Evidence of meeting #90 for Public Safety and National Security in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was privacy.
A video is available from Parliament.
Liberal
The Chair Liberal John McKay
I'd like to call to order the 90th meeting of the Standing Committee on Public Safety and National Security.
We have with us a familiar face, our Privacy Commissioner.
Welcome again to the committee, sir. I'll leave you to introduce your colleagues.
Daniel Therrien Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Thank you, Mr. Chair.
Mr. Chair and members of the committee, I am here this morning with Patricia Kosseim, who is our general counsel, and Lara Ives, who is the director general of audit and review.
Thank you for the invitation to discuss Bill C-59.
As you know, Bill C-59 introduces a wide range of measures intended to strengthen Canada's national security framework in a manner that safeguards the rights and freedoms of Canadians. On the whole, I find it represents a step in the right direction, but as other commentators have noted, its weakest part is the Security of Canada Information Sharing Act, or SCISA, which contains provisions related to information sharing and privacy. Professor Forcese, for instance, gave these sections a failing grade. I was therefore glad to hear Minister Goodale last week say that SCISA was probably the part most deserving of scrutiny. I hope your study will result in much-needed improvements to these rules.
In previous parliamentary briefs, I highlighted the need for rigorous legal standards around the collection and sharing of personal information, effective oversight, and minimization of risks to the privacy of ordinary law-abiding Canadians, particularly through privacy-sensitive retention and destruction practices. Specifically, I indicated that the law should prescribe two things essentially, which are useful to bear in mind. First is clear and reasonable standards for the sharing, collection, use and retention of personal information”, so substantive rules. Second is that compliance with these standards should be subject to independent and effective review mechanisms.
It is with this analysis in mind that I offer the following comments and recommendations. While I will focus in my remarks on SCISA, this analysis, looking at two types of issues, is also relevant for other parts of Bill C-59, including parts 3 and 4. The full list of our recommendations is attached to this statement.
Bill C-59 would create a new expert review body, the NSIRA, with broad jurisdiction to examine the activities of all departments and agencies involved in national security. Recently, Parliament also created, through Bill C-22, a new National Security and Intelligence Committee of Parliamentarians. Both of these bodies will be able to share confidential information and generally co-operate so as to produce well-informed and comprehensive reviews that reflect considerations both by experts and by elected officials.
These developments are most welcome, but they are, in my view, clearly insufficient. In my view, effective review of national security activities must include both parliamentary and expert review, and the latter must include both national security and privacy experts. Why privacy experts? Because the work of national security agencies depends in large part on personal information. It is what they call their “lifeblood”. The OPC is the federal centre of expertise in privacy and personal data protection. Canadians are concerned that anti-terrorism efforts in government not unduly impede their privacy rights, and they expect my office to play a role in ensuring that balance.
Bill C-59 is oddly silent on the role of my office. It does not amend the Privacy Act, so my existing authorities appear to be untouched. The only body with explicit authority to play a role in relation to part 5, the renamed SCIDA, or security of canada information disclosure act, is the NSIRA, the national security and intelligence review agency.
The ethics committee, in its study of SCISA, has already noted the ambiguity in the interplay between that act and the Privacy Act. It has called for amendments to clarify that the Privacy Act continues to apply to all personal information disclosed pursuant to SCISA. I have provided to your committee amendments that would confirm the application of the Privacy Act and the OPC's role, which I am told the government wants to maintain.
However, there is no ambiguity on whether my office would be able, with Bill C-59, to share confidential information with the NSIRA and the new committee of parliamentarians. We would not have that authority, and actually we would be prohibited by existing provisions in the Privacy Act from sharing such information.
This means that the comprehensive review process offered in Bill C-59, as a fundamental element to bring balance between security and respect for rights, would stop short of the objective by leaving privacy experts out of integrated review. I am at a loss to understand why. If the fear is of duplication between our work and that of other review bodies, I would gladly explain through the question period how bringing the OPC firmly within the family of review bodies would not only bring required expertise but would actually enhance efficiency and reduce overlap.
