Bill C-59 (Historical)

National Security Act, 2017

An Act respecting national security matters

Part 1 enacts the National Security and Intelligence Review Agency Act, which establishes the National Security and Intelligence Review Agency and sets out its composition, mandate and powers. It repeals the provisions of the Canadian Security Intelligence Service Act establishing the Security Intelligence Review Committee and amends that Act and other Acts in order to transfer certain powers, duties and functions to the new Agency. It also makes related and consequential amendments to other Acts.
Part 1.‍1 enacts the Avoiding Complicity in Mistreatment by Foreign Entities Act to authorize the issuance of directions respecting the disclosure of and request for information that would result in a substantial risk of mistreatment of an individual by a foreign entity and the use of information that is likely to have been obtained as the result of mistreatment of an individual by a foreign entity.
Part 2 enacts the Intelligence Commissioner Act, which provides that the duties and functions of the Intelligence Commissioner are to review the conclusions on the basis of which certain authorizations are issued or amended, and determinations are made, under the Communications Security Establishment Act and the Canadian Security Intelligence Service Act and to approve those authorizations, amendments and determinations if those conclusions are reasonable. This Part also abolishes the position of the Commissioner of the Communications Security Establishment, provides for that Commissioner to become the Intelligence Commissioner, transfers the employees of the former Commissioner to the office of the new Commissioner and makes related and consequential amendments to other Acts.
Part 3 enacts the Communications Security Establishment Act, which establishes the Communications Security Establishment and, among other things, sets out the Establishment’s mandate as well as the regime for authorizing its activities. It also amends the National Defence Act and makes consequential amendments to other Acts.
Part 4 amends the Canadian Security Intelligence Service Act to
(a) add a preamble to that Act and provide a mechanism to enhance the accountability of the Canadian Security Intelligence Service;
(b) add new limits on the exercise of the Service’s power to reduce threats to the security of Canada including, in particular, by setting out a list of measures that may be authorized by the Federal Court;
(c) provide a justification, subject to certain limitations, for the commission of acts or omissions that would otherwise constitute offences;
(d) exempt employees of the Service and persons acting under their direction from liability for offences related to acts committed for the sole purpose of establishing or maintaining a covert identity;
(e) create a regime for the Service to collect, retain, query and exploit datasets in the course of performing its duties and functions;
(f) make amendments to the warrant regime that are related to datasets; and
(g) implement measures for the management of datasets.
Part 5 amends the Security of Canada Information Sharing Act to, among other things,
(a) emphasize that the Act addresses only the disclosure of information and not its collection or use;
(b) clarify the definition of “activity that undermines the security of Canada”;
(c) clarify that advocacy, protest, dissent and artistic expression are not activities that undermine the security of Canada unless they are carried on in conjunction with an activity that undermines the security of Canada;
(d) provide that a disclosure of information is authorized only if the disclosure will contribute to the carrying out by the recipient institution of its national security responsibilities and will not affect any person’s privacy interest more than reasonably necessary;
(e) require that information disclosed be accompanied by information about the accuracy of the disclosed information and the reliability of the manner in which it was obtained; and
(f) require that records be prepared and kept in respect of every disclosure of information and that every year a copy of every record prepared in the preceding year be provided to the National Security and Intelligence Review Agency.
Part 6 amends the Secure Air Travel Act to authorize the Minister of Public Safety and Emergency Preparedness to collect from air carriers and operators of aviation reservation systems, for the purpose of identifying listed persons, information about any individuals who are on board or expected to be on board an aircraft for any flight prescribed by regulation, and to exempt an air carrier from providing that information, or from the application of any provision of the regulations, in certain circumstances. It amends the Act to authorize that Minister to collect personal information from individuals for the purpose of issuing a unique identifier to them to assist with pre-flight verification of their identity. It also reverses the rule in relation to a deemed decision on an application for administrative recourse. Finally, it amends the Act to provide for certain other measures related to the collection, disclosure and destruction of information.
Part 7 amends the Criminal Code to, among other things,
(a) make certain procedural modifications to the terrorist listing regime under section 83.‍05, such as providing for a staggered ministerial review of listed entities and granting the Minister of Public Safety and Emergency Preparedness the authority to amend the names, including aliases, of listed entities;
(b) change the offence of advocating or promoting terrorism offences in general, in section 83.‍21, to one of counselling the commission of a terrorism offence, and make corresponding changes to the definition of terrorist propaganda;
(c) raise one of the thresholds for imposing a recognizance with conditions under section 83.‍3, and amend when that section is to be reviewed and, unless extended by Parliament, to cease to have effect;
(d) repeal sections 83.‍28 and 83.‍29 relating to an investigative hearing into a terrorism offence and repeal subsections 83.‍31(1) and (1.‍1), which require annual reports on such hearings;
(e) require the Attorney General of Canada to publish a report each year setting out the number of terrorism recognizances entered into under section 810.‍011 in the previous year; and
(f) authorize a court, in proceedings for recognizances under any of sections 83 and 810 to 810.‍2, to make orders for the protection of witnesses.
Part 8 amends the Youth Criminal Justice Act to, among other things, ensure that the protections that are afforded to young persons apply in respect of proceedings in relation to recognizance orders, including those related to terrorism, and give employees of a department or agency of the Government of Canada access to youth records, for the purpose of administering the Canadian Passport Order.
Part 9 requires that a comprehensive review of the provisions and operation of this enactment take place during the fourth year after section 168 of this enactment comes into force. If that section 168 and section 34 of Bill C-22, introduced in the 1st session of the 42nd Parliament and entitled the National Security and Intelligence Committee of Parliamentarians Act, come into force within one year of each other, the reviews required by those sections are to take place at the same time and are to be undertaken by the same committee or committees.

