Proceedings of the Standing Senate Committee on
Transport and Communications
Issue 14 - Evidence, November 28, 2012
OTTAWA, Wednesday, November 28, 2012
The committee met this day at 6:45 p.m. to examine the subject matter of those elements contained in Divisions 5, 12 and 20 of Part 4 of Bill C-45, a second Act to implement certain provisions of the budget tabled in Parliament on March 29, 2012 and other measures.
Senator Dennis Dawson (Chair) in the chair.
[Translation]
The Chair: Honourable senators, this meeting of the Standing Senate Committee on Transport and Communications is hereby called to order.
[English]
This evening the Standing Senate Committee on Transport and Communications concludes a pre-study of Divisions 5, 12 and 20 of Part 4 of Bill C-45. After the witnesses, we will meet in camera to discuss a draft report that Senator Greene and I will be submitting tomorrow to the Finance Committee and will be tabling in the chamber.
[Translation]
We have the pleasure of hearing from Ms. Chantal Bernier, Assistant Privacy Commissioner, and she is accompanied by Carman Baggaley, Senior Strategic Policy Advisor. Miss Bernier, we will begin with your presentation and then we will go to questions from committee members. The floor is yours.
Chantal Bernier, Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada: Thank you Chair and members of the committee for the opportunity to address the privacy issues arising from Division 12 of Bill C-45.
I am Chantal Bernier, Assistant Privacy Commissioner, and with me is Carman Baggaley, our Senior International Research and Policy Analyst. The Commissioner sends her regrets that she is unable to appear here today.
First I will briefly describe the amendment before us. I will then provide an overview of the program to which it pertains, and then conclude by commenting on the privacy issues it raises.
The amendment in question amends subsection 107.1(1) of the Customs Act to require carriers to provide passenger information about persons "expected to be on board" a conveyance. The practical purpose of this amendment is that it will specifically allow the Canadian Border Services Agency to collect information about air travellers on international flights to Canada prior to the departure of the aircraft.
While the amendment may be relatively minor in and of itself, it relates to a program that involves the collection, use and disclosure of large amounts of potentially sensitive personal information about airline passengers arriving in Canada. From that perspective, it merits a broader-based reflection about the transparency of the program and its relation with other travel programs.
[English]
The information consists of two distinct but related types of information. Advanced Passenger Information, or API, consists of the biographical information found in a passport or travel document. Passenger Name Record, or PNR, information consists of data typically found in a reservation system, information about the flight or trip in question, such as the manner in which the ticket was paid for, the number of bags checked, seat information and various dates such as when the ticket was issued and the date of travel.
API is essentially static; PNR information changes from trip to trip. PNR information is potentially much more revealing because it provides information about travel companions, who purchased the ticket and the traveller's itinerary. Even a special fare, for example, to prepare for a conference or event can provide information about the traveller. PNR is valuable to border officials, specifically because it can be used to create profiles and draw inferences.
Our office has a long-standing interest in the API/PNR program. We had a number of concerns when the program was first announced about a decade ago.
The Minister of National Revenue who was in charge of the program at that time made a number of changes in April 2003 that addressed some of our concerns. Further changes to the program were made following negotiations with the European Union. As a result of these changes, API/PNR information can only be used for a specific set of purposes, it is depersonalized after 72 hours and access to the information is restricted. The information is deleted after three and half years unless it has been used for administrative or enforcement purposes.
I would now like to bring to your attention two key privacy concerns that we have with respect to the proposed amendments. The first relates to what appears to be the collection of personal information beyond the purpose of the program and the second is about the lack of openness and transparency.
First, collection beyond the purpose of the program: Through the amendments contained in Bill C-45, we understand that information on travellers will be provided to CBSA in advance of their actual departure. Practically speaking, this means that CBSA could be collecting API/PNR information on individuals who change their plans and never ultimately come to Canada. If this is the case, we would be concerned that personal information is being collected without any justification since the person is not travelling to Canada. If an individual never actually boards a flight to Canada, the purpose for which the government is collecting and using the information becomes unclear. We believe that this is an important issue that needs to be addressed with CBSA officials.
With respect to openness and transparency, the issue arises with respect to the relationship between API/PNR and similar programs and to parliamentary oversight. The API/PNR program should be viewed in relation to other travel programs, specifically the proposed electronic travel authorization eTA program and the Passenger Protection Program known as the no fly program, or PPP.
Clause 16 of Bill C-45 amends the Immigration and Refugee Protection Act to establish the eTA program. The eTA program will require people from visa-exempt countries, for example, Australians, New Zealanders, Europeans, to complete an application form and submit it to Citizenship and Immigration prior to traveling to Canada. Our understanding is that CIC will use this information to define individuals who may be inadmissible to Canada.
The PPP has been in place since 2007. This program is intended to identify individuals who may pose a threat to aviation security and prevent them from boarding an aircraft. The Passenger Protection Program is administered by Public Safety Canada and Transport Canada.
The relationship of the API/PNR program to the proposed eTA program and the PPP is not clear to us. If it is not clear to us, we doubt that most Canadians will understand how they relate to one another. Rather than being examined in isolation, these programs should be studied as a whole to obtain a better sense of how they overlap and interact with one another.
