Bill C-59 (Historical)

National Security Act, 2017

An Act respecting national security matters

Part 1 enacts the National Security and Intelligence Review Agency Act, which establishes the National Security and Intelligence Review Agency and sets out its composition, mandate and powers. It repeals the provisions of the Canadian Security Intelligence Service Act establishing the Security Intelligence Review Committee and amends that Act and other Acts in order to transfer certain powers, duties and functions to the new Agency. It also makes related and consequential amendments to other Acts.
Part 1.‍1 enacts the Avoiding Complicity in Mistreatment by Foreign Entities Act to authorize the issuance of directions respecting the disclosure of and request for information that would result in a substantial risk of mistreatment of an individual by a foreign entity and the use of information that is likely to have been obtained as the result of mistreatment of an individual by a foreign entity.
Part 2 enacts the Intelligence Commissioner Act, which provides that the duties and functions of the Intelligence Commissioner are to review the conclusions on the basis of which certain authorizations are issued or amended, and determinations are made, under the Communications Security Establishment Act and the Canadian Security Intelligence Service Act and to approve those authorizations, amendments and determinations if those conclusions are reasonable. This Part also abolishes the position of the Commissioner of the Communications Security Establishment, provides for that Commissioner to become the Intelligence Commissioner, transfers the employees of the former Commissioner to the office of the new Commissioner and makes related and consequential amendments to other Acts.
Part 3 enacts the Communications Security Establishment Act, which establishes the Communications Security Establishment and, among other things, sets out the Establishment’s mandate as well as the regime for authorizing its activities. It also amends the National Defence Act and makes consequential amendments to other Acts.
Part 4 amends the Canadian Security Intelligence Service Act to
(a) add a preamble to that Act and provide a mechanism to enhance the accountability of the Canadian Security Intelligence Service;
(b) add new limits on the exercise of the Service’s power to reduce threats to the security of Canada including, in particular, by setting out a list of measures that may be authorized by the Federal Court;
(c) provide a justification, subject to certain limitations, for the commission of acts or omissions that would otherwise constitute offences;
(d) exempt employees of the Service and persons acting under their direction from liability for offences related to acts committed for the sole purpose of establishing or maintaining a covert identity;
(e) create a regime for the Service to collect, retain, query and exploit datasets in the course of performing its duties and functions;
(f) make amendments to the warrant regime that are related to datasets; and
(g) implement measures for the management of datasets.
Part 5 amends the Security of Canada Information Sharing Act to, among other things,
(a) emphasize that the Act addresses only the disclosure of information and not its collection or use;
(b) clarify the definition of “activity that undermines the security of Canada”;
(c) clarify that advocacy, protest, dissent and artistic expression are not activities that undermine the security of Canada unless they are carried on in conjunction with an activity that undermines the security of Canada;
(d) provide that a disclosure of information is authorized only if the disclosure will contribute to the carrying out by the recipient institution of its national security responsibilities and will not affect any person’s privacy interest more than reasonably necessary;
(e) require that information disclosed be accompanied by information about the accuracy of the disclosed information and the reliability of the manner in which it was obtained; and
(f) require that records be prepared and kept in respect of every disclosure of information and that every year a copy of every record prepared in the preceding year be provided to the National Security and Intelligence Review Agency.
Part 6 amends the Secure Air Travel Act to authorize the Minister of Public Safety and Emergency Preparedness to collect from air carriers and operators of aviation reservation systems, for the purpose of identifying listed persons, information about any individuals who are on board or expected to be on board an aircraft for any flight prescribed by regulation, and to exempt an air carrier from providing that information, or from the application of any provision of the regulations, in certain circumstances. It amends the Act to authorize that Minister to collect personal information from individuals for the purpose of issuing a unique identifier to them to assist with pre-flight verification of their identity. It also reverses the rule in relation to a deemed decision on an application for administrative recourse. Finally, it amends the Act to provide for certain other measures related to the collection, disclosure and destruction of information.
Part 7 amends the Criminal Code to, among other things,
(a) make certain procedural modifications to the terrorist listing regime under section 83.‍05, such as providing for a staggered ministerial review of listed entities and granting the Minister of Public Safety and Emergency Preparedness the authority to amend the names, including aliases, of listed entities;
(b) change the offence of advocating or promoting terrorism offences in general, in section 83.‍21, to one of counselling the commission of a terrorism offence, and make corresponding changes to the definition of terrorist propaganda;
(c) raise one of the thresholds for imposing a recognizance with conditions under section 83.‍3, and amend when that section is to be reviewed and, unless extended by Parliament, to cease to have effect;
(d) repeal sections 83.‍28 and 83.‍29 relating to an investigative hearing into a terrorism offence and repeal subsections 83.‍31(1) and (1.‍1), which require annual reports on such hearings;
(e) require the Attorney General of Canada to publish a report each year setting out the number of terrorism recognizances entered into under section 810.‍011 in the previous year; and
(f) authorize a court, in proceedings for recognizances under any of sections 83 and 810 to 810.‍2, to make orders for the protection of witnesses.
Part 8 amends the Youth Criminal Justice Act to, among other things, ensure that the protections that are afforded to young persons apply in respect of proceedings in relation to recognizance orders, including those related to terrorism, and give employees of a department or agency of the Government of Canada access to youth records, for the purpose of administering the Canadian Passport Order.
Part 9 requires that a comprehensive review of the provisions and operation of this enactment take place during the fourth year after section 168 of this enactment comes into force. If that section 168 and section 34 of Bill C-22, introduced in the 1st session of the 42nd Parliament and entitled the National Security and Intelligence Committee of Parliamentarians Act, come into force within one year of each other, the reviews required by those sections are to take place at the same time and are to be undertaken by the same committee or committees.

