Proceedings of the Standing Senate Committee on
National Security and Defence
Issue No. 33 - Evidence - Meeting of November 21, 2018
OTTAWA, Wednesday, November 21, 2018
The Standing Senate Committee on National Security and Defence, to which was referred Bill C-21, An Act to amend the Customs Act, met this day at 12:02 p.m. to give consideration to the bill.
Senator Gwen Boniface (Chair) in the chair.
[English]
The Chair: Honourable senators, welcome to the Standing Senate Committee on National Security and Defence. Before we begin, I will ask my colleagues to introduce themselves.
[Translation]
Senator Dagenais: Jean-Guy Dagenais from Quebec.
[English]
Senator Coyle: Mary Coyle, Nova Scotia.
Senator Oh: Victor Oh, Ontario.
Senator Richards: David Richards, New Brunswick.
[Translation]
Senator McIntyre: Paul McIntyre from New Brunswick.
[English]
The Chair: I am Senator Gwen Boniface from Ontario.
This afternoon we are continuing our study of Bill C-21, An Act to amend the Customs Act. I want to thank Senator Dagenais, the Chair of the Subcommittee on Veterans Affairs, for allowing us to use this time slot. Thank you.
Today we have before us Daniel Therrien, Privacy Commissioner of Canada, accompanied by Lara Ives, Director, Government Advisory Directorate.
Mr. Therrien, you have the floor, to be followed by questions. Welcome.
[Translation]
Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada: Thank you, Madam Chair and committee members. I would like to thank you for the invitation to speak about Bill C-21, An Act to amend the Customs Act. I am generally satisfied that this border management issue is based on important public policy objectives and the personal information in question is not particularly sensitive.
That being said, it is important that the information to be collected under the entry/exit program is processed prudently, in accordance with appropriate agreements and procedures. This is especially true about information retention and, in the interest of time, I am going to focus my remarks on this issue.
I understand why the house passed an amendment aimed at placing reasonable limits on the retention of exit information to be collected by the Canada Border Services Agency, the CBSA. In my appearance before the house committee studying this bill, I had spoken about the need for institutions to clearly justify retention periods. Personal information should be retained only so long as necessary to achieve relevant statutory purposes, those of the CBSA or those of the institutions with which CBSA will share exit information.
It would appear that the intent of the house amendment, adding a new section 93.1 to the Customs Act, was to impose a 15-year limit on the retention of exit information. However the wording adopted does not clearly convey that objective and, in fact, could lead to interpretations that may harm privacy.
[English]
The proposed new section 93.1 states that exit information collected under the new legislation “shall be retained for 15 years,” subject to section 6 of the Privacy Act. My concerns with this wording are twofold.
First, the proposed section 93.1 effectively functions as a minimum and not as a maximum. The words “shall be retained for 15 years” clearly indicate that information cannot be destroyed before the end of the 15-year period. Then there are no words in the provision to prescribe what happens after the end of the period. Therefore, the information can be kept longer.
My second concern is that it is unclear whether the proposed section 93.1 applies only to CBSA, which may have been the intention. Given that the amendment refers to information that has been “collected under sections 92 and 93” — that is, collected under the exit program — one interpretation is that the 15-year retention period follows the information so collected by CBSA even in the hands of another government institution with which exit data is then shared. This interpretation could have the effect of lengthening retention periods for some departments, such as those intending to purge non-relevant data immediately after collection. I will have an example of that in a second.
We were informed by CBSA officials recently that the interpretation I have just mentioned is not their interpretation. They interpret section 93.1 as applying only to CBSA. In their view, if exit information is then shared by CBSA with another institution, that other institution will collect it under its own authority and the retention period will be that governing the latter collection.
If the interpretation of CBSA officials holds, then the 15-year minimum retention period would apply only to the agency. Retention periods governing other institutions would be unaffected by Bill C-21. Some of these retention periods would be longer than 15 years, others shorter.
