Even as Paul, a TekSavvy internet subscriber, faced the possibility of a U.S. film company suing him for illegally downloading a movie, he felt certain that he would emerge unscathed.

"I wasn't too concerned about the repercussions," said Paul, whose name has been changed to protect his identity due to fear of losing his job.

But that sense of security — driven in part by a Federal Court decision in February that put limits on the U.S. practice of "trolling" for copyright infringements  — may soon be a thing of the past.

A proposed new federal law threatens to open the doors to the sharing of online users' identities between companies, without court oversight. 

Tabled three weeks ago in the Senate, the proposed digital privacy act is supposed to better protect Canadian from data breaches and fraud. But it could instead put them at risk in cases of alleged copyright infringement, such as those made against Paul, internet advocates say.

Paul was just one of 2,000 internet subscribers with the Ontario-based TekSavvy provider whose identities were sought in a landmark case by Voltage Pictures, a California film company that owns the rights to numerous lesser-known films as well as star-studded ones such as Hurt Locker and Dallas Buyers Club.

On Feb. 20, the Federal Court told the internet service provider that it will have to hand over subscriber information, but in a court-monitored process intended to protect the users.

Experts heralded that decision, saying it closed Canada's door to the troublesome "copyright trolls" in the U.S., companies that use fear-mongering tactics to scare internet users into paying thousands of dollars in settlements to avoid lawsuits for copyright infringement.

But today these experts are also saying that the proposed digital privacy act threatens to reopen that door.

It 'affects everybody'

Michael Geist, the Canada Research Chair in internet and e-commerce law at the University of Ottawa, was the first to raise alarm bells about a provision buried within Bill S-4.

The bill would finally require organizations to tell Canadians when there had been a security breach involving their personal information. But the proposed rules also permit companies to voluntarily disclose personal information to another company, without a court order and without telling the person affected.

"The expansion of warrantless personal information disclosure raises enormous concerns," Geist said. 

Not only does this put ordinary Canadians at risk in cases of alleged copyright infringement, such as in the TekSavvy-Voltage dispute, it could also raise the legal stakes in cases involving an allegation of defamation, or when a content or service provider accuses someone of violating the lengthy terms-of-service agreement that people so often click through without reading.

"That's a huge loophole and seriously undermines the privacy of any Canadian with an internet connection," says David Christopher, communications manager at open-internet advocacy group OpenMedia.ca. "This affects everybody."

In response to stories about the loophole, Industry Minister James Moore put out a statement on April 15 saying recent media reports misrepresented the intent of the bill: to strengthen protection of Canadians' privacy.

Moore said the act will place "strict limits on the type of personal information companies can disclose to other organizations" and companies will have to follow strict rules before releasing it.

The rules will make sure information is released only "when there is a reason to believe the law has been broken, the investigation would be compromised by notifying the individual and that only information needed in the investigation is released," said the statement. It noted the privacy commissioner will be able to take action against those who break the rules.

However, Geist notes that individuals won't know that their information has been shared.

Canada's Interim Privacy Commissioner Chantal Bernier voiced her pleasure that the digital privacy act mandates companies to notify customers of data breaches and allows for new penalties, but notes her office is still studying the bill. 

"We expect to be called to appear before the [Senate committee when it's referred for study] and that's the point at which we will provide our detailed analysis of the bill," Valerie Lawton, Office of the Privacy Commissioner of Canada spokeswoman, wrote in an email to CBC News.

The danger of 'trolls'

In the precedent-setting TekSavvy-Voltage case, Canadians were not only alerted during the court process but will benefit from the legal system's guiding hand throughout.

Justice Kevin Aalto took specific steps to protect Canadians from the type of harassment and fear-mongering tactics used south of the border.

In those cases, "copyright trolls" send out letters to people who are alleged to have illegally downloaded content, threatening to sue them in court for a hefty amount but offering to settle for several thousand dollars. If even a portion of the people pay, the company profits.

Judge Aalto acknowledged the rights of copyright holders, but made sure that innocent people are protected by vowing to keep these kinds of actions in check.

A case management judge must review the demand letter Voltage sends to alleged illegal downloaders. The letter must clearly state that the individual has not yet been found liable in court. That judge will also monitor any legal action taken by Voltage against the individuals.

He even suggested that, in the future, courts should punish companies by denying its attempt to get the names and addresses of alleged illegal downloaders if there's evidence the company used the court process with an "improper motive" of coercing payments out of people.

For Paul, the court-monitored process in his Canadian case is welcome. He acknowledges downloading movies in the past, but isn't sure whether they involved Voltage films because he doesn't backup his downloads folder. At the time, he also had roommates sharing his WiFi.

"I have literally no way of verifying whether it was my computer used to download that movie. Nor do they," said Paul. "That's a really tricky part of it."

And that's why courts play such a key role, he says.

A 'little game' with big consequences

In the U.S., legislators and consumer groups are struggling to stop mass copyright lawsuits targeting large groups of John and Jane Doe defendants.

"It's a small, little game in the grand scope of things, but it does affect a lot of people personally," says a U.S. blogger who runs the Die Troll Die website dedicated to helping advise those victimized by the so-called copyright trolls.

The blogger, who requested anonymity due to threats from copyright holders, said innocent people can get caught in the wide nets being cast.

"It scares a lot of people and the trolls know that," said the blogger. "And they use it to their advantage."

For example, he says, it might cost a company several hundred dollars to file a case in court, plus a few hours of a lawyer's time. Letters then get sent out to hundreds of people asking them to pay $5,000 to settle before the case reaches the court, or they will be sued for $150,000.

A number of people opt for the settlement, fearing the legal fees will be much more steep. Often, the company has no intention of even incurring the costs of taking individuals to court.

"Most Canadians would agree, we definitely don’t want that kind of system here," said OpenMedia's Christopher. "But if this digital privacy act goes through in its current form, it would mark a massive step backwards."

Christopher said OpenMedia.ca has heard from many Canadians frustrated with the proposed digital privacy act and hopes to rally them to put pressure on the government to change the proposed legislation. 

However, even if the legislation remains unchanged, Paul is confident that the internet will adapt.

"The internet is constantly changing and the way that people use it is constantly changing and there's nothing legislation can do to prevent that."