Thank you very much to the committee for inviting the Canadian Civil Liberties Association to speak on this important topic.
The CCLA, as you know, is an independent national and non-governmental organization that has fought for civil liberties in Canada since 1964.
I'm going to focus on three topics today, the first at some length and the others very briefly. First is the need to update laws and policies regarding device searches at the border in a way that reflects the heightened privacy expectations that adhere to these devices. Second is the great need for public transparency and accountability regarding the way current laws are being interpreted at the border, and the policies and procedures in place regarding particularly privacy-invasive searches, and, very briefly, the need to ensure that the new preclearance act, Bill C-23, maintains or enhances privacy protections for Canadians and travellers on Canadian soil and does not diminish them.
I'm not going to speak at any length to President Trump's executive order excluding non-U.S. citizens from privacy protections under the U.S. Privacy Act, but I do want to just note that CCLA agrees with the concerns reflected in the Privacy Commissioner's letter of March 8, and we share his call to our government to ask the United States for improved privacy protection for Canadians under that act.
This study is both timely and extremely badly needed in light of the stories we've all heard about individuals facing intrusive and humiliating questions about religious faith, ethnic origins, sexuality, and political beliefs at both sides of the border, Canadian and American, and conversely the rhetoric we're hearing about extreme vetting that plays on pervasive fear of terror and “the other”.
I'm going to speak about law in principle for the most part, but I want to stress at the outset that the reason we need to think long and hard about how to improve privacy at the border has to do with the cost to individuals and to public trust from failing to do so.
The CCLA runs a public inquiry line, and on that line border questions have increased dramatically in the last six months. We've had calls from Muslims and Christians, and men and women of different skin colours and different sexual orientations, and they're all afraid of the same thing. They're afraid they are going to be subjected to privacy-invasive searches or questions when they cross the border. Some of them are afraid to travel at all.
We can't do much about how Canadians are treated at the United States border, but we can and we must address the problems that exist at our own. I would go further and suggest that the time is right for Canada to take a global leadership position regarding rights respecting border security laws, policies, and practices.
It is widely believed that borders are special zones in which privacy rights are reduced because of the compelling duty to protect state sovereignty and the populace. We don't disagree with that duty or with the need for effective border security that follows from it, but it is important to note that “reduced” expectations of privacy cannot and should not ever mean “non-existent”, and we argue that to be genuinely effective in the best sense, security must be both rigorous and rights-respecting in equal measure.
This is particularly true in relation to searches of electronic devices, including cellphones, laptops and wearables. We're living in a world where the tools that we increasingly use to navigate our daily lives, sometimes by design and often by default, contain, create, and connect information about us that is profoundly personal and sensitive. We have to quit trying to fit these technologies into a legal and regulatory structure created at a time when both these devices and the quantity and quality of information they can contain was inconceivable.
I know this committee has heard very similar variations on this theme in relation to its studies of the Privacy Act and PIPEDA, and it is similarly and urgently relevant here for this study.
I would argue that it is entirely possible for us to do better. When it comes to law enforcement outside the border context, we are actually in a small way starting to figure out how to address dealing with these devices, the information they store, and the potential for even seemingly insubstantial bits of information to have privacy implications. It's a work that's still very much in progress, but there has arguably been some advancement. In particular, we've recognized that the privacy-invasiveness of an electronic device search requires a clear framework under domestic law to ensure that the search itself is reasonable, that it's conducted in a reasonable manner, and that it's otherwise charter-compliant, usually by requiring prior judicial authorization—a warrant—and adequate grounds on which to base the search.
There is no compelling reason why we can't develop clear laws that allow us to do the same at the border, even taking into account its unique context. The current practice of CBSA is not sufficient. CBSA agents conduct warrantless searches of electronic devices with no defined threshold for grounds, based on largely unexplained interpretations of legislation that originally meant to apply to carriages and cars and boxes and bags. Nor has the manner of such searches yet faced a meaningful public or judicial scrutiny.