[Daniel Therrien]

It is not what our office is doing. You're perfectly right. Our role is to look at the sharing or disclosure of information and whether it was done lawfully. I think the new review agencies created under Bill C-59 will help, because they will look not only at questions of legality but at effectiveness of the programs. Your question as to whether tips are acted upon or information is acted upon has more to do with the effectiveness of the way in which the various agencies perform their mandates, so that may be.... I would need to look at the mandate of NSIRA. That may be part of its job, but the committee of parliamentarians, certainly, would have a mandate to look at questions of effectiveness of the agencies.

[Daniel Therrien]

We can do that.

However, as a practical matter, if you let Bill C-59 pursue its course—and perhaps, I would suggest, be inspired by some of what is found in part 4—and then translate it to any recommendations you would make to amend the act you are reviewing. I think that would be good.

[The Chair, Liberal, Wayne Easter]

Thank you.

What I'm trying to get at is that if things that are being done via Bill C-59 are important to moving ahead on money laundering and terrorism financing, which is our review, then they need to be done fairly quickly, because that committee will be starting clause-by-clause on that bill. If there are areas that you think we can deal with in our review, then drop us a note on the specifics and we'll have a look at it.

[Daniel Therrien]

There are two things I'm saying about Bill C-59. First, there are a number of oversight bodies overseeing FINTRAC. We, as one of the bodies, cannot legally share information that we collect in the course of our review with other review bodies. We're saying that it would be very helpful to having fully informed reviews by us and other review bodies if we were able to share our work and come up with more informed conclusions. That's one point.

The other point is the analogy with collection and retention rules by CSIS, which are in part 4 of Bill C-59. There is some analogy to FINTRAC and the PCMLTFA. Under part 4 of Bill C-59, CSIS can collect considerable information, much of which is about law-abiding citizens, as FINTRAC collects a lot of financial transaction information about law-abiding citizens. However, under part 4 of Bill C-59, there are mechanisms to ensure that the collected data is reviewed fairly promptly to determine whether it is of probative or investigative value, and that if it is not of investigative value, it must be discarded.

