fears raised from previous proposals made in 2021.

Contrary to what some critics may claim, the bill in its current form does not bring undue restrictions to freedom of expression, a right that is never absolute. It strengthens existing mechanisms and sanctions against harmful content already prohibited in Canada, such as that promoting terrorism and violent extremism and incitation to hatred. It beefs up measures against child pornography, bullying children or messages inciting them to harm themselves, as well as “revenge porn” and the revictimization of survivors of sexual crimes.

Some amendments will certainly need to be discussed – some proposed penalties, such as life imprisonment, don’t seem appropriate – but the bill doesn’t tread on the dangerous ground of regulating speech that would be “lawful but awful” and might have presented free speech issues.

The core of the bill lies elsewhere, in new obligations for the operators of major digital platforms and the creation of new bodies to support victims.

New rules for digital platform operators

Inspired by expert recommendations and the European approach, the proposed framework centres on a duty to act responsibly, a duty to make certain content inaccessible and a duty to protect children. Generally speaking, operators would have to minimize the risk of exposure to harmful content through their design choices and content moderation mechanisms.

These new obligations would only apply to the largest social networking and content-sharing platforms. While defining the criteria will require careful consideration, private messaging services, such as WhatsApp or Signal, are excluded, except when messages can be broadcast to an unlimited audience. Such an approach should limit the risk to privacy and freedom of expression, while incentivizing platforms to constrain unlimited sharing, and with it the spread of disinformation.

The proposed law would require platform operators to appoint resource persons familiar with internal procedures who could support victims.  It is regrettable that the current bill would not require this resource person to be located in Canada. Although onerous for platforms, such an obligation would guarantee, both for operators and the public, that this person is in tune with the particular local context, values, linguistic realities and Indigenous Peoples.

The government also missed an opportunity to learn from the best privacy frameworks. These resource persons could additionally be “digital safety officers” with guarantees of protection and independence modeled on “data protection officers,” who could act in the event of a problem and influence the organization’s policies.

New bodies to support victims

Following the experts’ recommendations, the draft legislation is supported by the creation of three bodies: a digital safety commission, that would oversee the implementation of the Act, a digital safety ombudsperson and a digital safety office to support both of them.

Composed of three to five members, the commission would have significant powers to investigate and impose orders and sanctions on platform operators. The fact that decision-making power would not rest with a single commissioner, but rather with a commission, seems an excellent proposal that should ensure balanced decisions — depending on the commission’s composition.

SIGN UP

The inner workings of government

Keep track of who’s doing what to get federal policy made. In The Functionary.

Read it now.

SUBSCRIBE

The Functionary

Our newsletter about the public service. Nominated for a Digital Publishing Award.

Unlike the privacy commissioner in Bill C-27, this commission will not be subject to a new administrative tribunal, which would add delays to the protection of Canadians. To avoid political interference, the commission will also be a truly independent body from the government – unlike Bill C-27’s artificial intelligence and data commissioner.

In addition to its oversight powers, the commission will also have an online safety literacy mandate. This mandate is reinforced by the creation of an independent ombudsperson position to provide support to platform users and defend the public interest in “systemic online safety issues” that remain to be defined.

To avoid any suggestion the commission will finance itself through the large potential fines for operators of up to six per cent of global gross revenue or $10 million, whichever is greater, the fines would be remitted to the Receiver General of Canada, and the bill includes a recommendation for the appropriation of public revenues to fund since no funds were earmarked in the 2023 budget.

A curious and problematic point of the bill remains the mention of possible royalties set by the government that – if we are reading the bill correctly – would have to be paid by platforms to operate in Canada and would be used to fund the commission. While the federal budget is limited, the commission must be seen as an investment for Canadian society. Such a funding mechanism could also have a perverse effect on the quality of information and competition in an ecosystem that already relies on a handful of players.

If lessons are learned from recent attempts to levy digital royalties with bill C-18, some operators could withdraw from the Canadian market, reinforcing existing information oligopolies and cutting Canadians off from certain platforms that are essential in a globalized world. This could be dramatic for not-for-profit platforms such as Wikipedia, which may find themselves regulated but unable to pay royalties.

Unequal protection for whistleblowers

Finally, one of the bill’s biggest shortcomings is the lack of protection for whistleblowers. Several recent cases have demonstrated their essential role in shedding light on operators’ decisions that run counter to the objectives of the law.

While it is true that the bill would oblige the commission to protect the identity of those reporting observations, the same cannot be said of operators’ employees, who would have to request anonymity while specifying what could put them at risk.

An employee who is unfamiliar with surveillance techniques could put themself at risk, as the bill does not provide for protection from reprisals by the employer. In addition, there are no exceptions to provisions of the Criminal Code protecting trade secrets, or to non-disclosure agreements. Employees thus run the risk of criminal or civil prosecution.

In short, there are some missing elements, and as with any bill this complex, the devil is most likely in the details. But, for once, the overall infrastructure of the bill seems to be well thought-out. We now hope the shortcomings will be corrected during parliamentary debates.

The author was a member of the Council of Canadian Academies’ expert group on digital public safety that contributed to the 2023 Vulnerable Connections report advising policymakers.