Evidence of meeting #34 for Access to Information, Privacy and Ethics in the 39th Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was countries.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Geoffrey O'Brian  Advisor, Operations and Legislation, Canadian Security Intelligence Service (CSIS)
Superintendent Bob Paulson  Acting Assistant Commissioner, National Security Criminal Investigations, Royal Canadian Mounted Police

5:05 p.m.

Advisor, Operations and Legislation, Canadian Security Intelligence Service (CSIS)

Geoffrey O'Brian

I'll answer the first one, if I may, which is the one about information-sharing and foreign arrangements, because I think it is an important point, and this was one that again came up when the CSIS Act was first passed in 1984.

The way we dealt with it was that in section 17 of our act it says that before we enter into any arrangement with a foreign agency.... We too have some written arrangements, but a lot of them, frankly, are not written. But before we enter into an arrangement with a foreign agency, we have to get the permission of the Minister of Public Safety, and he has to consult with the Minister of Foreign Affairs, and that consultation is done on paper. So the arrangement, even if it is verbal, has to be described on paper, if you see what I mean.

Then under section 38 of our act, the Security Intelligence Review Committee is specifically mandated to look at all of our arrangements and to review the provision of information and intelligence pursuant to those arrangements, and they do that every year. For example, although the details are not public, every year they look at that. I notice in their last report, which was just out last fall and tabled in the House last fall, as of March 31, 2007, CSIS had 271 foreign arrangements with agencies in 147 countries.

SIRC reviews all new enhanced or modified arrangements. SIRC found the service had informed itself of the human rights situation in all the countries and agencies in question. Moreover, the service had proceeded cautiously with exchanges of information involving countries with questionable human rights records. So the difficulty, of course, is that in some cases the information is not public. What you are dealing with in some cases, again, are surrogates for the public, because of the nature of the information. SIRC appears before Parliament to talk about its report, and the Privacy Commissioner, of course, has the same kind of access. Again, it's that bit of process versus substance.

5:10 p.m.

Liberal

Glen Pearson Liberal London North Centre, ON

Understood.

Do I still have some time, Mr. Chair?

5:10 p.m.

Liberal

The Chair Liberal Paul Szabo

A couple of seconds, sure.

5:10 p.m.

Liberal

Glen Pearson Liberal London North Centre, ON

What do you do with your unused information? You collect and there's a bunch of it that you don't end up using or don't require, which is part of what the Privacy Commissioner was getting at, right? What do you do with the unused information?

5:10 p.m.

Advisor, Operations and Legislation, Canadian Security Intelligence Service (CSIS)

Geoffrey O'Brian

There are several answers to that. One is that in some cases the Privacy Commissioner, frankly, wouldn't like us to get rid of it, because you want to leave a paper trail or a trail so that someone can check up afterwards as to whether you were collecting it properly or not, if you see what I mean. That's the first answer.

5:10 p.m.

Liberal

Glen Pearson Liberal London North Centre, ON

She didn't imply that, but go ahead.

5:10 p.m.

Advisor, Operations and Legislation, Canadian Security Intelligence Service (CSIS)

Geoffrey O'Brian

Yes, I know. But in fact what happens is the first time, frankly, you destroy something, someone comes along and says, “Why did you destroy it? We wanted to review it to ensure that you collected it properly.” So there is again that balance, and we're subject to the archives act, and all of those kinds of things.

In terms of communications that we intercept pursuant to warrants, we debrief them, put in operational reports, and then the tapes are destroyed after a certain length of time. And that length of time varies according to the investigation.

5:10 p.m.

Liberal

The Chair Liberal Paul Szabo

We'll have Mr. Wallace, please.

5:10 p.m.

Conservative

Mike Wallace Conservative Burlington, ON

Thank you, Mr. Chair.

Thank you for coming today and listening to us for an hour before you got a chance to speak.

Mr. O'Brian, I'm going to give you a chance to answer the question Madame Lavallée asked, which Mr. Paulson thoroughly answered.

Have you reviewed the ten quick fixes, as she calls them, the commissioner has put forward on the Privacy Act? That's the first part of the question. The second part is to both of you. Those are ten things she's recommending. As indicated by our parliamentary secretary, that is what we have to work with, basically. Are there other things we should or should not be doing? Or should we just be saying that we looked at it, there are no changes, and we'll just leave it alone for another 25 years, or whatever it has been?

Those are my two questions, and I'll start with you, Mr. O'Brian.

5:10 p.m.

Advisor, Operations and Legislation, Canadian Security Intelligence Service (CSIS)

Geoffrey O'Brian

Well, in terms of the ten, I have reviewed them. I confess that I don't have written notes.

The first recommendation is about the necessity test. You will see, from my opening remarks, that we actually have a necessity test for collection in our act. Section 12 of our act says that the “Service shall collect, by investigation or otherwise, to the extent that it is strictly necessary”, information and intelligence respecting activities we suspect of being threats to the security of Canada.

Now, the devil is in the details, and the devil is in how you interpret that. Frankly, the British have, I think, quite a good phrase. They talk about information they collect being necessary and proportional. Those are judgment calls, in some ways. I think what Chief Superintendent Paulson and I are saying is that we have to be able to exercise our judgment, subject to review, but not be hamstrung. Now, we have learned to live with that strictly necessary test. But if you drill down--and I'm sorry, because the devil is in the details--it helps if you look at specifics.