I think that's an interesting compromise. You have broad collection but screen it fairly promptly, leading to not unduly long retention of information regarding law-abiding citizens.

[The Chair, Liberal, Wayne Easter]

Before I turn to Mr. Kelly, you mentioned in your remarks, Mr. Therrien, Bill C-59. I took it that you might have thought there needed to be amendments to Bill C-59.

Is what you're talking about there related to issues relative to money laundering and terrorism financing, or was that other issues related to privacy with the new security agency?

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

I want to thank all our witnesses for the work you do for Canadians. I appreciate your expertise and your presence at the table today.

I would like to start first with Mr. Therrien. Thank you very much for your presentation. I'm going to be asking a couple of questions on what you've offered, but also, being from British Columbia, I have some specific cases. I'd also like to talk about...because these reviews happen every five years, and technology changes and whatnot.

First of all, you've made the suggestion that right now FINTRAC collects information on every financial transaction that it can possibly get a hold of, that it's allowed to under law, but perhaps there should be some proportionality applied.

Does technology, for example algorithms, allow for the risk-based assessments that you're talking about, or are you just talking about taking the current system and slowly scoping it into a different framework vis-à-vis Bill C-59?

[Daniel Therrien]

We aren't necessarily suggesting that the documents be destroyed within a short time frame. We are recommending a risk-based approach. A great deal of information is collected on a huge number of transactions, the vast majority of which relates to the financial transactions of law-abiding Canadians. That is the basis of the approach used to detect criminals or terrorists and is very similar to the procedure proposed in Bill C-51 and Bill C-59. It has merit, but the information has to be screened using numerous pieces of data to uncover threats and individuals who are security threats or criminals.

I am not calling the process into question, but it's helpful to keep some figures in mind. Over the past few years, the ratio of actionable disclosures to law enforcement or other organizations has been one for every 10,000 reports received. For every 10,000 reports received, only one disclosure is made to police, the Canada Revenue Agency, or security agencies. We found that a significant amount of information is collected but that people pose a security threat in a very small number of cases.

I'm not saying that the information should no longer be collected, but I am recommending that a risk-based approach be adopted, as the Canada Revenue Agency officials more or less suggested. A considerable amount of information can be gathered initially, but a risk-based approach—one that takes into account the usefulness of the information for forensic evidence purposes—can be applied. That could be one of the factors given consideration. However, a risk analysis should be conducted fairly early on to determine whether the information needs to be retained or not. It is possible that, for a variety of reasons, a certain number of reports would need to be retained for a long period of time. On the flip side, I think many other reports would need to be destroyed rather quickly, as proposed in Bill C-59.

Personally, I see similarities between the approach set out in Bill C-59, which proposes extensive data collection in order to identify the small number of people who pose a threat, and the collection of financial transaction information under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, in order to identify a small number of criminals who are laundering money or contributing to terrorist financing.

[Daniel Therrien]

In terms of review and oversight of this regime, there are some review mechanisms in place and others proposed in Bill C-59, but I would argue that there are still some gaps in terms of comprehensive oversight.

While some decisions are subject to statutory or judicial review by the federal courts, which is one form of oversight, by the courts, a decision by FINTRAC to disclose information is more likely to be challenged in the context of a proceeding involving a disclosure to an investigative body such as a law enforcement agency. In many cases, however, an individual whose information is disclosed by FINTRAC might never know the disclosure took place.

Bill C-59, if passed, would create a new expert review body, the national security and intelligence review agency, with broad jurisdiction to examine the activities of all departments and agencies involved in national security, which includes FINTRAC. In addition, the new National Security and Intelligence Committee of Parliamentarians will also have a role to produce well-informed and comprehensive reviews of the work of these agencies.

However, the NSIRA will not review all of FINTRAC's activities, given the latter's mandate to identify criminality related to money laundering, and the NSIRA's national security mandate. Its national security review might also be limited given that not all of FINTRAC's disclosures are within the federal family.

