Evidence of meeting #35 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was scisa.
A recording is available from Parliament.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
Is it really a matter of what some are characterizing as a lowering of the bar for privacy under this act? Is it a necessity, and is that threshold your principal criticism?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Do you mean whether it's a necessity in terms of maybe not being necessary for this legislation to be adopted at all, or as a threshold for transactions and information?
Conservative
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I would say that, yes, it is our main concern. It is not our only concern, of course, but it is the issue that I relate most directly to the ultimate risk, which is, I think, the risk to law-abiding citizens.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
Of course, we are rightly concerned with Canadians' privacy. It's the business of this committee, as well as of your office, to ensure that Canadians' privacy is rightly protected.
Canadians would also be rightly appalled to learn, as a result of an inquiry into a future catastrophic crime or terror event, that there had been meaningful knowledge or intelligence that could have prevented such a crime or such an act from taking place, and that an agency had been reluctant to share it out of fear of an act and penalties under an act.
It is very important, no matter what we recommend, that we bear in mind that Canadians expect our various institutions of law enforcement and intelligence gathering that share information with each other to do their jobs correctly.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Absolutely. I'm not disputing that at all.
The question is whether the previous authorities were sufficient, whether this new legislation was necessary, and, regardless, whether there are appropriate safeguards to ensure that this worthwhile activity does not create risks beyond those that are necessary.
Again, I would point out the risk to law-abiding citizens, to taxpayers, to travellers. There's no rule at this point in this bill that says that after information has been analyzed with a view to detecting national security threats, as it should be—that for the vast majority, for 99.99% of the people, whose information is shared—it should be destroyed ASAP.
Conservative
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
Thank you.
Thanks for your presentation. That was helpful in terms of trying to understand the thrust of the bill.
I think we're all agreed that we're trying to find the right balance between the legitimate use of information in order to stop security threats and the respect for Canadians' private information.
The gist of some of the testimony we've heard so far, in my view anyway, is that a lot of the controls for this information sharing are matters of internal department policy. In some cases, there are written agreements between the departments.
I'm just trying to get at what in SCISA actually mandates oversight. What's in the law that says from time to time departments will be evaluated in terms of how they are conducting themselves with respect to information sharing under SCISA?
Is there anything that requires departments to go outside themselves, as it were, in order to be evaluated, or is that something that really only happens as a matter of internal departmental policy?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It's the latter. There's nothing in SCISA that legally requires this type of review or analysis.
I can do a review, as I'm doing, on my own initiative. I can investigate complaints, if they are made. However, in this type of area, the people who may complain don't know what's happening, so it's unlikely that there will be complaints raised to my office.
Of course, there are other oversight bodies that can act. However, in terms of, as you put it, internal controls, governance mechanisms, they exist, but they are wholly administrative. There's no legal requirement to have them.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
Is it fair to say then that the main problem—if there is one—with SCISA is that it establishes a very low threshold for information sharing and retention but doesn't actually provide for any external oversight in terms of departments interpreting their authorities under the act to receive that information, retain it, and use it?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I will say yes, and I can expand that to say the law facilitates, as a legal matter, information sharing. The safeguards—and you say, the “controls”, but I'll say the “safeguards”—to ensure that these activities are not excessive are administrative and not legally required for the most part.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
How would it be if the department were using some of this information in a way that Canadians would think was inappropriate? Other than a leak coming from somewhere in the department, is there any way Canadians could expect to find out that this is going on, then, or would it have to be someone reporting, in an unauthorized way, information they have by virtue of working within that department? Are there any other ways that Canadians would come to know of abuses of information within a department?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I'll repeat that there are no legally required controls. There is a reference in the preamble to SCISA that says, among other things, that information sharing should occur responsibly. That's advice given by Parliament to departments, and I'm sure this advice in the preamble will lead to certain actions within the public service. However, it's left completely to the public service to determine what kind of controls or governance structure they will put in place to live by this principle of responsible information sharing.