However, if as we fear the minimum 15-year period follows the information even in the hands of other institutions, then section 93.1 would have the effect of lengthening the period during which these institutions would have to retain the information.
For example, exit data will be shared with Employment and Social Development Canada for the purpose of verifying Employment Insurance eligibility. Our understanding is that before the amendment, the data was to have been immediately purged by ESDC in instances where it would not lead to Employment Insurance ineligibility. Under the interpretation we fear may be given to section 93.1, ESDC would be required to keep the data for 15 years, as the data was, to quote the provision, “collected under sections 92 and 93.”
Retention periods shorter than 15 years would still be possible under this interpretation of 93.1 if regulations made under section 6 of the Privacy Act prescribed a shorter period. The provision says that the information shall be retained for 15 years subject to section 6 of the Privacy Act. However, we know of no plans to make such regulations, and we have verified with Treasury Board on that point.
In conclusion, although the intent of the house amendment was apparently to prescribe a maximum retention period that sought, in part, to protect privacy interests of travellers while giving government institutions sufficient time to complete investigations, the amendment could actually weaken privacy rights.
It would be desirable, in my view, to achieve greater legal certainty to amend section 93.1 to clarify that it applies only to CBSA and that it is a maximum period.
As for retention periods for institutions that receive information collected initially by the CBSA, including ESDC, these periods should be guided by the principle outlined at the outset of my statement; that is, that personal information should be retained only so long as necessary to achieve each specific statutory purpose. If the law allowed for such a sliding scale according to the laws governing the recipient institutions, then I would have no objections.
Thank you, Madam Chair. I look forward to your questions.
The Chair: Thank you.
[Translation]
Senator Dagenais: Thank you, Mr. Therrien. If I understand correctly, after the bill is passed, we will find out from the government the rules for using the data that will be collected. Is that not a little late if we want to make meaningful comments and if corrections need to be made to the collections of data?
Mr. Therrien: In my statement, I talked about the retention period, whereas you are talking about the use that different departments could make of the information collected by the CBSA.
Bill C-21 slightly broadens the potential uses of the information, such as the Employment Insurance program, for example. However, the purposes for which this information could be used are already very broad and the bill that you are studying at the moment does not broaden them much further. I know that some witnesses who have testified before you are concerned by the issue
One might be concerned by how broad the possible uses are under the current legislation, unamended by Bill C-21, but that reverts to the status quo. That is one part of my answer.
The other part of the answer is the procedural aspect. Then government has told us that, if new uses are made of the information under this legislation, which gives it some room to manœuvre, the CBSA has made the commitment that the agency and the government would advise us and give us the opportunity to provide our comments on the uses, how reasonable they are, and their proportionality in terms of assessing privacy issues. That process is called a privacy impact assessment.
The agency was responsible in the consultations it had with our office on the implementation of the entry/exit program. They committed to advise us 120 days, four months, before new programs and new uses go into effect. That mechanism is intended to limit the risks.
That being said, you are right to say that the act allows the use of that information for various purposes, some of which are very broad, but there are procedural mechanisms to reduce the risks.
Senator Dagenais: Will members of the public be able to check the information gathered and retained on them for 15 years, are we saying? Will they be able to say, “Here is the personal information of mine that they have retained“?
Mr. Therrien: The bill before you talks about collecting half a dozen new pieces of personal information. This information is relatively non-sensitive and quite normal in a border management situation. To your question as to whether members of the public will be able to find out the information collected by the government under this program, the answer should be yes. I will ask Ms. Ives to tell us about the government’s commitments in that respect.
The information items are relatively few and non-sensitive. Personally, I would go further than your statement in saying that the government should demonstrate transparency in the use of that information. This is where publishing the privacy impact assessments would be very useful for the public in understanding the purposes for which the government will be using that information.
Lara Ives, Director, Government Advisory Directorate, Office of the Privacy Commissioner of Canada: I would like to answer in English, if I may.
