Information & Ethics committee  I generally echo those comments. At least from a SCISA perspective, for the 17 institutions that are listed—and for many more, because if put on the disclosing end, it could be any institution that is permitted under SCISA to disclose—I think there needs to be a single body that looks at all of that.

Information & Ethics committee  The concern here is that anything set out in the act in terms of the use of information can be covered off within the act. I think the main concern about the Privacy Act would be about further uses and disclosure, for which there aren't any restrictions in the law. You may have something that's disclosed legitimately in the interests of protecting national security, but it could be used for any other collateral purpose.

Information & Ethics committee  I won't speculate on how it came to be, but certainly from CBA's perspective, it could be worked on. It could be made a lot better in a way that would much better protect the privacy rights of Canadians.

Information & Ethics committee  I guess that there is some vetting and that we're not passing on information that is rumours or hearsay. We're not repeating or forwarding fake news. We're doing some analysis and some checking on our own to make sure we're reasonably sure this is accurate information.

Information & Ethics committee  I think it's particularly useful if it is restricted to just the head of the particular institution, and only that. The head of the institution has access to the information and makes the call.

Information & Ethics committee  Yes, we like the Privacy Act and the controls that are in place there, and I guess there seems to be a bit of confusion about how the two interrelate. The Privacy Act would generally be presumed to govern, but the Privacy Act has explicit exceptions for situations in which another law is applicable.

Information & Ethics committee  Well, I don't think it is; it's of these 10 or so factors.

Information & Ethics committee  I don't think we have a particular issue with the scope of that section as drafted. To your question about it being non-exhaustive, I think it would be much more problematic if it were non-exhaustive, if it was just “including the following things” as an open-ended definition—

Information & Ethics committee  I want to make sure I understand your question. Are you asking if it's desirable that we have clear agreements with each of these international partners?

Information & Ethics committee  Yes, I would think so. We may be a smaller player within the Five Eyes in terms of our intelligence, but I don't think that means we lack any bargaining power and I don't think it means that we sign on to whatever the largest members of Five Eyes do and agree to all those procedures.

Information & Ethics committee  Thank you very much for your questions. To your first question, on whether there are too many, I think part of the issue is that we don't really know. That's because for a number of these listed institutions, it's not obvious—to me, anyway—exactly what their responsibilities and authorities that relate to national security are.

Information & Ethics committee  I guess what we're really talking about is accuracy. There are general provisions right now in the Privacy Act for all government departments that any information they're collecting, using, or disclosing should be reasonably accurate and that they should take steps to ensure that it is.

Information & Ethics committee  Well, definitely, in accordance with our position, we think those records should definitely exist, because without those records it's very difficult for anybody to have any kind of oversight to check up on exactly how the law is being implemented and what information is being shared.

Information & Ethics committee  Well, I can say we haven't done a full budgeting workup of what that would look like or those costs, so I'm not in a position to tell you today that it's going to require so many employees or that there's going to be an annual budget. What I can say is that I think for that to work, a couple of things have to happen.

Information & Ethics committee  I certainly think that is a mechanism that might help. I think, as a country, we wouldn't want information shared indirectly with countries that we wouldn't otherwise have shared with directly.