Public Safety Committee on Oct. 5th, 2017

[Brenda McPhail]

Absolutely. We know people infer things from country of origin all the time. It's a common problem. We know there has been, as I have mentioned, an increase in intrusive questioning, including questions specifically targeted at people with particular backgrounds, from Middle Eastern countries, people who practise the Muslim faith in particular, and there is enough information on that page 2 to permit at least the beginning of that kind of profiling.

The reality is also that, at the border, whether this is the only information that is shared, it is certainly not the only information that officers will have access to at the time of questioning. Because we're expanding their ability to question at the point of exit as well as the point of entry, we are increasing the risk that intrusive questioning is going to happen and that is going to be difficult. I'll leave it at that.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Okay. Thank you.

I have a question for both of you with regard to some of the concerns about how long the information is held for and things like that. There has been a change, in particular, through one of the recent executive orders that essentially removed legal privacy protections from non-U.S. citizens in the U.S. With this type of trend, if I can put it that way, is there a concern with the information being shared potentially between the two agencies about not only the length of time but the actual protections that are put in place and where that information might end up?

We could even dare say this would be outside of government agencies and even within the private sector. In particular, we've heard that even with the NAFTA renegotiations one of the American asks has been a broader ability to share information and things like that, which aren't necessarily theirs, and omit them from certain legal protections.

Could I hear both of you on that, please?

[Eric Jacksch]

As Canadians, we don't get to dictate U.S. policy, so when Canadians appear or anyone appears at a U.S. border, they have to accept U.S. law. Certainly my advice to the U.S. government would be the same as I've given this committee, which is you collect information, you use it for the purpose for which it was collected, and when it's no longer necessary or relevant, you safely dispose of that information.

In terms of the impact on Canadians, I think it's important to realize that the data flow from Canada to the United States is occurring as people have already left the United States. While I share the concerns on issues such as profiling, the reality is the trigger for Canada to send this record to the United States is someone leaving the United States and entering Canada and not the other way around, so it's difficult to understand how that, again, would have a significant impact on a traveller. I've just left the United States and come to Canada and now Canada is sending the information that the U.S. presumably already has, other than the fact that I've left.

Again, in terms of information retention, it's difficult to know what the United States will do with that, but again the only information that Canada is really giving them that they don't already have is the date, time, and port of exit. If anything as a Canadian, I'd prefer that the United States knows that I left. That way, the next time I show up requesting entry into their country, they're going to have that record and know that when I said I was staying for a week, I stayed for a week.

[The Chair, Liberal, John McKay]

Thank you, Mr. Jacksch and Mr. Dubé.

Mr. Spengemann is next, please.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Mr. Chair, thank you very much. Ms. McPhail and Mr. Jacksch, thank you both for being here for your expertise.

Ms. McPhail, I wanted to start with you with a question just to follow up on an earlier comment with respect to the scope of what's being collected. Is it correct that it's your testimony that outside of the current dataset that was enumerated for the committee, other things could in the future be collected without an amendment to the legislation?

The committee received testimony in an earlier session that for any additional data points to be collected, the legislation would again have to be amended. I just wanted to, for the record, clarify your views on that.

[Brenda McPhail]

I believe that's true. I believe that what's left to be prescribed in regulations is not what kinds of information can be collected, but from where and from whom and then how. It is my understanding that you would have to amend the legislation for different kinds of information.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

That's helpful. Thanks very much.

You mentioned earlier in your comments that one of the things that we should look at before going forward with new legislation is to see how things are working now. I wanted to take the opportunity of your presence here to ask you if you could outline from your experience looking backward—and not necessarily at the specific issue but at privacy more broadly—the differences and also the convergence between Canadian and American privacy approaches and cultures.

Are there fundamental differences in the way Americans look at data collection and privacy that would give cause for concern in the way this legislation is framed?

[Brenda McPhail]

Canadians and Americans have always had somewhat different privacy cultures. Under the current administration, the current trend has been to diminish privacy protections, particularly for foreign nationals, and Canadians, of course, are foreign nationals in the U.S. What this does is it makes it more incumbent on us....

As my colleague pointed out, we don't get to dictate American policy, but what we do get to do with individual agreements is negotiate our terms. As general privacy protections in the U.S. are under siege and being eroded in a range of ways, it makes it all the more important that in specific agreements we make sure that our Canadian values are addressed in relation to agreements, because when there is no general protection, the terms of the individual agreement is all we have to make sure that we're safe.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Thank you for that.

Does the Canadian Civil Liberties Association keep any data on public opinion? Do you do any polling? Do you review any primary data on how the Canadian public feels about privacy issues?

[Brenda McPhail]

We don't do any formal polling. What we do have is a fairly extensive public inquiries program where people call in to us with their civil liberties concerns. Over the last eight months, the number of people calling in with concerns about privacy issues at the border has tripled, which for a small organization is a significant increase.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

For the benefit of the committee and the Canadian public, could you speak about the differences between public and commercial privacy concerns? The Canadian public is travelling extensively. We share our flight agenda to collect air miles or Aeroplan points. We share our travel reservations to collect hotel reward points, and anything up to and including gasoline purchases are basically shared through rewards points systems, which are made available to all sorts of vendors contractually.