[English]
Pursuant to the Privacy Act, individuals are allowed to request access and correction to their personal information held by a government institution. Anything that CBSA holds on them would come under that, but as far as what the U.S. government would hold on them, that wouldn’t fall under the Privacy Act.
[Translation]
Senator Dagenais: Can you give us some examples of the amount of information that can be exchanged between Canada and United States? Basically, the border we cross most often is with the United States. What can we do to find out if everything shared between the two countries is really appropriate?
Mr. Therrien: Let me answer in two ways. First, I remind you that information collected by the agency and probably exchanged with the United States under the bill that you are considering is made up of a half-dozen relatively non-sensitive items. That data identifies people crossing the border and whether they could be connected to other information that the two governments potentially may have exchanged about them.
In addition, that is not the purpose of the bill. Nothing changes in the intergovernmental practices, but the fact remains that a significant quantity of information can be exchanged between the two governments about certain persons of interest to those governments. There are information-sharing agreements that are important in this field. We have asked to play a role in studying those agreements. The government has consulted us on some of those agreements. Guaranteeing the protection of privacy is partly the role that the Office of the Privacy Commissioner of Canada can play, by providing comments when the agreements are concluded.
However, in terms of the reform of the Privacy Act, we have asked for the requirement to consult us to be a legal requirement, because, in actual fact, it is not always observed. We want it to be important, but we may be going beyond the scope of the bill we are dealing with.
Senator Dagenais: Thank you very much.
[English]
Senator Oh: Thank you, Mr. Therrien, for your very informative presentation.
We all know that it is essential that we find the right balance between our safety and our rights. I have been approached by numerous immigrants regarding their prolonged process on verifying their residency requirements. Some could take up to five to 10 years. One person told me he sent in seven kilos of documents, including hydro bills, invoices, bank statements and whatever he could find, to prove his residency.
Without the exit information, it’s hard for immigration officers to determine their eligibility in immigration programs. I hope that Bill C-21 will make it easier for them to show how long they’ve been staying in Canada to meet their residency requirements.
What should be done to make sure their privacy is protected? Who would be entitled to have access to the data obtained? In what cases would the data collected be purged? And what about dual citizenship? We have a lot of dual-citizen immigrants in Canada.
Mr. Therrien: You ask a number of questions of principle but, if I understand correctly, particularly in the context of the use of the information on entry and exit by immigration authorities in verifying that residency requirements are respected and potentially that the individual is eligible for citizenship.
When you go to the principles, does it make sense? Is it reasonable for the government to collect information about exits to have a better understanding of whether an individual is in Canada or not? If that is a criterion for maintaining residency and potentially obtaining citizenship, I think the answer is yes, it makes sense. Potentially, it would reduce the need by immigration authorities to collect all kinds of secondary information like phone bills, electricity bills and so on to prove that one has been actually residing in Canada. I think that’s one good example of why the bill, in principle, makes sense.
Then issues arise around how the government, in its various departments, manages the information in question. How long is it retained? Who protects it? These are all excellent questions. I think one issue is retention: How long should the information be retained?
The house has adopted an amendment, which I think was meant to limit the period of retention for 15 years, which should be sufficient for the purpose that you outline. I’m not sure that the objective has been achieved, so that’s a bit unfortunate, leading to my recommendation that the law be clarified.
I hope that somewhat answers your questions.
Senator Oh: Do you think 10 years is long enough? If a person is in question, could his file be extended to 15 years?
Mr. Therrien: Bear with me, because the answer involves a number of departments.
The exit information is collected by CBSA, which will then share it with a number of other departments that will use it for their own programs. Each recipient department may need it for a shorter or a longer period, depending on its needs.
Immigration authorities will need to retain the information only so long as to determine residency requirements, citizenship and so on. Fifteen years, from that perspective, is probably too long because I think the person has to be in Canada three of the last five years, if I’m not mistaken. So 15 years appears to be too long.
