This is how I discovered last year that CSE was not acting legally or lawfully. They shared what we call CII, which is Canadian identity information, with some Five Eyes partners without minimizing the information. For example, you cannot name the person. You should say a Canadian, for example. There was a problem and they didn't do it.
On March 21st, 2017. See this statement in context.