When Bill C-51 enacted the Security of Canada Information Sharing Act, known as SCISA, I indicated that among my concerns was the fact that the relevance standard for sharing was set too low, and that there was an absence of clear data retention and recordkeeping requirements and a lack of information-sharing agreements and privacy impact assessments.
The relevance test is too permissive because it casts too wide a net and creates undue risks for ordinary citizens who pose no threat to national security. The government seems to recognize that a relevance standard does not sufficiently protect privacy because it is suggesting changes to section 5 of SCISA.
In its response to the Standing Committee on Access to Information, Privacy and Ethics, the government said the following:
The key issue regarding the threshold is the need to establish specific decision making parameters for the discloser of information that will protect individual privacy but not cause undue delays in the information sharing process.
I agree with that assessment. The proposed new section 5, particularly paragraph 5(1)(b), incorporates some aspects of a necessity threshold but falls short of adopting what officials refer to as “strict necessity”.
In order to adequately protect privacy rights, under new section 5, this limited progress in increasing the threshold for disclosure would have to be accompanied by more complete changes to the standard applicable to receiving institutions, in other words, the security agencies receiving the information in question.
Information sharing involves two parties and, to protect rights, rules are also required for receiving institutions. If relevance is not adequate for disclosing institutions, it is also inadequate, even more so, for receiving agencies.
And the delay considerations that may apply to disclosure affect receiving departments very differently. These institutions are perfectly capable of applying the classic, internationally established necessity test, and should be required to do so.
We understand that the government intention is for receiving institutions to continue to be governed by the Privacy Act, or their specific enabling legislation where applicable. The current Privacy Act threshold is relevance.
As your committee recommended in its May 2017 report on Canada's national security framework, we also recommend that a dual threshold be adopted for information sharing—that set out in amended section 5 for disclosing institutions, and that of necessity and proportionality for receiving institutions.
Even if one accepts that government sharing of information related to law-abiding citizens may lead to the identification of new threats to national security, once that information is analyzed and leads to the conclusion that someone is not a threat, it should no longer be retained. Otherwise national security agencies will be able to keep a profile on all of us.
This is consistent with the conclusions of our review of the Canada Border Services Agency's scenario-based targeting initiative, summarized in my latest annual report to Parliament, and it is one of the principles upheld by the European Court of Justice in the passenger name and record case, decided in July 2017.
In addition, if the threshold for collecting or receiving information is higher than the standard for disclosure—which is currently the case at least for CSIS and would be the case if you adopt a dual threshold, that is, one for disclosing institutions and one for receiving institutions—then, rules are required to ensure that information is discarded without delay either when the collection test is not met or if the receiving institution is of the view that the disclosure standard was not satisfied.
In conclusion, my complete recommendations, annexed to this statement, include some that I have made in the past and do not have time to explain in the time allotted this morning. I also intend to write a fuller submission prior to the end of your study.
My team and I would be glad to answer any questions you may have.
Liberal
Liberal
Julie Dabrusin Liberal Toronto—Danforth, ON
Thank you for that. I appreciate that you have provided us with specific recommendations.
Last night I was reviewing the Air India inquiry recommendations and trying to get a sense, against that backdrop where 329 people were killed, of where their recommendations specifically pointed to problems with a lack of information sharing and yet understanding that there are many concerns in balancing privacy in that framework. With this set of questions I'm trying to figure out where we meet that balance.
You go quite a bit that way, talking about the required expertise you can bring to help us reach that balance. You touched on it and said you might be able to give us more information about that in the questions, so I am going to open that to you. Where do you see your expertise coming in to help us reach that balance? Where would you have us slot that in? Ultimately, we're going to have to be reviewing this legislation on a clause-by-clause basis. What would be the main recommendations you have listed that you think can bring that expertise?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I start my analysis with the need to have good, clear, sufficiently high legal standards, including thresholds. That's where the issue of relevance for contributing to the mandate or being necessary comes in, so there are substantive legal safeguards.
The second element of well-balanced national security legislation requires strong, independent, effective review. On the substantive legal safeguards side, I accept that to apply the necessity test may pose problems for disclosing institutions, which is the main point the government made in responding to the ethics committee, and which may have been a contributing factor to your committee when you suggested a dual threshold.