However, CBSA collects the information and also sends it, say, to the RCMP for the purpose of criminal investigations, some of which may take a long time to be completed, such as a murder investigation. Fifteen years in that case may be too short.
The difficulty in setting the retention period is that there should be a retention period for CBSA, but then the rules should be clear on what the retention period should be by recipient institutions. And there will be very many of these recipient institutions. For immigration, it’s probably shorter; for the RCMP, it’s perhaps longer.
Senator Oh: We share information with the United States. Do we know the ins and outs of immigration in the United States in the same computer network as we are in?
Mr. Therrien: I believe the networks are different, but there’s a certain amount of information sharing between the two countries. I do not think it is the same system.
Senator Oh: Thank you.
[Translation]
Senator McIntyre: Thank you for coming to answer our questions, Mr. Therrien, and for clarifying the period for which this information is retained under section 93.1.
That period should be limited to the Canada Border Services Agency, correct?
Mr. Therrien: That would mean that the period is not too long for other departments, indeed.
Senator McIntyre: That said, under this bill, information will be communicated with other government agencies in Canada, such as Employment and Social Development Canada, the Canada Revenue Agency, and the RCMP. In your opinion, does this bill raise any concerns about the way in which the information would be communicated to foreign governments?
Mr. Therrien: Once again, the bill allows for the government to collect some items of information. Overall, it is relatively little, but, once the information is collected, various pre-existing information-sharing agreements come into play. Does the bill provide adequate privacy protection when it comes to sharing information with foreign countries? The bill does not get into that situation; it simply adds a few information items that will be collected and potentially shared with other orders of governments. That does not mean that the situation is ideal, but it does not materially change the type of information that will be exchanged with foreign governments.
Does the bill provide adequate privacy protection when information is shared with foreign governments? As things currently stand, we are not always consulted. From time to time, we are consulted on the information-sharing agreements between Canada and the United States. Actually, on the matter of entries and exits, we have just received correspondence from the Canada Border Services Agency with proposed amendments to an agreement between Canada and the United States. We are in the process of studying it. That is one way of reducing the risk.
Senator McIntyre: Let me continue along the same lines. Could the information collected be shared with the private sector in some cases? If so, which cases?
Mr. Therrien: To my knowledge, nothing in the Customs Act would allow exchange of that kind with the private sector.
Senator McIntyre: If I understand correctly, you are satisfied with the way information is communicated to other government agencies in Canada.
Mr. Therrien: I am saying that, in principle, the communication is logical. It allows better management of government programs administered by other agencies that have important public-interest policies to apply. Is the bill justified in terms of its own principle? I say yes. After that, there are significant management approaches to personal information in terms of privacy protection. That is where we have some comments. As for the very principle of collecting information and exchanging it with other departments for the purposes of their programs, I see no particular problem.
[English]
Senator Coyle: Thank you very much, Mr. Therrien and Ms. Ives. I know simple bills don’t exist, but this bill, quite simply, is now giving Canada the power to receive information on anyone leaving Canada at the land border or through airports.
Mr. Therrien: Or land borders, yes.
Senator Coyle: Yes, land borders or through airports. Currently the U.S. already has this information. Now they’re giving it back to us in terms of the land border and in terms of the overseas flights that will be coming to CBSA and others through the flight manifests of the airlines.
Mr. Therrien: That’s our understanding of how it will function in practice, yes.
Senator Coyle: That’s basically what we’re trying to accomplish with this bill.
You have stated now and have stated previously that you’re generally satisfied that this border management initiative is going to achieve important public policy objectives and that the personal information in question is not particularly sensitive. I believe you do applaud the spirit of the amendment that was made and approved in the house, the intent of which we believe was to have a maximum period of 15 years for the retention of that information by CBSA. You’ve highlighted to us today that it actually may be a minimum and that the way this amendment currently stands is problematic. You’re bringing that to our attention. We want to make sure we get absolutely correct what we now do with what you’re telling us. Am I okay so far?