We don't need to be overly prescriptive, but I think there need to be some high-end controls, safeguards, and governance mechanisms to ensure that this broad authority given by Parliament is exercised responsibly.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
How would you characterize the best possible oversight mechanism, one that respects the sensitivity of the information, obviously, that's being shared and used to fight threats to national security but nevertheless is something Canadians can trust to have teeth when it comes to ensuring that government is using that information responsibly and not keeping it longer than it needs to or should?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It starts with the legislation itself, so I would say that the standard matters and rules around retention matter. It should not be for the bureaucracy to decide how long they are going to keep the information. There should be rules of law on this.
There should be a legal requirement to have agreements whereby you bring the general principles to something more down to earth—what kind of information will be shared for what purpose, etc. Some accountability mechanisms in these agreements would be helpful.
Review of the agreements by review bodies like me, like SIRC, and so on would be helpful, because that will put an expert lens on whether the agreements strike the right balance. It will inform the review bodies as to how to direct their case investigations further down the road.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
We've heard in some cases that either making the information-sharing agreements public or even just knowing that there's a written agreement between international governments, and not just among departments, would pose a potential threat to national security. Do you think there is a way to have those agreements? Do they all have to be made public, or would it be sufficient to have, in some cases, either the Privacy Commissioner or SIRC or others say, without revealing the content of those agreements, “We are aware of them and we think these are adequate”, and for Canadians to know that those review bodies have access to those written agreements? Do you think a mechanism like that in the most sensitive cases would be—
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The latter is certainly possible. I don't see why SIRC, the OPC, or other review bodies would not be able to see the complete text of agreements. There may be some cases in which certain provisions should not be disclosed to the public for reasons of undermining methods of operation, but, by and large, I think the agreements could be public, subject to few and limited exceptions.
Conservative
The Chair Conservative Blaine Calkins
Thank you, Mr. Blaikie.
We'll now move to Mr. Long to wrap up the seven-minute round. We'll move to five minutes after that.
November 22nd, 2016 / 11:30 a.m.
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
Thank you, Chair. It's good to see you back.
Thank you, Commissioner, Ms. Kosseim, and Mr. Morgan for coming today. The more you come, the more you can be part of our club. I think for five appearances you get a special status. You might be close.
I read a National Post article that was done on your report , in which you basically said that the federal government has scant regard for privacy rights when it comes to national security. In your report you state that SCISA opens a door to federal government surveillance.
Do you really feel that way? Can you comment on that?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I feel there are insufficient safeguards in the legislation to prevent that kind of risk from materializing. I'm not saying that government officials involved in national security are in bad faith and are looking to do surveillance of the population, but the safeguards are insufficient.
It's not just a theoretical concern. We have seen cases in the recent past where there has been excessive, sometimes unlawful, collection or retention of information. Think of the report of the CSE commissioner who found that the CSE had disclosed metadata to other countries illegally. Think of the recent judgment by the Federal Court that found that CSIS had unlawfully retained the metadata of a large number of law-abiding individuals who are not threats to national security because CSIS felt it needed to keep that information for analytical purposes.
These are not theoretical risks. These are real things, real concerns. Do we want a country where the security service has a lot of information about most citizens with a view to detecting national security threats? Is that the country we want to live in?
We have seen real cases in which CSIS had in its bank of information the information about many people who did not represent a threat. Is that the country we want?
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
No, it's not.
What would be the number one amendment you would make immediately? What would be the first thing you would do?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I would start with a threshold, but review is also important. To me, in order to have the right balance, you need the right safeguards and the threshold. The issue of relevance versus necessity is very important, but you also need review of these activities by independent review bodies. It's the combination of the two that I think elevates the possibility of having a balanced system.
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
The article I read was interesting. It said there were only two of 17 departments and agencies with power to collect that believed PIAs, privacy impact assessments, were necessary.
Can you comment on that? Was it alarming that only two of 17 departments actually thought the PIAs were necessary?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It is alarming.