[Lex Gill, Advocate, National Security Program, Canadian Civil Liberties Association]

Mr. Chair, another deeply problematic aspect of Bill C-51 that has not been touched are changes to the Immigration and Refugee Protection Act that undid important protections for named persons in security certificate proceedings. Bill C-51 limited the requirement for disclosure of relevant information to special advocates and introduced a series of procedural barriers which further disadvantaged the rights of the named person.

In our legal challenge, CCLA has argued that these amendments are an unconstitutional violation of the section 7 guarantee to a hearing before an independent and impartial tribunal. Our Supreme Court has affirmed that the individual named in the security certificate “must be given an opportunity to know the case to meet, and an opportunity to meet the case”, an impossible exercise in the absence of a coherent legal framework for full disclosure.

This committee recognized as much in May 2017 when it recommended amending IRPA in order to give special advocates full access to complete security certificate files. We urge that Bill C-59 be amended to correct this issue.

We move now to the new elements of the new national security landscape that Bill C-59 has introduced. Our written submission will address a much wider range of issues in relation to the CSE Act, but we would like to highlight two parts today.

First, the proposed active and defensive cyber-operations aspects of the CSE's mandate essentially allow the establishment to engage in secret and largely unconstrained state-sponsored hacking and disruption. The limitation of not directing these activities at Canadian infrastructure is clearly inadequate given the inherently interconnected nature of the digital ecosystem. Such activities are also bound to impact the privacy expression and security interests of Canadians and persons in Canada, and may threaten the integrity of communications tools such as encryption and anonymity software that are vital for the protection of human rights in the digital age.

In the case of CSIS's disruption powers, which are in some ways analogous to these new aspects of CSE's mandate, the government has set out a complex framework for prior judicial authorization and a longer list of prohibited activities. While we do not concede the adequacy of that framework, it is notable that, in contrast, CSE's cyber-operations activities involve no meaningful privacy protections, require only secret ministerial authorization, and involve only after-the-fact review.

Second, while the majority of CSE's activities cannot be directed at Canadians or persons in Canada, this is an inadequate safeguard against CSE's overreach in the face of unselected bulk collection. Bill C-59 exacerbates this privacy risk by creating a series of exceptions for the collection of Canadian data, including one which allows its acquisition, use, analysis, retention, and disclosure, so long as it is publicly available.