Mr. Therrien: Yes.
Senator Coyle: My first question is that if we look at the principle that the 15-year retention period by CBSA be considered a minimum period, is that too long for CBSA? You said it may not be long enough for some of the Canadian government agencies with which the information is being shared, such as the RCMP. It may not be long enough for the RCMP, but I’m asking the question for the CBSA itself. What is the rationale for that 15-year period? Do you think that is a reasonable period for the purposes which CBSA will need it?
That’s my first question. I’d like to hear the answer to that and then I have a follow-up.
Mr. Therrien: I will try to answer but I will note first that it’s difficult to answer that question because CBSA’s purposes or needs are not only its own; it also serves other departments. It collects information on behalf of other departments, so it’s difficult to divorce the needs of the recipient departments from the needs of the CBSA.
That being said, there’s no right or wrong or black or white answer to the question, but I think in principle the period for CBSA should be long enough for CBSA to be able to assist other departments in implementing programs like immigration authorities vis-à-vis residency, for instance, but also long enough to detect patterns in travel behaviour that would assist security or police agencies to detect persons who may be of concern for law enforcement or national security purposes.
How long is long enough? I think there was a discussion in the house committee among members of the relevant committee, some of whom had police experience, and they were, I think, looking at 10 or 15 years. Others were suggesting much longer periods. I think that would not be reasonable.
I’m not an expert in police investigations, but when I hear debate about 10 and 15, we’re probably in the right neighbourhood. From a privacy perspective, I would say more 10 than 15, but the period should be long enough to identify suspicious patterns in travelling histories.
Senator Coyle: That’s very helpful. That, then, deals with the aspect of the maximum period of 15 years for the retention of information by the CBSA.
Do you believe other amendments are required? You were referring to information in terms of the retention period for other government agencies or departments. Do you believe that should be handled in an amendment to this legislation, or are you seeing other mechanisms for us to ensure that safeguards are in place for those departments and agencies?
Mr. Therrien: For the other departments, I think it’s not possible to have a single time period. That’s why I say in my statement that the principle should be each institution, each department should be able and authorized to retain the information only so long as necessary to carry out their statutory mandate and objectives. I think that’s the right principle. That will lead to various retention periods, depending upon the needs of the various departments.
So if you’re considering amending the bill, I think it would be helpful to add a provision which would codify that principle in its broad terms, and then the consequences of that from a time perspective would flow.
Senator Coyle: Thank you.
Senator Richards: Thank you very much for coming. My question is similar to others and has been answered in a way, so it might sound repetitious. But thanks for your talk.
We have no real control over how long the U.S.A. would keep any of this information if they feel it’s pertinent to them, do we? They would keep it as long as they wanted to; there would be no 10- or 15-year limit on it?
Mr. Therrien: Correct.
Senator Richards: So much information in this new world of ours has already been collected on us that there’s no telling what other departments or organizations already have on us anyway, I don’t think. That’s an aside.
You said there was a 15-year period. Could it be longer for some people and shorter for others? With this bill, if someone was a definite person of interest, could the information be retained longer than 15 years, or shorter if it was somebody rather benign?
Mr. Therrien: I hesitate because we’re back to the question of interpretation of 93.1. I think there’s a good chance that a court would find that 93.1 applies not only to CBSA but to other departments as well. If so, I don’t think 15 years is the right period for many of the departments that would receive the information. We have been in contact with CBSA, and their officials are telling us that they interpret 93.1 as applying only to them.
Your work as a committee is ideally to have a law that is as good as possible, but you’re arriving late in this process. So one question you might want to ask of government officials is how they interpret 93.1, a confirmation that they think, in their view, it applies only to CBSA. That would circumscribe the debate. Then, if you’re inclined to accept the interpretation given by the government, it matters less what the retention periods of other departments would be because it would be unaffected by Bill C-21, and current rules would dictate. Although I would repeat, it would be a useful addition to have as a general principle only so long as necessary to achieve the purpose.