The OPC is another oversight mechanism. We have an important mandated role, as already examined, and insight on the privacy aspects, including 10 years of audit experience in this area. However, as we've said in the context of Bill C-59, we currently would not have the legal authority to work with other national security review bodies, such as the NSIRA, to co-operate and provide effective oversight in this area.

To summarize, I would recommend the following: one, that the purpose of our reviews under the PCMLTFA be modified to include advice or recommendations on proportionality; two, that they begin at least one year before every anticipated five-year review that Parliament must undertake; and three, with respect to any contemplated changes to the regulations, Finance Canada should be legally required to consult with my office on draft legislation and regulations with privacy implications, before they are tabled.

Thank you very much, and I look forward to your questions.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair.

I’d like to thank the members of the committee for the opportunity to appear before you today as part of your statutory review of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, or PCMLTFA.

We, of course, support Canada's efforts to combat money laundering and terrorist financing. However, the manner in which these efforts are undertaken must strike an appropriate balance between the need to combat such activities and respecting privacy rights of Canadians.

The most apparent privacy implication with this regime is that it casts a wide net capturing a great deal of information about law-abiding Canadians conducting financial transactions, with a view to uncovering threats to national security or incidents of money laundering.

In our previous parliamentary briefs on Bill C-51 and Bill C-59, we signalled concerns around information collection and sharing regimes in the context of national security.

Specifically, we have highlighted the need for rigorous legal standards around the collection and sharing of personal information, effective oversight, and minimization of risks to the privacy of law-abiding Canadians, in part through prudent retention and destruction practices.

As you are aware, subsection 72(2) of the PCMLTFA provides my office with a mandate to conduct biennial reviews of how FINTRAC protects information it receives or collects under this act. We can also conduct reviews under section 37 of the Privacy Act.

All of our audits have identified issues with FINTRAC receiving and retaining reports that do not meet legislative thresholds for reporting.

In 2014, the PCMLTFA was amended by Bill C-31 to add subsection 54(2), which requires that FINTRAC destroy information in its holdings that was not required to be reported.

Although FINTRAC has implemented measures to validate incoming reports, a significant improvement, we continue to identify information in FINTRAC databases that did not meet thresholds and should not have been retained.

Also, we have generally found FINTRAC to have a comprehensive approach to security, including controls to safeguard personal information. Our most recent audit did identify governance issues between FINTRAC and Shared Services Canada, which FINTRAC has committed to addressing.

Beyond these issues, which we are mandated to review under the PCMLTFA, our principal concern, based on our experience reviewing FINTRAC over the past 10 years, relates to the lack of proportionality of the regime. Disclosures to law enforcement and other investigative agencies made in a given fiscal year represent a very small number when compared with the information received during that same time frame. For every 10,000 reports received, one disclosure is made.

Information received is also retained for long periods. FINTRAC's retention of undisclosed reports increased from five to 10 years in 2007.

Even if one accepts that sharing financial transaction data related to law-abiding citizens may lead to the identification of threats of money laundering or terrorist financing activities, once that information is analyzed and leads to the conclusion that someone is not a threat, it should no longer be retained.

More broadly, we have noted a trend to broaden the regime over the years, and we note the Department of Finance Canada's vision of moving towards a holistic information collection scheme, which would create an environment supporting increased analytics and information sharing. We have already seen discussion about lowering existing thresholds for reporting, which could be done through regulations without parliamentary approval. In the consultation paper, the Department of Finance Canada also suggests increasing the number of reporting agencies and establishing a new model for engagement of the private sector.

While I appreciate that a holistic approach to the collection and sharing of information might be useful to identify threats, what is proposed, unless appropriate privacy safeguards are adopted, would further exacerbate our concerns with proportionality.

Instead, I would suggest that a risk-based approach be adopted in order to minimize the risk of over-collecting and retaining the financial and personal information of law-abiding citizens. Under such an approach, FINTRAC, based on a thorough risk-based analysis of its data, would develop criteria to limit collection, sharing, and retention to only situations likely to represent potential manifestations of terrorist financing or money laundering.

