Thank you, Mr. Chair.
Mr. Chair and members of the committee, I am here this morning with Patricia Kosseim, who is our general counsel, and Lara Ives, who is the director general of audit and review.
Thank you for the invitation to discuss Bill C-59.
As you know, Bill C-59 introduces a wide range of measures intended to strengthen Canada's national security framework in a manner that safeguards the rights and freedoms of Canadians. On the whole, I find it represents a step in the right direction, but as other commentators have noted, its weakest part is the Security of Canada Information Sharing Act, or SCISA, which contains provisions related to information sharing and privacy. Professor Forcese, for instance, gave these sections a failing grade. I was therefore glad to hear Minister Goodale last week say that SCISA was probably the part most deserving of scrutiny. I hope your study will result in much-needed improvements to these rules.
In previous parliamentary briefs, I highlighted the need for rigorous legal standards around the collection and sharing of personal information, effective oversight, and minimization of risks to the privacy of ordinary law-abiding Canadians, particularly through privacy-sensitive retention and destruction practices. Specifically, I indicated that the law should prescribe two things essentially, which are useful to bear in mind. First is clear and reasonable standards for the sharing, collection, use and retention of personal information”, so substantive rules. Second is that compliance with these standards should be subject to independent and effective review mechanisms.
It is with this analysis in mind that I offer the following comments and recommendations. While I will focus in my remarks on SCISA, this analysis, looking at two types of issues, is also relevant for other parts of Bill C-59, including parts 3 and 4. The full list of our recommendations is attached to this statement.
Bill C-59 would create a new expert review body, the NSIRA, with broad jurisdiction to examine the activities of all departments and agencies involved in national security. Recently, Parliament also created, through Bill C-22, a new National Security and Intelligence Committee of Parliamentarians. Both of these bodies will be able to share confidential information and generally co-operate so as to produce well-informed and comprehensive reviews that reflect considerations both by experts and by elected officials.
These developments are most welcome, but they are, in my view, clearly insufficient. In my view, effective review of national security activities must include both parliamentary and expert review, and the latter must include both national security and privacy experts. Why privacy experts? Because the work of national security agencies depends in large part on personal information. It is what they call their “lifeblood”. The OPC is the federal centre of expertise in privacy and personal data protection. Canadians are concerned that anti-terrorism efforts in government not unduly impede their privacy rights, and they expect my office to play a role in ensuring that balance.
Bill C-59 is oddly silent on the role of my office. It does not amend the Privacy Act, so my existing authorities appear to be untouched. The only body with explicit authority to play a role in relation to part 5, the renamed SCIDA, or security of canada information disclosure act, is the NSIRA, the national security and intelligence review agency.
The ethics committee, in its study of SCISA, has already noted the ambiguity in the interplay between that act and the Privacy Act. It has called for amendments to clarify that the Privacy Act continues to apply to all personal information disclosed pursuant to SCISA. I have provided to your committee amendments that would confirm the application of the Privacy Act and the OPC's role, which I am told the government wants to maintain.
However, there is no ambiguity on whether my office would be able, with Bill C-59, to share confidential information with the NSIRA and the new committee of parliamentarians. We would not have that authority, and actually we would be prohibited by existing provisions in the Privacy Act from sharing such information.
This means that the comprehensive review process offered in Bill C-59, as a fundamental element to bring balance between security and respect for rights, would stop short of the objective by leaving privacy experts out of integrated review. I am at a loss to understand why. If the fear is of duplication between our work and that of other review bodies, I would gladly explain through the question period how bringing the OPC firmly within the family of review bodies would not only bring required expertise but would actually enhance efficiency and reduce overlap.
When Bill C-51 enacted the Security of Canada Information Sharing Act, known as SCISA, I indicated that among my concerns was the fact that the relevance standard for sharing was set too low, and that there was an absence of clear data retention and recordkeeping requirements and a lack of information-sharing agreements and privacy impact assessments.
The relevance test is too permissive because it casts too wide a net and creates undue risks for ordinary citizens who pose no threat to national security. The government seems to recognize that a relevance standard does not sufficiently protect privacy because it is suggesting changes to section 5 of SCISA.
In its response to the Standing Committee on Access to Information, Privacy and Ethics, the government said the following:
The key issue regarding the threshold is the need to establish specific decision making parameters for the discloser of information that will protect individual privacy but not cause undue delays in the information sharing process.
I agree with that assessment. The proposed new section 5, particularly paragraph 5(1)(b), incorporates some aspects of a necessity threshold but falls short of adopting what officials refer to as “strict necessity”.
In order to adequately protect privacy rights, under new section 5, this limited progress in increasing the threshold for disclosure would have to be accompanied by more complete changes to the standard applicable to receiving institutions, in other words, the security agencies receiving the information in question.
Information sharing involves two parties and, to protect rights, rules are also required for receiving institutions. If relevance is not adequate for disclosing institutions, it is also inadequate, even more so, for receiving agencies.
And the delay considerations that may apply to disclosure affect receiving departments very differently. These institutions are perfectly capable of applying the classic, internationally established necessity test, and should be required to do so.
We understand that the government intention is for receiving institutions to continue to be governed by the Privacy Act, or their specific enabling legislation where applicable. The current Privacy Act threshold is relevance.
As your committee recommended in its May 2017 report on Canada's national security framework, we also recommend that a dual threshold be adopted for information sharing—that set out in amended section 5 for disclosing institutions, and that of necessity and proportionality for receiving institutions.
Even if one accepts that government sharing of information related to law-abiding citizens may lead to the identification of new threats to national security, once that information is analyzed and leads to the conclusion that someone is not a threat, it should no longer be retained. Otherwise national security agencies will be able to keep a profile on all of us.
This is consistent with the conclusions of our review of the Canada Border Services Agency's scenario-based targeting initiative, summarized in my latest annual report to Parliament, and it is one of the principles upheld by the European Court of Justice in the passenger name and record case, decided in July 2017.
In addition, if the threshold for collecting or receiving information is higher than the standard for disclosure—which is currently the case at least for CSIS and would be the case if you adopt a dual threshold, that is, one for disclosing institutions and one for receiving institutions—then, rules are required to ensure that information is discarded without delay either when the collection test is not met or if the receiving institution is of the view that the disclosure standard was not satisfied.
In conclusion, my complete recommendations, annexed to this statement, include some that I have made in the past and do not have time to explain in the time allotted this morning. I also intend to write a fuller submission prior to the end of your study.
My team and I would be glad to answer any questions you may have.