Thank you, Mr. Chair and members of the committee, for the invitation to address you today.
The subject of your study, Canada's regime for combatting the financing of terrorism, is clearly a timely one.
As you are aware, in light of Bill C-51 and other recent legislative activity, the past year has seen much public debate about the rules that regulate how information is collected, shared and analyzed by and among our law enforcement and intelligence agencies. Indeed, information sharing is a very important aspect of combatting crime and terrorism. It can also, however, pose risks from a privacy perspective.
Operating under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, FINTRAC is one agency that is a key player in information gathering and sharing, and one that my office has had many interactions with over the years.
As I outlined in my recent submission on Bill C-51, in a country governed by the rule of law, it should not be left for national security agencies to determine the limits of their powers. Generally, the law should prescribe clear and reasonable standards for the sharing, collection, use and retention of personal information, and compliance with these standards should be subject to independent and effective review mechanisms, including the courts.
In this case, the legal standards are established under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and accompanying regulations, which I find to be reasonable in their current state, as they target individuals and organizations suspected of criminal or terrorist activity or financial transactions of a significant value. This could change as a result of Bill C-51 or other measures currently under consideration that would require the sharing of all electronic transfers regardless of the amounts involved.
In terms of review, the office of the commissioner is mandated to conduct biennial reviews of FINTRAC's personal information handling safeguards, under section 72 of the enabling legislation. We also measure their activities against sections 4 to 8 of the Privacy Act, under our authority to conduct reviews as outlined in section 37 of that act.
While we know that current laws and regulations contain reasonable standards, our audits have found problems with the collection and retention of personal information in excess of these standards. We have found that some of the information shared with FINTRAC related to activities that did not demonstrate reasonable grounds to suspect money laundering or terrorist financing, and that FINTRAC was retaining data that is not relevant to its mandate. This presents an unquestionable risk to privacy by making available personal information for use and sharing that should never have been provided to FINTRAC.
To address this problem, after consulting with FINTRAC, we've prepared guidance for private sector organizations to reduce the risk of overreporting in violation of the risk to privacy. Furthermore, explicit authority under subsection 54(2) of the PCMLTFA, Proceeds of Crime (Money Laundering) and Terrorist Financing Act, as enacted by Bill C-31, was also recently granted to FINTRAC for the destruction of information that is not related to money laundering or terrorist financing. Despite these initiatives, the risk of overreporting and retention remains, and we will be paying particular attention to this issue in our upcoming two-year review.
The risks I've described will increase only if the reporting threshold for electronic funds transfers is dropped to zero, as has been discussed at this committee and elsewhere, and should Bill C-51, which further widens the potential sharing of information, be enacted without amendment.
Finally, let me say a few words about the review.
While our office is obligated to conduct compliance reviews of FINTRAC, we can only examine privacy issues. FINTRAC does not have a dedicated review body to examine their activities to ensure they are lawful, reasonable, and effective.
I conclude by reminding the committee that the lack of a dedicated review for FINTRAC was last raised by the O'Connor commission and that it remains a serious problem.
Thank you. I look forward to your questions.