In fact, the government is not violating its own law, because conducting such an assessment is not a legal obligation, but currently stems from a Treasury Board directive. Hence, a department that doesn't comply is violating a government directive, not a law. That's the problem we've identified. In our view, there should be a provision in the law that says that when a department develops a new program or uses new tools that may have significant consequences for privacy, it must carry out a privacy impact assessment.
We'll continue to encourage the departments to conduct those assessments, and we'll continue to advocate for legislation making them mandatory. In an ideal world, when the question is asked, the response would always be, “Yes, we carried out an assessment.” The media and parliamentary committees are doing important work by raising those issues.
The idea is not to ban those tools outright. Indeed, police forces must have the tools they need to do their jobs, but they need to be disciplined in their use of those tools, after conducting a privacy impact assessment.
We issued a decision on certain tools used by the Royal Canadian Mounted Police to fight crime. Of course, fighting crime is important and the RCMP has to be able to do so successfully, but we determined that the approach taken to protect privacy was insufficient. Therefore, we'll continue to do this work, but I think that there would be greater compliance if the obligation were enshrined in law.