Information that is collected from devices searched or detained by CBSA is taken without public knowledge about what it will be used for; whether, how, or for how long it will be retained; and whether, how, or with whom it could be shared. Many individuals, from members of the business community to journalists, researchers, doctors, and lawyers, also have professional obligations to maintain the confidentiality and integrity of their data. The present law is entirely unequipped to deal with that reality.
There are also current constitutional challenges coming forward in the lower courts relating to device searches. While the trend up until now seems to have been to settle and make them go away, at some point these questions will have to be dealt with in the court. They should be dealt with, I would argue, by our lawmakers. It's long past time we updated the Customs Act and other legislation that applies in the border context to recognize the distinction between a bagful of underwear and a device that contains or provides access to our most intimate, personal conversations, our political musings and affiliations, our religious faith, our financial records, our commercial secrets, our health information, and many more types of information.
We also have to note in this context that certain groups—for instance, Muslim individuals, or individuals perceived to be Muslim, which are not always the same thing—have demonstrably been subject to greater scrutiny at the border, perhaps even more so since the U.S. executive order popularly known as the “Muslim travel ban”. Any measure that gives border officials powers to conduct invasive searches or that allows for continued ambiguity, uncertainty, and unchecked discretion in these matters runs the risk of disproportionately affecting these groups.
It's also impossible to talk about device searches without at least touching on related topics of compelled password disclosure and forced access to social media credentials. These practices truly highlight the illogic of treating electronic devices as equivalent to any other good that crosses the border. While it should remain within the purview of CBSA, of course, to detain devices, get a warrant, and conduct a forensic search on reasonable grounds, individuals shouldn't have an obligation to participate in that process.
We know from a 2015 interim document that was released via an access request that the CBSA believes it has the power to impose penalties on travellers who decline to provide a password for a given device. CCLA would argue that, at least in some cases, compelling that disclosure of a password that exists only in an individual's mind could interfere with the individual's charter rights to silence and against self-incrimination. This is in addition to the other privacy rights clearly at play.
Currently Canada doesn't ask for social media passwords or credentials that would allow them to access data stored remotely, and there's no legislative authority that would justify such a request. We simply want to warn against ever moving in that direction, because it would be both ineffective and likely to raise serious constitutional issues.
Social media is a place where people can and do play with identity, which would render the information profoundly unreliable. Of course we know—social science tells us—that people who think they're being watched change the way they behave and the materials they feel free to look at and explore and learn from and study. This means that such scrutiny could also have a profoundly chilling effect on other fundamental freedoms that we value, including freedom of association and freedom of expression.
The second topic I'd like to mention very briefly is the need for greater public transparency and accountability in the way in which our current laws, including the Customs Act and the Immigration and Refugee Protection Act, are being interpreted at the border, especially as they pertain to privacy-invasive searches and questions. I mentioned that we have access to a small number of policy documents. They actually reside on the website of our friend the BCCLA. However, a couple of documents received from an access request in 2015 hardly fulfills the requirement for public accountability or transparency. We don't even know if they're complete, accurate, or up to date. In contrast, if we look at our neighbours to the south, they actually have proactively published their policy documents about this kind of search, a privacy impact study that they conducted, and statistics regarding the electronic searches they conduct. There's no reason we can't do the same.
For an ordinary person at a Canadian border, it's difficult, even impossible, to evaluate whether the way a search has taken place meets constitutional standards. In other words, those scared people I was talking about at the beginning have no way to figure out if the way they're being treated at the border is lawful and fair if they have no access to the policies and procedures that are supposed to have been followed. Of course, with no independent oversight of CBSA, although there is hope that this will change, it's extremely hard to seek recourse.
In my last six seconds, I'll ask you to please take a look at Bill C-23 for its privacy implications, particularly in regard to the ability of American officers to perform strip searches if a Canadian officer declines to do so. It opens up a very dangerous territory. Borders require special consideration not just because they're zones where we need security, but also because they're the first place where people coming into Canada interact with what we hope is a free and democratic country. We need to show them who we are by making sure that our policies and laws at the border reflect our values.