Evidence of meeting #30 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was rcmp.
A video is available from Parliament.
Conservative
The Chair Conservative Pat Kelly
—go fully or the answer go too long when a question is posed right at the very end of the round.
Go ahead, Mr. Green.
NDP
Matthew Green NDP Hamilton Centre, ON
Do you believe that the use of technologies like this by law enforcement has the potential to violate rights guaranteed by the Charter of Rights and Freedoms?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Well, the Charter of Rights is there, and I think it can be raised in appropriate cases if there's a violation. I think that the regime is there and the protection is there. This is something that would be raised before courts and would be decided by courts.
What I would say in terms of my mandate as the Privacy Commissioner is that these technologies have the potential of having impacts on privacy, so they need to be looked at from that standpoint. There is a regime that allows that, and it is the regime of the privacy impact assessments, and I would hope that this be made a legal obligation and be done early enough in the process so we can course correct, if needed, as opposed to doing it long after it's been started.
NDP
Matthew Green NDP Hamilton Centre, ON
Thank you.
I know that you mentioned that you'd like to see frameworks in place to ensure that technologies don't go further than they need to, and I'm not sure if you are aware of the document submitted by the RCMP on a warrant, which is like a sample warrant.
Are you familiar with the matter for the application of general warrants by Justice Bertha Wilson? Did you have a chance to look at that?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I'm not sure that I am.
NDP
Matthew Green NDP Hamilton Centre, ON
I'll reference it for you, just the top sentence, which says, “When oral communications have been intercepted using an ODIT, the monitor who subsequently reviews the communication must cease reviewing the communication as soon as the monitor determines that no person in paragraph 3a is a party to the communication”. It sets a parameter.
The challenge that I have with the cavalier nature of law enforcement—you referenced stingray technology where they're mass intercepting communications from everybody and then deciding which ones they'll use—is who reviews their use? Once this warrant is granted and surveillance has begun, what mechanisms are in place to ensure that the RCMP are adhering to the terms of this warrant?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That's right; this is what we want to be looking at, and these are questions you may want to ask the RCMP when they appear before you. How does the regime work? How well does it work? There is judicial authorization, and there is follow-up that can be done there. There's notification after the fact—
NDP
Matthew Green NDP Hamilton Centre, ON
Just quickly, before my time is up, do you have anybody in your office who you feel has the technical knowledge to deal with the emerging technology at pace with the legislation?
Conservative
The Chair Conservative Pat Kelly
Your time is up. We have time for a yes-or-no answer and then we have to move on.
NDP
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We can provide information to the committee on our technical unit.
Conservative
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
Thank you, Mr. Chair.
I want to thank the Privacy Commissioner and the deputy commissioner for being with us today. I think this is an important discussion.
I just want to go back to what you said earlier in answering questions from Ms. Khalid, that Pegasus is not used by other government departments. How do you know that, when the RCMP never disclosed proactively that they were using on-device investigative tools? How do you know that CSIS, CSE, CBSA and National Defence are not making use of this type of technology?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Right; what I perhaps should have said is that I'm not aware of any government entity using it. I don't know for a fact that they're not, but I don't have confirmation—
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
So really, this is about a lack of transparency by the government, because they haven't been disclosing this information to you proactively. That's why we need to have the privacy impact analysis embedded in the Privacy Act legislation, so that all departments are obligated to do these impact analyses and request the advice of your office to ensure that they are compliant.
Now that you know that the RCMP have deployed this technology in the past, have you reached out to other government agencies that are responsible to you on whether or not they're using other Pegasus-type ODIT?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
No, we have not. We reached out to the RCMP after this matter became public. We would expect the government departments to have the onus on reaching our office and advising us if they are using tools. That's the expectation.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
You wouldn't be interested in actually asking them directly, in your role as commissioner, if they will disclose that they use on-device investigative technology?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We could reach out to them in our exchanges, but what's important, I think, is that the obligation rests on departments themselves to notify my office if they are using these tools. I wouldn't want to create an expectation that unless we proactively ask all organizations they don't have to provide us with the information. I think it's important that this is how the directive and the policies of Treasury Board are designed. The onus is on the organizations to advise the Privacy Commissioner of the use of those tools, and I would expect them to do so.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
You know, as Conservatives we do believe that we want to make sure that police agencies and our national security and criminal investigations have the appropriate tools to do this as long as charter compliance is in place and privacy rights are protected. How do you feel about the unintended consequences? They may have a warrant to turn on a cellphone and monitor the data or the video of conversations happening involving a person of interest, but what about the other Canadians who might be around that device and have their privacy violated as well? How do we balance that off?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That is exactly the type of question we would be asking in terms of looking at a PIA. This is the type of approach that I would call a culture of privacy. What is the impact on the privacy of Canadians? Are you going further than you need to? You may well need to do it to investigate one individual, but are you using a tool that's going to be gathering information about other individuals? Is that necessary? Can that be avoided? Can that be mitigated?
This is part of the context we would want to look at to see if it's minimally intrusive from a privacy standpoint.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
Is there a responsibility across government agencies and departments to ensure that they respect the charter, where they are prohibited from spying on Canadians? This is spyware. They cannot directly or indirectly spy on Canadians without proper warrants. Do you believe the current warrant system we have in place is modern enough to deal with the spyware that's out there now?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Well, this is why we need this information. This is the question that we will be asking when we receive the briefing on the information, to see whether, given this new technology, the safeguards are sufficient, or whether we have to make recommendations to make it safer from a privacy standpoint. These tools may well be needed, but do they have an impact from a privacy standpoint that is greater than what is warranted given the purpose?
This is an important question. This is the central question, to my mind, when doing a PIA, looking at the purpose and looking at the impact.