I accept that a threshold lower than necessity helps disclosing institutions do a difficult task while having safeguards. However, receiving institutions—essentially national security agencies—know very well what their mandate is and what they need to do their job. There, the necessity threshold, which is the international norm, should apply fully.
That's the main substantive recommendation I'm making, which is again where this committee was at not long ago.
The second substantive rule is as follows. If there is a difference between the thresholds applicable to disclosing and receiving institutions which would be the result of a dual threshold, it's easier for disclosing institutions to disclose, but the threshold for receivers is higher. Point one is, what do we do about this gap, if the receiving institution has received something that is not necessary?
Point two is, if the receiving institution has received information about a law-abiding citizen—travellers are the best example—to identify in the mass of travellers the extremely few who may pose a threat to national security, there should be legal rules to require the receiving institution to get rid of the information, to destroy the information, to no longer retain the information if there's a gap between the two thresholds, or if, in relation to a given individual, the analysis leads to the conclusion that the person is not a threat and therefore that their information should not sit in the records of CSIS or the CSE or the intelligence apparatus. These are the substantive rules.
In terms of effective review, it is clear that the creation of the new NSIRA is an important improvement. The fact that it will be able to share information with the committee of parliamentarians creates a good step in the right direction, in that you have integrated review applicable to all departments—not only three as at the current time—and you have elected officials and experts who can talk to one another and reach a well-informed decision.
What we think we can bring to the picture—and we're not in the picture, at least not completely—with Bill C-59 is that the lifeblood, la matière première, the main tool that national security agencies have to do their job is information, and that includes personal information. We're the experts in how to deal with personal information in a way that respects privacy rights. We're not saying that NSIRA would be without any knowledge of the relevant issues, but there is an issue of core importance to the work of national security agencies, that of privacy, where we're the experts, and we think we can add value to the rest of the architecture.
Liberal
Julie Dabrusin Liberal Toronto—Danforth, ON
Thank you. I only have 45 seconds.
I see you have provided some recommendations as to effective review and oversight. I was wondering if you might be able, when you're providing your written submissions later, to flesh out how you see your interconnection with the NSIRA. Where do you see us slotting that, in your preferred situation?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
In a few words, I would say that I have a broad mandate, which goes well beyond national security, and I have limited resources. If only for that reason, we cannot afford to be involved in national security activities as the NSIRA would be, whose only task would be that.
We need to be able to have discussions with NSIRA on where we fit best and in which cases our expertise would be of most value, on the basis that for the most part, they would do the review, but that there will be cases in which we can add value because privacy will be particularly important.
Conservative
Pierre Paul-Hus Conservative Charlesbourg—Haute-Saint-Charles, QC
Thank you, Mr. Chair.
Good morning, Mr. Therrien.
We agree that, when it comes to the threat posed by terrorism, 9/11 was the tipping point for the public.
Last year, I visited NORAD headquarters. Although it concerned a military issue, you will see the connection. The people at NORAD, in Colorado Springs, told us that, prior to 9/11, they dealt with threats originating outside the U.S. and that the federal aviation agency was responsible for domestic threats. According to the commander in charge, after 9/11, the two organizations never hung up the phone. The communication and connection remained constant.
That leads me to the following question. In March 2015, you said that Bill C-51 would allow too many federal government agencies—up to 17—to share information. Do you still think the information sharing involving those organizations is too broad?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I was a government lawyer at the time, and I was responsible for national security and public safety issues for nearly 10 years afterwards. I am very cognizant, then, of those considerations.
Coming back to what I said in 2015, I would agree that information sharing is necessary for national security agencies to be effective. In 2015, when I referred to the involvement of multiple agencies, I did not mean that a certain number of agencies should not be permitted to share information. Rather, I wanted to draw attention to the flaws in the review mechanism, which applied only to three of the 17 receiving agencies. I don't believe I said that information sharing should not be permitted or that 17 agencies was too many. The point I was trying to make was that, if 17 agencies were receiving information in order to do their jobs, they should all be subject to independent oversight.
