Evidence of meeting #30 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was rcmp.
A recording is available from Parliament.
Assistant Deputy Minister, Corporate Services, Department of Citizenship and Immigration
We have both agreements under our act, the Immigration and Refugee Protection Act, as well as formal written agreements on information sharing. In fact, a lot of those are online, and you can read them on our website.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
How possible do you think it is, or how easy would it be for you to move from those instances where you don't have formal written agreements, either with other governments or with other departments, to a system where you are always operating under the auspices of a written information-sharing agreement?
Assistant Deputy Minister, Corporate Services, Department of Citizenship and Immigration
From a bureaucratic perspective, it's always easier if we have legislative authority to do it without having to negotiate a whole separate agreement, if that's what you're suggesting, in order to operate. If we had to write information-sharing agreements among all of us, there are guidelines, drafts, formats, and things like that we could do, but it would seem to me, in an era of red-tape reduction, that is not the direction we would want to take.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
A suggestion we have heard from some witnesses is that information sharing should always occur under an explicit written agreement, and furthermore, that those agreements should be made public. This is where I'm going next in terms of trying to have a sense both of the operational impact of putting those agreements in place and of what it would mean for your particular organizations to make public the general principles or rules according to which that information is shared—although not the information itself, obviously. What would be the operational impact?
Assistant Deputy Minister, Corporate Services, Department of Citizenship and Immigration
The acts are all public, and they are online. As I said, about 50 of ours are already online, and we're reviewing to see which others we could put up. The documentation itself isn't classified in any way. There may be parts of it in some instances. You can even read our information-sharing agreements with the U.K. and the U.S. They're up on our website.
Assistant Director Intelligence, Canadian Security Intelligence Service
Naturally it would be difficult for CSIS to publicize its relationships with all of the security intelligence agencies around the world with whom we work. That would disclose relationships that are closely guarded by some of our partners at times, relationships that may prove problematic to our ability to gather national security information from them about threats to the security of Canada.
Simply put, some organizations would not work with us if they had to publicize that relationship.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
In your case, then, one of the challenges wouldn't just be the type of information that's being shared and having that disclosed publicly. It would also be the fact of the relationship itself.
Assistant Director Intelligence, Canadian Security Intelligence Service
That's correct.
A/Commr Joe Oliver
Where we have long-standing relationships whereby the information is regularly shared, normally that is supported by an agreement that outlines the information protections required. However, it would be operationally impossible, I think, to negotiate an agreement with everybody we share with. If you look at the North American context, you have 360 law enforcement agencies in Canada and 17,000 in the United States. Where the offence takes place may have international implications. For us to share maybe a small portion of information with a state police in the United States, we would have to go through an onerous negotiation process for the sharing of information that is relevant to law enforcement. In some instances, this information has to be shared in a timely manner in order to prevent a more serious crime from taking place.
It would be very challenging to negotiate an agreement with everybody we share with. That's why we have strict policies that dictate how we share and with whom we share. There's a need to know and there's a right to know. Plus, we assess the relevancy of any request, the reliability of the information we are sharing, and the accuracy of that information before we share it. Then it's shared with the caveat that for any further dissemination, you would have to come back to the originator in order to share onward.
Chief Strategic Policy and Planning Officer, Royal Canadian Mounted Police
There's also the ongoing training of our employees so that they understand exactly what their responsibilities are—i.e., to share information or not.
Conservative
The Chair Conservative Blaine Calkins
The folks at CBSA, I think, have been waiting patiently as well.
Director, Access to Information and Privacy Division, Canada Border Services Agency
At CBSA we have policies that cover basically all possible legislative authorities for disclosure. We have a policy, for example, under section 107 of the Customs Act. We have a policy under the Privacy Act, section 8. We have a policy under SCISA. Granted, there might not be written agreements for every exchange of information, but there's policy governance to assist with those disclosures.
Now, our concern, if you will, is that you would try to implement a written agreement for all consistent-use disclosures. As you know, the Privacy Act is subject to other acts of Parliament that already have governing disclosure provisions, so in terms of consistent use, to have a written agreement for every single one would be very problematic.
Apart from that, when it's not a consistent use, we would agree, and support, that you need a governing framework, an authority, written and signed, to share that information.
Conservative
The Chair Conservative Blaine Calkins
Thank you very much, Mr. Blaikie. We went past seven minutes there.
We now move to Mr. Lightbound for our last seven-minute round.
Liberal
Joël Lightbound Liberal Louis-Hébert, QC
First of all, thank you all for being with us today and for the work you do.
My first question is regarding privacy impact assessments. The commissioner in one of his recommendations suggested that all institutions, before implementing a new program, would conduct a privacy impact assessment. We learned this fall that of the 17 institutions that are provided for in SCISA, only two conducted privacy impact assessments.
I'd like to know the frequency with which you conduct privacy impact assessments. I'll start with CBSA.
Director General, Corporate Secretariat, Canada Border Services Agency
I think it would probably be better for Dan to answer the question on frequency. I think in our last report we did seven or eight in the course of the year...?
Director, Access to Information and Privacy Division, Canada Border Services Agency
At CBSA we do have a lot of privacy impact assessments under development. If I had to guesstimate, I would say we probably have 40 of them on the go right at the present time. We commonly do privacy impact assessments. We do an assessment of the need for privacy impact assessments.
In terms of how we built in the process at CBSA, we start off with what's called a “privacy impact questionnaire”. Basically, that questionnaire is an assessment that is done, based on a review by my office and legal services, to determine if the new program or activity, or the substantive change to the program or activity, requires the development of a new privacy impact assessment. If it does, that privacy impact questionnaire basically serves as chapter one of the PIA. We have a regular review, at a director general level, of all proposed and new PIAs being developed. That is chaired by my director general, Robert Mundie. We have regular follow-ups with the program areas to make sure they're done.
We do have a lot, yes.
Liberal
Joël Lightbound Liberal Louis-Hébert, QC
And we do understand that making PIAs mandatory would not be too much of a hassle, considering—
Director, Access to Information and Privacy Division, Canada Border Services Agency
No, it would not. Granted, they're challenging and resource-intensive to put together, because they require a certain level of expertise, which you do not have normally in-house either within an ATIP office or within the agency or the program area. That is a challenge we need to look into.
Chief Strategic Policy and Planning Officer, Royal Canadian Mounted Police
Thank you.
Like CBSA, the RCMP does conduct privacy impact assessments for any new programs or any programs that are substantially amended. Last year, for 2015-16, we completed three privacy impact assessments, and provided three addenda to previously submitted privacy impact assessments. They're listed and explained in depth in our annual report to Parliament.
Assistant Director Intelligence, Canadian Security Intelligence Service
We're in the same situation. We conduct our privacy assessments. We work with the Office of the Privacy Commissioner in doing so, to make sure that they're effective at providing the information necessary.
Assistant Deputy Minister, Corporate Services, Department of Citizenship and Immigration
The same, as I said in our opening remarks, and in fact we've recently revised our PIA templates and guidelines for the officers writing them. I will say they are lengthy and time-consuming. It's not a simple effort. Even if we're doing, say, seven or eight a year, they can be telephone books, these things.
Liberal
Joël Lightbound Liberal Louis-Hébert, QC
We've heard from previous witnesses, for instance, that in B.C. there are requirements to protect or maintain data that is about Canadians in Canada, but there is no similar disposition in the federal law. I was wondering what measures you take to protect the data that pertains to Canadians that is stored outside of Canada, if you have any? Or is it all stored here in Canada, on servers here?