Frankly, what we collect that may be strictly necessary when we are attempting to look at someone.... In the case of a foreign diplomat, for instance, who we believe is a member of or may be engaged in espionage, our goal would be to recruit that person. Therefore, what we would collect and what we would think of being collection that is strictly necessary could be immense. We would want to know where he goes in his off hours, whether he fishes, and whether his children take skating lessons. We would want to look at ways in which we could make an approach. I think you would argue that in a different kind of investigation, one in which you were looking at a different kind of potential threat, this kind of extensive collection might not be appropriate. So it's difficult.

So that's the comment on recommendation 1.

Recommendation 2 I'm not an expert on in terms of the power to award damages.

Recommendation 4, having a clear public education mandate, seems fine.

With regard to greater discretion of the Office of the Privacy Commissioner to report publicly, again, we wouldn't have concerns about that, obviously, within the bounds of our security concerns. Yet we vet documents that are made public all the time. So hopefully, that would be fine.

On amending the Privacy Act to align it with PIPEDA by eliminating the restriction, I confess that lawyers could say much better than I whether access is sufficient now. Frankly, when I read the act, it seems to me that the intent is that she or he should have access to information--and I read out part of that section--however recorded. I don't know what the problem is, frankly.

The final one, which is strengthening the provisions governing the disclosure of personal information to foreign states, we've talked about. I believe that the CSIS Act, with SIRC and the inspector general and the requirement for them to review all the arrangements, and the fact that two ministers of the crown have to approve every single one of our foreign arrangements, builds in those kinds of protections, frankly.

I would be wary, again, of something that could be interpreted as restricting as opposed to something being an important subject that has to be reviewed on an ongoing basis.

So those are, in many ways, my general comments. My general comment at the beginning was that we're all engaged in national security: the RCMP from a law enforcement point of view, CSIS from an intelligence point of view, CBSA from a borders point of view, Transport Canada, and so on and so forth. Each of us has slightly different powers and mandates. CSIS has no powers of arrest and no ability to take measures to enforce security. We have a broad mandate: Reason to suspect an activity. So I think one has to look at the individual mandates when you're making the kinds of difficult judgments you have to make.

Mr. Zed asked me at the beginning what I would look at. I wasn't smart enough to recommend to him a book that I think is particularly good. It's a Canadian book that was written recently by Stan Cohen, from the Department of Justice. He's sort of “Mr. Charter”. He's probably been seen on the Hill a number of times testifying about the charter standards with respect to particular bits of legislation. He wrote a book called Privacy, Crime and Terror: Legal Rights and Security in a Time of Peril. There are chapters on privacy, privacy in the Privacy Act, information sharing as it affects the interests of law enforcement, national--

5:15 p.m.

Conservative

Mike Wallace Conservative Burlington, ON

Do you agree with what he's written?

5:15 p.m.

Advisor, Operations and Legislation, Canadian Security Intelligence Service (CSIS)

Geoffrey O'Brian

It's a very good discussion and a very thoughtful book. I highly recommend it.

5:15 p.m.

Liberal

The Chair Liberal Paul Szabo

We'll go to Madame Lavallée, and then I think we'll be done.

5:15 p.m.

Bloc

Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC

When a foreign government asks for information, is it always information on individuals and organizations? Is there any other type of information that might be exchanged?

5:15 p.m.

Advisor, Operations and Legislation, Canadian Security Intelligence Service (CSIS)

Geoffrey O'Brian

Yes. We exchange all sorts of information. At times we have to make judgment calls.

Again, the answer is in part a process answer and in part a substance answer. First of all, we have to have an arrangement with the country. Second of all, we have to have had enough experience with them that we know they are going to respect our caveats that we've put on the information. In other words, we've had a history with them in which information has not been abused. Then we have a process by which within the service, individuals sign off as that information is sent abroad, and it's signed off by a director general.

5:20 p.m.

Bloc

Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC

When you exchange this type of information, is it substantial information, large documents, or just two or three pieces of information about an individual? How is the information provided? By e-mail, by Internet?

5:20 p.m.

Advisor, Operations and Legislation, Canadian Security Intelligence Service (CSIS)

Geoffrey O'Brian

Frankly, it depends on the situation.

We have situations--and perhaps we could take the O'Connor report as an example--where there is a seizure of hard drives. Because we're not capable of processing it, we may give a copy on CD of that hard drive to our allied services to assist us in the processing. That could contain a huge amount of information. On the other hand, it may simply be a request such as “What do you know about this person?”

Again--I'm speaking for CSIS--we would rarely answer a question that was not put into the context of why the question is being asked and for what purpose.

5:20 p.m.

Bloc

Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC

I would like to put this question to each one of you. Have you ever lost information that you were exchanging, for example information on a USB key or a CD? Have you ever lost information? I want the truth, the whole truth and nothing but the truth.

5:20 p.m.

Bob Paulson

Indeed, it has happened that we have lost information here in Canada. Over the course of their work, some officers lost a piece of paper or a USB key. It has happened but not during an exchange with another country

5:20 p.m.

Bloc

Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC

This means that information on citizens ended up in the hands of people who should not have had it. When you lost a USB key, I suppose that the individual who found it probably connected it to his computer to see what was on it and saw that Carole Lavallée is not a criminal, for instance.

In such a case, depending on the type of information, do you feel obliged to advise the individuals whose information has been lost?

5:20 p.m.

Bob Paulson

It depends on the type of information.

5:20 p.m.

Bloc

Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC

I suppose so.

5:20 p.m.

Bob Paulson

Each case is different. If it is personal information on people who are not involved in criminal activity, yes.

5:20 p.m.

Bloc

Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC

Have you ever advised people in such circumstances?

5:20 p.m.

Bob Paulson

Yes.