Necessity is, as the Privacy Commissioner said, a very well-regarded and internationally accepted standard, so I would start with that. If the sending agency is insufficiently attuned to possible security implications, then someone should make sure that they know about that and are in a position to administer whatever standard it is, whether it is necessity or whether it is relevance.
One of the recommendations of the Air India commission, and I should mention that I was the research director of legal studies for that commission, was that we needed a more proactive role at the centre to make sure all the agencies involved in national security worked together.
I don't think you can fix this problem simply by having a fairly low standard for the sending agency. It seems to me that if something is necessary for security reasons, then whether you're in the agricultural department, the CBSA, or wherever, you should have appropriate training and awareness, and appropriate intelligence briefings, so that you will be able to make that call correctly.