This definition is so broad that it plausibly includes information in which individuals have a strong privacy interest, and potentially allows for the collection of private data obtained by hacks, leaks, or other illicit means. Furthermore, it may encourage the creation of grey markets for data that would otherwise never have been available to government—a client with deep pockets.

The government has failed to demonstrate why this exception, as worded, is necessary or proportionate, or what risk it is meant to mitigate in the first place.

[Cara Zwibel, Acting General Counsel, Canadian Civil Liberties Association]

Yes, my apologies to the committee for coming in late.

Thank you, Mr. Chair, and members of the committee. The Canadian Civil Liberties Association appreciates the opportunity to make submissions with respect to Bill C-59.

CCLA was a vocal critic of the Anti-terrorism Act passed in the last Parliament and initiated a constitutional challenge to a number of aspects of that law, which remains in abeyance pending consideration of Bill C-59. While this new bill has partially addressed some of Bill C-51's constitutional deficits, it has certainly not resolved all of them. The bill also grants our national security agencies a number of extraordinary new powers that have not been adequately justified and that do give rise to very real civil liberties concerns. The government has framed this bill as being about protecting both national security and rights, and CCLA supports both of these goals, and our comments and recommendations are made in that spirit.

We will begin by identifying the positive changes Bill C-59 makes to former Bill C-51, outline the issues that remain unaddressed, and finally, set out the new problems created by Bill C-59.

Since we certainly can't cover everything in 10 minutes, we'll also be filing a more detailed written submission. Beginning with the items that Bill C-59 has improved, we are reassured by the government's amendments to the terrorist speech offences. Without these amendments, the provisions violate sections 2 and 7 of the charter and may also undermine community-based deradicalization efforts. While the amended offence is arguably unnecessary, given the large number of pre-existing terrorism offences in the Criminal Code, counselling offences are a known quantity in the criminal law and follow a clear legal framework. However, the language of “terrorism offence” in the amendment would be better changed to “terrorist activity”, which is a defined term in the code.

On information sharing, Bill C-59 adds new proportionality and reporting requirements, which is a distinct improvement over the largely unaccountable system introduced in Bill C-51. However, the definition of “threats to the security of Canada” that triggers information disclosure remains unduly broad and circular. It is not clear why this definition is so much broader than the one included in the CSIS Act, and we remain concerned that constitutionally protected acts of advocacy, protest, dissent, or artistic expression, particularly by environmental and indigenous activists, will continue to be swept up in the process.

One of the most controversial aspects of Bill C-51 was the threat reduction powers granted to CSIS and the accompanying warrant provisions that appeared to allow for judicially sanctioned charter breaches. We do not doubt that there are times when CSIS may see an opportunity to take action to reduce the threat to the security of Canada. What is unclear is why this goal cannot be achieved through better communication and co-operation between CSIS, the RCMP, and other law enforcement bodies. This is a very significant shift in mandate that appears to ignore the historical reasons for separating law enforcement and intelligence in the first place, and there has been no convincing case made for why this shift is necessary.

Moreover, the legal framework for the exercise of these powers established in Bill C-51 was deeply problematic and clearly unconstitutional in our view. The scheme as modified by Bill C-59 is an improvement. It establishes clearer contours around what actions are permitted and what is prohibited, and the warrant scheme appears to be intended to ensure that the charter rights of individuals are respected. If CSIS is to continue to have these powers there are a number of ways in which we believe the scheme should be improved.

First, the requirement for CSIS to consult with other federal departments or agencies to see if they can reduce the threat should be amended to clarify that if a law enforcement body is better placed to do so, CSIS should not pursue threat reduction. Second, the list of measures set out in proposed section 21.1(1.1) only require a warrant where CSIS determines that they may violate the law or limit a charter right. A warrant should be required in any case where these measures will be pursued by CSIS. It is vital that the determination of whether a law is being violated or a charter right limited not be left solely to CSIS.

Finally, the new national security and intelligence review agency should be required to report on the number of warrants issued under proposed section 21.1, and the number of requests that were refused. SIRC does so now, and reducing reporting requirements is not consistent with Bill C-59's stated goal of enhancing accountability.