How does that compare with how Canadians feel and what Canadian expectations are with respect to publicly collected data? Are they two different worlds? There's a propensity for Canadians to share their data through commercial channels, or even through social media like Facebook or Instagram. Do we do that differently with respect to considerations related to public agencies?

[Brenda McPhail]

There is a fundamental difference between Canadians as consumers making an informed choice to share data in exchange for a perceived benefit or convenience, and the state mandating that information they have to give to the state can be shared with other parties with relatively little control by individuals. It's a bit of a different thing.

There's also an increasingly blurred boundary between public and private. We know that the state is interested in using information that's publicly available but not necessarily shared for the purposes that individuals would have expected it to be used by the state. This is something we're concerned about in a more general way.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Would you be in a position to comment on whether Canadian public opinion has been shaped more by the commercial environment or the public environment? Or is it really a bifurcation of opinion when it comes to the difference between the commercial travel points scenario and publicly held information on health, immigration, or travel?

[Brenda McPhail]

What we're increasingly seeing—and polling by the Privacy Commissioner of Canada supports this—is that people feel as though they're losing control of their information across all sectors, and in all ways. They're losing control of what the public sector does with it, they're losing control of what the private sector is doing with it, and they're not happy about it. I think there's a real blurring of boundaries. I think people are unhappy in both regards, and I'm not sure that everyone necessarily makes the distinction. They're just feeling that all of their information is going out and they don't know what's going to happen to it.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

I think it's clause 2 of the legislation that creates the authority for CBSA and public officials to collect data. It's framed in a permissive way—the legislation says that XYZ official may collect information. We had testimony from the regulators themselves who said this is the way it's typically done in the Department of Justice. The permissive environment is created, and then through regulation precision is restored regarding how the information is collected.

Would you say that this discretionary authority gives rise to concerns that an officer may or may not decide to collect the data, or would the officer be ultimately so confined by regulation that there is very little discretion?

[Brenda McPhail]

Less permissive is better than more permissive in our opinion. Things that you mean to have enshrined in legislation should be there.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Thank you.

[The Chair, Liberal, John McKay]

Now that was an instruction in brevity.

Ms. Gallant.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Thank you, Mr. Chairman.

We need only look at some of the terrorist attacks that have occurred in Europe—where it has taken days for authorities to track down perpetrators to make sure they're not on the way to conducting another attack—to understand why the entry-exit data is important for security purposes.

I understand that part of the reason for the delay behind the implementation of the full beyond the border plan is the decision to expand the sharing of travellers' entry and exit information with other Canadian federal departments. One of those is the Canada Revenue Agency.

Can you explain how the travel exit-entry data would be relevant and worthwhile to the Canada Revenue Agency in terms of protecting citizens, or preventing fraud or anything else?

[Brenda McPhail]

I'm not sure. I share your question in relation to that.

I would note that under the Security of Canada Information Sharing Act, information sharing was vastly expanded, and the scope of agencies that were identified as having potentially something to do with national security was extremely broad. That's something we criticized in relation to Bill C-51, and it seems reasonable to continue to criticize it here.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Other than a cross-comparison of data, I don't see how they would be gleaning whether or not somebody is cheating on their taxes from this information. It mystifies me as to why they would do this.

For Mr. Jacksch, you say that the sky is not falling, and law-abiding citizens don't have anything to worry about in terms of their information being safeguarded or misused by Canadian or American agencies. However, we see, such as with NATO, that they fend off over 500 cyber-attacks a month. The Pentagon is always fending them off.

Now we don't know about the ones they're not able to fend off. They're kept in-house, of course. Even here at the House of Commons, we will from time to time lose all our connectivity because they've been rendered helpless until they reboot the system and clean out the malware.

Given that not only is it a segregated computer system but that we're living in the Internet of things, how can you be so confident that individuals' information is totally protected?

[Eric Jacksch]

I'm not sure I'd use the words “totally protected”, but we can manage those risks. Canada, and particularly the federal government in Canada, has a good process. We have a proven risk assessment methodology. In fact, the Government of Canada process is so good that I often use it with private sector clients.

What it comes down to is the application of what we know. If we correctly architect systems, correctly design systems, perform risk assessments, take seriously the guidance provided for our lead agencies in that space, if we look at, for example, the controls that are suggested by the Communications Security Establishment and ITSG-33, we can build systems that are quite secure and that certainly provide the level of security needed to protect this level of information.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

But we had Heartbleed and our science department, NSERC, was attacked.

How can you say with such confidence, given the record of attacks we have had, that this information won't be exposed to a criminal element?

[Eric Jacksch]

I'm not saying it won't, but I'm not saying it will either.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Okay.