Public Safety Committee on Dec. 7th, 2017

[Daniel Therrien]

I think all review bodies should be sufficiently resourced, which does not mean necessarily a huge infusion of resources, but they should be able to do their job properly. Whether something is red tape or necessary review, I guess, is in the eye of the beholder. At this point, given the level of resources that SIRC, the CSE commissioner, and I have, with my limited resources, I would not talk about red tape. We're talking about 20 people, at the most. This is not red tape. This is necessary review. We need sufficient resources to do that job adequately.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Okay, thank you.

Three inquiries—Air India, Arar, and the O'Connor decision—have identified sharing information and communicating threats as critical to having an effective national security team. You have indicated, certainly, that you agree with that.

With this new national security and intelligence review agency, can some of the overall issues you have found with procedure and reporting be fixed?

[Daniel Therrien]

With procedure reporting?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Procedure and reporting: can those things be shored up with this new review agency?

[Daniel Therrien]

Absolutely. NSIRA is a very important step forward, in part because its jurisdiction encompasses all departments and agencies involved in national security, which is a flaw of the current system.

What I'm recommending is that our expertise be added to this mix so that the sum total of expert review and parliamentary review is able to give Canadians the assurance that both their security and their rights are protected.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Would you characterize proactive collection or centralized intelligence as a threat to privacy?

[Daniel Therrien]

I'm not sure what you mean by proactive and centralized. I answered Mr. Paul-Hus to say I agree that the collection of information, including that of some who are not a threat, can be useful to actually identify threats.

If that's what you mean by proactive, yes, I agree with that, so long as there are safeguards to ensure that the privacy of those who are not threats is not at risk.

[The Chair, Liberal, John McKay]

Thank you, Mr. Motz.

Mr. Spengemann, you have five minutes.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Mr. Therrien, thank you for being here with your staff, and for your expertise and testimony.

I'd like to build briefly on the question my colleague, Mr. Picard, asked you in the form of an example to make it concrete for the committee, but also for Canadians who are listening now or are reviewing your testimony in the future.

Could you give us an example of a case from the area of security that would highlight how the application of relevance, necessity, and proportionality would unfold, perhaps an example that both meets and then, in an extrapolation, exceeds the threshold of each of these so there's a better understanding on the part of the Canadian public as to what analysis is actually taking place here?

[Daniel Therrien]

The best example would be, again, that of travellers. The information about travellers, many of whom are not a risk to national security, may be relevant and may contribute to the mandate of the receiving agency, to use the words of the new section 5, because in the mass of travellers there might be some who are a threat. To have information on a more permissive relevancy or contribution standard may be acceptable at the front end. However, when that information is then received and analyzed by the national security agency and the agency determines that the individual is not a threat, on what basis should the information be used and, moreover, retained by the agency? The retention of information about 99.9% of the travellers who are not a threat is not necessary to its work, to its mandate.

In looking at Bill C-59 as a whole with all of its parts, I'm struck by the fact that parts 3 and 4 have essentially the standards. I understand that relevance and necessity are somewhat esoteric notions, but in parts 3 and 4, the government and you as parliamentarians are seized with a bill that recognizes that there is a need for the higher necessity threshold in some circumstances.

CSIS and the CSE will not be able to use and exploit the personal information of individuals unless it meets a necessity test. If it's good for parts 3 and 4, I'm saying it should be good for part 5.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Okay.

In your view, is there a risk of collecting irrelevant information at the outset? You're advocating for a broad funnel, the way I understand it, at the beginning. What kind of information might be irrelevant, and is there a risk of collecting irrelevant information?

[Daniel Therrien]

If the necessity threshold for the receiving institution is higher, yes, it will receive irrelevant information, but only for a fleeting period. That may be a price to pay for the fact that in that large basket of information, some information may be relevant.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

So we shouldn't really be concerned with the quality of the irrelevant information. There's no categorical concern—

[Daniel Therrien]

I wouldn't say we should not be concerned at all, but I see safeguards, including reliability of the information in the bill which are useful. I'm less concerned at the front end, the disclosing end, than I am at the receiving end.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Thank you very much for that.

My second question goes into the area of youth and the criminal justice system. As you know, in counterterrorism work or terrorism generally, youth are often the target for radicalization efforts by such entities as al-Shabab, or Abu Sayyaf for ISIS, and youth are vulnerable in many ways with respect to data as well. Clause 159 of the bill brings the Youth Criminal Justice Act into play on the criminal justice side of things.

What concerns, if any, do you have from the privacy side that are specific to Canadian youth?

[Daniel Therrien]

I confess that we haven't paid much attention to this, but we will, and we will address that question in our ultimate submission.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

I'd be grateful. Thanks very much.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Are you in a position to comment on whether there will be judicial review of decisions made by the intelligence commissioner? Judicial review is an important component of accountability and ultimately privacy as well. Would he or she be subject to judicial review, in your assessment?

[Daniel Therrien]

I haven't thought this through in detail, but the intelligence commissioner is an interesting, new creation. It is more of an oversight body. It reviews matters before the fact, as opposed to after the fact. It's a bit novel and it's a different position from, say, the current SIRC, which is clearly subject to judicial review.

I would say probably, yes.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

If you could add your thoughts into your written submissions, I think that would be helpful to the committee as well.

Thank you, Mr. Chair.

[The Chair, Liberal, John McKay]

Thank you, Mr. Spengemann.

Mr. MacKenzie, you have five minutes, please.

[Dave MacKenzie, Conservative, Oxford, ON]

Thank you, Commissioner, and your panel for being here today.

I'm intrigued by your comments about 90 days for the destruction. How broad is that across agencies when they look at their information and within 90 days they don't see any value? Is that when you would suggest the destruction period would occur?

[Daniel Therrien]

The 90-day period in Bill C-59 applies to the specific situation of the collection of datasets by CSIS. In a model where it's conceivable that more information may be required at the front end, but an exercise is required to funnel this to less information at some point, it's important that this period of analysis not be too long so as to give time to security agencies to do the analysis they need to do.

Ninety days strikes me as a very reasonable period. Should it be 90 days throughout regardless of whether it's CSIS, CSC, or others? We would have to look at it, but 90 days is a good rule of thumb.

[Dave MacKenzie, Conservative, Oxford, ON]

From a practical, operative view, that may be a short period of time. I only have to look back to the more recent situation in New York City with the motor vehicle running down people on the street, and the British went back and looked at their records and determined that they had missed something in a telephone call that would have been helpful. I don't know whether it was 90 days or more, but it just seems that frequently it's the necessity to go back maybe a bit longer, and then make the connections not only directly to that, but to other events.

[Daniel Therrien]

Absolutely. There's no magical solution here. It's a question of balancing the value of the information and how long agencies should have to analyze it. Obviously the delay cannot be so long as to result in the creation of profiles or dossiers on all of us forever.

I'll note that for the CSIS provision in part 4, after 90 days the court doesn't base its determination on necessity, but rather on whether the information can be useful. It's a threshold, but we're not yet at the necessity stage. It's when this bank of information is then queried by officers that the necessity threshold applies.

I think there's room for CSIS in the regime for information that may not be clearly necessary at that point to be kept. It can be useful, but it will only be queried by CSIS officers at the back end, on a necessity threshold.