Some of the most problematic aspects of Bill C-51 received only cosmetic improvement or none at all. As this committee is aware, the passenger protect program continues to raise serious constitutional problems. The process by which individuals are placed on the list remains opaque, and proposed redress mechanisms are inadequate. Bill C-59 also fails to correct the flawed appeals procedure, which parallels the system in place for security certificates prior to the Supreme Court's Charkaoui decision in 2007.

While the no-fly list is undoubtedly different from being named in a security certificate, both have the ability to substantially interfere with the constitutionally protected rights and liberties of an individual and to seriously impact their lives and families. The current process allows the use of hearsay and secret evidence, without access to a special advocate able to test that evidence or to represent the interests of the listed person.

This committee recognized these profound issues in May when it recommended the use of special advocates in no-fly list proceedings, among other safeguards, and yet Bill C-59 does not address these concerns. It should do so by adopting this committee's initial recommendation. We would note that the terrorist entities list raised similar issues.

[Hayley McNorton, Research Assistant, Department of Political Science, Royal Military College of Canada, As an Individual]

Mr. Chair, to enhance intelligence accountability, we have suggested five recommendations.

The first is that Bill C-59 does not describe if and how NSIRA, which is the national security and intelligence review agency, will support the National Security and Intelligence Committee of Parliamentarians. In the existing system, the committee of parliamentarians could apply to OCSE, the office of the CSE commissioner, the Security Intelligence Review Committee, or the Civilian Review and Complaints Commission, if they needed additional assistance. However, if Bill C-59 is passed, it will only apply to NSIRA or the CRCC. In regard to this recommendation, we consider how much support NSIRA will give the committee of parliamentarians and what kind of support they will give the committee of parliamentarians.

The second suggestion is that the Civilian Review and Complaints Commission should retain its ability to review issues and investigate complaints related to national security. The existing legislation giving NSIRA the ability to review matters related to national security issues goes against the recommendations from the O'Connor commission. Also, in the end, it would give the CRCC undue influence over what NSIRA reviews in regard to national security, because NSIRA will remain the principal point of contact for the complaints and reviews, which it would then refer to NSIRA.

The third recommendation is that NSIRA should have the ability to conduct joint investigations with provincial police and complaint bodies. The CRCC has this power as well. Basically, a lot of the federal intelligence and security agencies work with provincial police bodies, so that is also a consideration.

NSIRA should develop and establish standards for intelligence accountability.

Last, NSIRA should take reasonable steps to co-operate with the committee of parliamentarians to avoid unnecessary duplication of work in relation to the fulfillment of their respective mandates.

[Daniel Therrien]

On balance, Bill C-59 makes important improvements, but the recommendations I am making, particularly on the necessity threshold and legal safeguards for retention or destruction, are necessary to achieve the right balance.

[Peter Fragiskatos, Liberal, London North Centre, ON]

Thank you very much.

I have one final question. You wrote an overview of C-51 in The Globe and Mail shortly after the bill was released. You said, “In a country governed by the rule of law, it should not be left for national security and other government agencies to determine the limits of their own powers.”

On balance, are you satisfied that Bill C-59 has addressed this concern?

[Daniel Therrien]

Sure.

Yes, the application of the Privacy Act would be part of this, as would the lessons learned in the application of the Privacy Act otherwise in government to national security agencies. I think it's important that national security agencies be covered by specific rules, as in Bill C-59, but also by the legal regime of the Privacy Act, because these are emanations of the state, and as with all emanations of the state, they should be covered to the general rules applicable through the Privacy Act.

As an example of how we might add value, about two years ago we reviewed an incident involving the unfortunate but unlawful disclosure of metadata by the CSE to the Five Eyes. We played a very specific role. We did not look at all of the situation, but we looked at sufficient parts of it to examine the importance of metadata to privacy. We were able to look at the deficiencies, make recommendations on how to improve things, and play a public education role to make sure that the public was informed of the importance of metadata for privacy protection. That's something we added.

[Peter Fragiskatos, Liberal, London North Centre, ON]

Thank you very much, Mr. Chair, and thank you for being here today, Mr. Therrien.