We realize this may be challenging, but as privacy experts, we at the OPC believe we can play a role in the assessment of these factors, which leads me to this: currently our review mandate, under the PCMLTFA and the Privacy Act, is limited to ensuring that these statutes and regulations, as enacted, including monetary thresholds for collection, are respected.

We think a more useful contribution would be to provide advice, after review, on amendments that could be made, to either the statutes or the regulations or the practices of FINTRAC, to ensure greater proportionality, including the assessment of risk factors that might govern information collection, sharing, and retention.

The government is recommending that the PCMLTFA be amended to provide that the reviews we currently undertake every two years under section 72 now occur every four years. We agree in part, but we would recommend a change of purpose for these reviews.

First, we would recommend that the purpose of our reviews under the act be modified to include advice or recommendations on proportionality, as just mentioned.

Second, they would begin at least one year before every anticipated five-year review that Parliament must undertake. The OPC would continue to conduct compliance reviews under section 37 of the Privacy Act, which would not need to be amended. As it relates to proportionality, the committee may wish to consider part 4 of Bill C-59, currently before Parliament, concerning CSIS datasets and their retention, which might be instructive.

Under that model, CSIS must clean data promptly—that is, within 90 days—and can retain Canadian datasets only if the Federal Court is satisfied that doing so is likely to assist in the performance of CSIS's mandate, including the detection of threats to the national security of Canada. In addition, with respect to any contemplated changes to reduce existing thresholds through regulations, which would also affect proportionality, I would reiterate my recommendation in the context of Privacy Act reform, that government institutions should be legally required to consult with my office on draft legislation and regulations with privacy implications before they are tabled.

My written statement now goes into questions of oversight. Do I have time?

[John Davies]

The Office of the Privacy Commissioner looks at FINTRAC every two years. That's one.

The big issue for the Privacy Commissioner is whether the information FINTRAC is collecting is relevant. There is commentary on that.

I would look to the new national security intelligence committee of parliamentarians proposed in C-59, the integrated review body. It will get more into efficacy reviews on the impact of that kind of sharing. That's probably something more downstream.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

I have one last question. Do you have any concerns about privacy or access to information powers that you have right now? What would the commissioners of either of those organizations say with regard to Bill C-59 in your organization? Have you no concerns?

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

In your opening remarks I heard you say that a concern you had was that there was no referral back to your organization should NSIRA make a determination that it does not cross or meet whatever their threshold is for a national security issue. Would you be advocating to request a legislative change in Bill C-59 to make sure that issue is brought back to your organization? I'm assuming from your comments that when an investigation does cross that national security threshold, in your organization's opinion, and you send it on—or will be sending it on to NSIRA, in this particular case—that investigation would cease in your organization. Is that correct?

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Are you satisfied that, with the security level you currently have or will have if Bill C-59 is enacted, you will have access to enough intelligence on a national security matter to cross-reference in order to know if you have an investigation ongoing whether it might involve national security, or does the information become self-evident as you conduct the investigations?

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Thank you, Mr. Chair.

My questions for you are going to be very pointed about the Bill C-59 legislation. As it exists right now, if you find something as you are doing an investigation, from a complaint that's sourced either internally or from outside, and it does become the opinion of CRCC that it's a national security matter, currently it goes nowhere. Is that correct?

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

I have one final question. I might then give Mr. Picard some speaking time since it is his birthday.

My question pertains to the Canada Border Services Agency. There is a debate going on right now that you are certainly aware of. There is always some tension between police authority and the territory a certain number of kilometres around customs areas. There have been some incidents, in Windsor in particular. As I recall, someone died following a police chase.

One of the questions raised in the debate of Bill C-59 is the review or surveillance of the Canada Border Services Agency.

Does your mandate include the work the CBSA does in co-operation with the RCMP or is it once again a question of following the trail, national security issues, and information sharing?