Conservative
Pierre Paul-Hus Conservative Charlesbourg—Haute-Saint-Charles, QC
In your brief, you say that “Canadians are concerned that anti-terrorism efforts in government not unduly impede their privacy rights”. Why do you believe that Canadians are concerned? My impression is actually that Canadians are concerned about security. You, however, maintain that anti-terrorism measures cause privacy concerns among Canadians. Can you cite any sources to back up that statement?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes, Canadians are concerned about both of those issues.
We regularly receive correspondence from people, and surveys done over the years show without a doubt that people are worried about their security. That is clear. A number of studies show that, despite that worry, which is normal, Canadians expect the government and Parliament to simultaneously protect their security and their rights, especially their privacy rights. A number of surveys demonstrate that to be true.
Conservative
Pierre Paul-Hus Conservative Charlesbourg—Haute-Saint-Charles, QC
Would it be possible for you to provide copies of those surveys to the committee? It would be useful to take a close look at them.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
Conservative
Pierre Paul-Hus Conservative Charlesbourg—Haute-Saint-Charles, QC
Later on, in your remarks, you call the relevance test “too permissive”, saying that it “creates undue risks for ordinary citizens who pose no threat”. The problem with terrorism is that, technically speaking, everyone is a potential threat. How are we supposed to differentiate between an ordinary citizen who poses no threat to national security and someone who does?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I am aware of the challenge. That is why I say that the sharing and fairly broad collection of information for the purpose of identifying threats is reasonable provided that, once the information is analyzed and leads to the conclusion that the vast majority of people do not pose a threat, it is destroyed. That way, security agencies will not have numerous profiles on people who are not threats.
It is fine to begin with a funnel-like approach and focus on a certain number of people, many of whom are not threats, and then come to an appropriate conclusion. Therefore, once it has been concluded that the vast majority of those people are not threats, their information should be destroyed.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Is the purpose of the bill reasonable? What do you mean by purpose?
What I mean is that the purpose of compiling information in order to analyze and identify threats is fine. I am saying, though, that, once an analysis of the information leads to the conclusion that the vast majority of people are not threats, there need to be consequences and agencies should not have the discretion to decide whether or not to retain the information. Clear legal rules governing the destruction of information are necessary to protect people's privacy.
Conservative
Pierre Paul-Hus Conservative Charlesbourg—Haute-Saint-Charles, QC
I want to come back to the collection of information. When Bill C-51 was introduced, people were worried about intelligence agencies being able to spy on their computer activities. They wondered just how much agencies would be able to invade their privacy.
Do you currently see that as a problem? Do you think Canadians are subject to an excessive invasion of their privacy?
Do you think our intelligence agencies are likely to spy on our computer activities?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We reviewed the operationalization of the Security of Canada Information Sharing Act, but, on the whole, we noted no such invasion.
My concern has more to do with the legal standards. We are not experts. The Security Intelligence Review Committee, or SIRC, actually assesses that on an ongoing basis. Other oversight agencies do as well.
Our review of the operationalization of the Security of Canada Information Sharing Act did not reveal any such invasions of privacy. The point I am trying to make actually pertains to the legal standards.
Liberal
NDP
Matthew Dubé NDP Beloeil—Chambly, QC
Thank you, Mr. Chair.
Mr. Therrien, I want to thank you and your team for being with us today.
My question has to do with the Canada Border Services Agency, or CBSA for short.
On the one hand, should the agency have an oversight body? It isn't the only organization that Bill C-59 excludes.
On the other hand, should we broaden the scope of the bill to include those organizations in national security matters?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
As far as I know, from a national security standpoint, CBSA does fall under the jurisdiction of the newly created body, the National Security and Intelligence Review Agency.
Is there a need to subject CBSA to oversight in relation to other matters? The question bears asking, since it is something that would certainly be welcome. Nevertheless, CBSA's national security activities do fall under the jurisdiction of the National Security and Intelligence Review Agency.
NDP
Matthew Dubé NDP Beloeil—Chambly, QC
CBSA is unlike other agencies in that it deals with travellers crossing the border as part of its day-to-day operations.
Does it raise any concerns that only CBSA's operations involving national security are subject to oversight? It could become difficult to distinguish between an action taken in the name of national security and one taken in the exercise of its mandate?