I have a question about the connection between speech and privacy. I think you would agree that free speech and the right to it and to privacy enjoy a very intimate and indeed interdependent connection. Bill C-59 would replace one of the most controversial features of Bill C-51, the advocating of terrorism offences in general, with a more traditional offence, that of counselling specific terrorism offences.

We heard just the other day from Professor Stephanie Carvin, who in a piece for The Globe and Mail, wrote:

This better respects freedom of expression while still recognizing that much speech — including terrorist recruitment and instruction — is a reasonable target for criminalization.

Can you comment on this change in Bill C-59 and what you make of it from a privacy perspective?

[Daniel Therrien]

The 90-day period in Bill C-59 applies to the specific situation of the collection of datasets by CSIS. In a model where it's conceivable that more information may be required at the front end, but an exercise is required to funnel this to less information at some point, it's important that this period of analysis not be too long so as to give time to security agencies to do the analysis they need to do.

Ninety days strikes me as a very reasonable period. Should it be 90 days throughout regardless of whether it's CSIS, CSC, or others? We would have to look at it, but 90 days is a good rule of thumb.

[Daniel Therrien]

The best example would be, again, that of travellers. The information about travellers, many of whom are not a risk to national security, may be relevant and may contribute to the mandate of the receiving agency, to use the words of the new section 5, because in the mass of travellers there might be some who are a threat. To have information on a more permissive relevancy or contribution standard may be acceptable at the front end. However, when that information is then received and analyzed by the national security agency and the agency determines that the individual is not a threat, on what basis should the information be used and, moreover, retained by the agency? The retention of information about 99.9% of the travellers who are not a threat is not necessary to its work, to its mandate.

In looking at Bill C-59 as a whole with all of its parts, I'm struck by the fact that parts 3 and 4 have essentially the standards. I understand that relevance and necessity are somewhat esoteric notions, but in parts 3 and 4, the government and you as parliamentarians are seized with a bill that recognizes that there is a need for the higher necessity threshold in some circumstances.

CSIS and the CSE will not be able to use and exploit the personal information of individuals unless it meets a necessity test. If it's good for parts 3 and 4, I'm saying it should be good for part 5.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Would you see a change in the mandate of your organization with the passage of Bill C-59? If so, would you require the allocation of more resources to manage those changes?

[Daniel Therrien]

Yes, there is a risk, but I think it is being managed properly, more or less.

The definition could probably be narrower but then national security agencies, such as CSIS, would be deprived of the information they need for their work. However, there is a risk. How can the risk be reduced? The answer is through independent and effective review mechanisms.

The part of Bill C-59 that deals with CSIS has a number of filters exercised by independent members of the executive of the government and the Canadian Security Intelligence Service based on high standards, including necessity. Overall, I think it's a fair balance.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Mr. Chair.

Mr. Therrien, I want to thank you and your team for being with us today.

My question has to do with the Canada Border Services Agency, or CBSA for short.

On the one hand, should the agency have an oversight body? It isn't the only organization that Bill C-59 excludes.

On the other hand, should we broaden the scope of the bill to include those organizations in national security matters?

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

You were actually very critical of Bill C-51 at the time. Now, you are not satisfied with Bill C-59. You consider the collection of information to be acceptable and see it as normal. However, you have concerns about Bill C-59's purpose. That's what you said this morning.

[Daniel Therrien]

I start my analysis with the need to have good, clear, sufficiently high legal standards, including thresholds. That's where the issue of relevance for contributing to the mandate or being necessary comes in, so there are substantive legal safeguards.

The second element of well-balanced national security legislation requires strong, independent, effective review. On the substantive legal safeguards side, I accept that to apply the necessity test may pose problems for disclosing institutions, which is the main point the government made in responding to the ethics committee, and which may have been a contributing factor to your committee when you suggested a dual threshold.

I accept that a threshold lower than necessity helps disclosing institutions do a difficult task while having safeguards. However, receiving institutions—essentially national security agencies—know very well what their mandate is and what they need to do their job. There, the necessity threshold, which is the international norm, should apply fully.