Have I missed something?
Senator Richards: No. It’s still a little cloudy, but you haven’t missed anything. Thank you very much.
[Translation]
Senator Boisvenu: Mr. Therrien and Ms. Ives, please forgive me for being late. It was wholly unintended on my part.
My first question goes to Mr. Therrien. We appreciate your practice of regularly considering the content of the bills we study. First, were you consulted as Bill C-21 was being drafted?
Mr. Therrien: To my knowledge, we were not consulted as the bill was being put together. The government consults us very frequently on the various implementation phases of the border control program with the United States, called Beyond the Border, which went through a number of stages. Departments also consulted very closely with us on the implementation of the provisions. But, at the outset, we were not consulted on the formulation of the bill.
Senator Boisvenu: During that consultation, did you make any comments or proposals for amending the bill, in general or more specifically?
Mr. Therrien: Not for Bill C-21. To my recollection, we did not make any comments on the principle, even on the retention issue, because at that time, the amendment to section 93.1 did not exist and we were relatively satisfied with the pre-existing rules. Essentially, each department is governed by its own retention periods. We were relatively satisfied with those provisions.
Then along came section 93.1, which perhaps does not meet the objective that the drafters wanted. At that point, we indicated that it would be desirable for the regulatory authority to be tightened. It’s something that we classified as desirable and that we asked for when the bill was being studied by the House of Commons. However, in our opinion, it is not absolutely necessary.
Senator Boisvenu: My last question is about the power that customs officers have to search cell phones. These days, as we know, our cell phones are our portable computers, either because of their power or because they are connected to our other devices.
Are you concerned that customs officers have that power or is this something that you support in the bill?
Mr. Therrien: Searching electronic devices is an excellent question. As you know, when Canadians enter the country, they are subject a search of their possessions, including their electronic devices. I have pointed out the fact that it would be very desirable for the Canada Border Services Agency’s policy — which goes further than the act and requires the agency to have grounds before searching electronic devices — be raised to the level of a judicial rule when it comes to admitting people into Canada.
When people leave Canada, the bill contains some additional powers, such as the power to question those leaving the country. Telephones could be examined when leaving. However, the bill provides no legal grounds for searching phones. In the same way, I would say that it would be very desirable for the bill to be amended to make the need to have grounds a judicial rule. That is at the level of the principles.
That said, searching electronic devices when leaving may well be very exceptional. So that is the way in which, in our opinion, the bill ought to be implemented. When Canadians leave the country to go to the United States, phones are generally searched by American agents who are subject to American law, over which we have very little control. As it has been explained to us by the agency and elsewhere in the government, exceptionally, a check when leaving could be done by a Canadian official, essentially when there are suspicions about a particular individual. In that context, the question you are asking is more relevant. But generally, when leaving, telephones or other electronic devices will be searched by American officials, in the vast majority of cases, under legislation over which Canadian law has little sway.
Senator Boisvenu: As I understand it, we would have to amend the bill by specifying that, on returning to Canada, electronic devices can only be searched if there were reasonable grounds to do so.
Mr. Therrien: I would say that it should be done in both directions, coming in and going out, because the principle should be the same. I will end with a caution and say that, in practice, when leaving, it should be very rare, although the principal remains the same.
Senator Boisvenu: Thank you very much.
[English]
The Chair: Thank you. I just want to clarify 93.1, if I can, from my position as chair.
You indicated that we could seek reassurance from the government on their interpretation of it or, second, you propose doing it as an amendment. I would assume that given that this legislation will last for some time, the amendment may be a preferable approach to a reassurance. Am I correct?
Mr. Therrien: Absolutely.
The Chair: Thank you.
I do believe that completes all the questions. We have no one else on the list. Let me take this opportunity to thank you for appearing before our committee. It’s always interesting from a privacy perspective, particularly on this bill.
Mr. Therrien and Ms. Ives, thank you very much.
(The committee adjourned.)