That's the main substantive recommendation I'm making, which is again where this committee was at not long ago.

The second substantive rule is as follows. If there is a difference between the thresholds applicable to disclosing and receiving institutions which would be the result of a dual threshold, it's easier for disclosing institutions to disclose, but the threshold for receivers is higher. Point one is, what do we do about this gap, if the receiving institution has received something that is not necessary?

Point two is, if the receiving institution has received information about a law-abiding citizen—travellers are the best example—to identify in the mass of travellers the extremely few who may pose a threat to national security, there should be legal rules to require the receiving institution to get rid of the information, to destroy the information, to no longer retain the information if there's a gap between the two thresholds, or if, in relation to a given individual, the analysis leads to the conclusion that the person is not a threat and therefore that their information should not sit in the records of CSIS or the CSE or the intelligence apparatus. These are the substantive rules.

In terms of effective review, it is clear that the creation of the new NSIRA is an important improvement. The fact that it will be able to share information with the committee of parliamentarians creates a good step in the right direction, in that you have integrated review applicable to all departments—not only three as at the current time—and you have elected officials and experts who can talk to one another and reach a well-informed decision.

What we think we can bring to the picture—and we're not in the picture, at least not completely—with Bill C-59 is that the lifeblood, la matière première, the main tool that national security agencies have to do their job is information, and that includes personal information. We're the experts in how to deal with personal information in a way that respects privacy rights. We're not saying that NSIRA would be without any knowledge of the relevant issues, but there is an issue of core importance to the work of national security agencies, that of privacy, where we're the experts, and we think we can add value to the rest of the architecture.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair.

Mr. Chair and members of the committee, I am here this morning with Patricia Kosseim, who is our general counsel, and Lara Ives, who is the director general of audit and review.

Thank you for the invitation to discuss Bill C-59.

As you know, Bill C-59 introduces a wide range of measures intended to strengthen Canada's national security framework in a manner that safeguards the rights and freedoms of Canadians. On the whole, I find it represents a step in the right direction, but as other commentators have noted, its weakest part is the Security of Canada Information Sharing Act, or SCISA, which contains provisions related to information sharing and privacy. Professor Forcese, for instance, gave these sections a failing grade. I was therefore glad to hear Minister Goodale last week say that SCISA was probably the part most deserving of scrutiny. I hope your study will result in much-needed improvements to these rules.

In previous parliamentary briefs, I highlighted the need for rigorous legal standards around the collection and sharing of personal information, effective oversight, and minimization of risks to the privacy of ordinary law-abiding Canadians, particularly through privacy-sensitive retention and destruction practices. Specifically, I indicated that the law should prescribe two things essentially, which are useful to bear in mind. First is clear and reasonable standards for the sharing, collection, use and retention of personal information”, so substantive rules. Second is that compliance with these standards should be subject to independent and effective review mechanisms.

It is with this analysis in mind that I offer the following comments and recommendations. While I will focus in my remarks on SCISA, this analysis, looking at two types of issues, is also relevant for other parts of Bill C-59, including parts 3 and 4. The full list of our recommendations is attached to this statement.

Bill C-59 would create a new expert review body, the NSIRA, with broad jurisdiction to examine the activities of all departments and agencies involved in national security. Recently, Parliament also created, through Bill C-22, a new National Security and Intelligence Committee of Parliamentarians. Both of these bodies will be able to share confidential information and generally co-operate so as to produce well-informed and comprehensive reviews that reflect considerations both by experts and by elected officials.

These developments are most welcome, but they are, in my view, clearly insufficient. In my view, effective review of national security activities must include both parliamentary and expert review, and the latter must include both national security and privacy experts. Why privacy experts? Because the work of national security agencies depends in large part on personal information. It is what they call their “lifeblood”. The OPC is the federal centre of expertise in privacy and personal data protection. Canadians are concerned that anti-terrorism efforts in government not unduly impede their privacy rights, and they expect my office to play a role in ensuring that balance.

Bill C-59 is oddly silent on the role of my office. It does not amend the Privacy Act, so my existing authorities appear to be untouched. The only body with explicit authority to play a role in relation to part 5, the renamed SCIDA, or security of canada information disclosure act, is the NSIRA, the national security and intelligence review agency.

The ethics committee, in its study of SCISA, has already noted the ambiguity in the interplay between that act and the Privacy Act. It has called for amendments to clarify that the Privacy Act continues to apply to all personal information disclosed pursuant to SCISA. I have provided to your committee amendments that would confirm the application of the Privacy Act and the OPC's role, which I am told the government wants to maintain.

However, there is no ambiguity on whether my office would be able, with Bill C-59, to share confidential information with the NSIRA and the new committee of parliamentarians. We would not have that authority, and actually we would be prohibited by existing provisions in the Privacy Act from sharing such information.

This means that the comprehensive review process offered in Bill C-59, as a fundamental element to bring balance between security and respect for rights, would stop short of the objective by leaving privacy experts out of integrated review. I am at a loss to understand why. If the fear is of duplication between our work and that of other review bodies, I would gladly explain through the question period how bringing the OPC firmly within the family of review bodies would not only bring required expertise but would actually enhance efficiency and reduce overlap.

When Bill C-51 enacted the Security of Canada Information Sharing Act, known as SCISA, I indicated that among my concerns was the fact that the relevance standard for sharing was set too low, and that there was an absence of clear data retention and recordkeeping requirements and a lack of information-sharing agreements and privacy impact assessments.

The relevance test is too permissive because it casts too wide a net and creates undue risks for ordinary citizens who pose no threat to national security. The government seems to recognize that a relevance standard does not sufficiently protect privacy because it is suggesting changes to section 5 of SCISA.

In its response to the Standing Committee on Access to Information, Privacy and Ethics, the government said the following:

The key issue regarding the threshold is the need to establish specific decision making parameters for the discloser of information that will protect individual privacy but not cause undue delays in the information sharing process.

I agree with that assessment. The proposed new section 5, particularly paragraph 5(1)(b), incorporates some aspects of a necessity threshold but falls short of adopting what officials refer to as “strict necessity”.

In order to adequately protect privacy rights, under new section 5, this limited progress in increasing the threshold for disclosure would have to be accompanied by more complete changes to the standard applicable to receiving institutions, in other words, the security agencies receiving the information in question.

Information sharing involves two parties and, to protect rights, rules are also required for receiving institutions. If relevance is not adequate for disclosing institutions, it is also inadequate, even more so, for receiving agencies.

And the delay considerations that may apply to disclosure affect receiving departments very differently. These institutions are perfectly capable of applying the classic, internationally established necessity test, and should be required to do so.

We understand that the government intention is for receiving institutions to continue to be governed by the Privacy Act, or their specific enabling legislation where applicable. The current Privacy Act threshold is relevance.

As your committee recommended in its May 2017 report on Canada's national security framework, we also recommend that a dual threshold be adopted for information sharing—that set out in amended section 5 for disclosing institutions, and that of necessity and proportionality for receiving institutions.

Even if one accepts that government sharing of information related to law-abiding citizens may lead to the identification of new threats to national security, once that information is analyzed and leads to the conclusion that someone is not a threat, it should no longer be retained. Otherwise national security agencies will be able to keep a profile on all of us.

This is consistent with the conclusions of our review of the Canada Border Services Agency's scenario-based targeting initiative, summarized in my latest annual report to Parliament, and it is one of the principles upheld by the European Court of Justice in the passenger name and record case, decided in July 2017.

In addition, if the threshold for collecting or receiving information is higher than the standard for disclosure—which is currently the case at least for CSIS and would be the case if you adopt a dual threshold, that is, one for disclosing institutions and one for receiving institutions—then, rules are required to ensure that information is discarded without delay either when the collection test is not met or if the receiving institution is of the view that the disclosure standard was not satisfied.

In conclusion, my complete recommendations, annexed to this statement, include some that I have made in the past and do not have time to explain in the time allotted this morning. I also intend to write a fuller submission prior to the end of your study.

My team and I would be glad to answer any questions you may have.