Individuals could be prevented from travelling to Canada under any of these programs and, since they will be administered by different departments and agencies, the redress process for each program differs.
With respect to the parliamentary oversight, one of our consistent concerns about the API/PNR program is the lack of transparency and the degree to which the details of the program are contained in regulations and are negotiated secretly with other countries. While we understand that international negotiations require a degree of secrecy, transparency requires that secrecy be kept to a minimum so that law-abiding citizens have a proper understanding of the system put in place and the level of intrusion that is proposed.
Fundamental questions about API/PNR programs, such as the data elements that are provided to CBSA, how this information can be used, with whom it can be shared and how long it is retained, cannot be found in the Customs Act. To a large degree, these matters have been shaped by negotiations with other jurisdictions, most notably with the European Union. A new PNR agreement is currently being negotiated with the European Union.
Based on the agreement between the EU and U.S. that was approved earlier this year, we are concerned that, under a new Canadian-EU agreement, the amount of information collected by CBSA will increase, it will be used for more purposes and it will be retained longer.
Finally, with respect still to parliamentary oversight, we would emphasize the lack of detail in the amendments before the committee. Neither the specific data elements nor how API/PNR information will be used is codified in the legislation. The substantive matters are instead deferred to either regulation or internal departmental policy and will not be scrutinized by Parliament.
[Translation]
To conclude, the powers and tools entrusted to government officials at our airports and borders are considerable. As such, it is only reasonable that the level of transparency and scruting associated with security programs like API/ PNR be commensurate to this significant responsibility. We believe that the government should be much more transparent about the justification to collect and use passenger information for this and other related travel programs.
Once again, I would like to thank you for this opportunity to discuss these important issues and I would be happy to take your questions.
The Chair: Thank you, Ms. Bernier. For my part, I will introduce the people at the table: Senator McDonald, from Cape-Breton, Nova Scotia; Senator Eggleton, from Toronto, Ontario; Senator Merchant, from Saskatchewan; and Senator Doyle, from Nova Scotia. Senator Housakos is from Montreal, Senator Verner is from Quebec, Senator Boisvenu is from Sherbrooke, in the province of Quebec, and we are honoured, this evening, to have Senator Carignan, Deputy Leader of the government in the Senate. I must say that this is the first time that I have presided over a committee meeting that Senator Carignan is attending.
Are there any questions?
[English]
Senator Merchant: Thank you for your presentation. The points you raise are significant. I am thinking back to the time when sometimes people who come to Canada do not speak English very well, and I think this will present a further problem for them. We had that very unfortunate incident last year at one of our airports where a person actually could not communicate. They could not communicate with him. Have you given some thought to that and how this complicates things further? Have there been some remedies not to have that kind of occurrence?
Ms. Bernier: We have looked at this program very much through the angle of privacy. I would underline, and I also hear it in your question, that this applies to everyone who travels. This applies to every irreproachable, law-abiding citizen who comes to the border. At the border, we know that we are faced with officials who have tremendous power; hence, it is a situation of vulnerability that in our view calls for that higher level of scrutiny.
You mention the language barrier, and there are many more that could indeed undermine the ability of an individual to properly deliver the information, to properly understand what personal information is asked of him or her, what is going to be done with it and how it will be used. Clearly, we feel that because of the specific situation, there should be clear information, hence the point about transparency, about the justification and the modalities of this program.
Senator Merchant: I have to agree because otherwise it presents a problem for the officials at the border too, if they do not have clear indications as to what is appropriate, because who decides whether these questions are intrusive? Is it the person who is asking the question, or is it the person of whom it is asked? Who makes the decision at that moment? There would have to be very clear indications, I think, for everybody's well-being.
Ms. Bernier: The data elements of the program will be defined and built into the program, so that will be decided on the basis of departmental policy, ministerial decisions or however the government chooses to proceed. That being said, I believe that your point about privacy sensitive officials at the border is crucial, and we have made that point repeatedly to CBSA in our audits or in specific interventions with them in our review of privacy impact assessments or investigations. Indeed, CBSA officials must be properly trained on privacy.
Senator Eggleton: Thank you for your comments. This electronic travel authorization, eTA, is a new document, then, that would be filled out by people coming, as you point out, even from very friendly countries where visas are not required — Europeans, Australians, New Zealanders. What about the Americans? Are they involved in that?
Ms. Bernier: I understand that it applies to all non-visa countries.
Carman Baggaley, Senior Strategic Policy Advisor, Office of the Privacy Commissioner of Canada: It does not apply to Americans. Part of the rationale for this is the perimeter security program, and, since the assumption is that the Americans are already within the northern North American perimeter, if you like, they are not covered by the program.
Senator Eggleton: What kind of questions would this form ask?
Ms. Bernier: Have you received a briefing on that? I do not know if my staff has seen a briefing on what questions would be asked. I understand it is still in preparation.
Mr. Baggaley: That is a very good question. It is very similar to an American program called ESTA. Under the American program, there are intrusive questions asked about health and communicable diseases. The minister was quoted as saying that we would not be asking such intrusive questions, but we have not been given a list of the questions that would be asked as part of the eTA application process.
Senator Eggleton: Okay. Do the Americans have something similar to this in operation now?
Mr. Baggaley: Yes, it has been in operation for several years.
Senator Eggleton: It would not apply to us, so I would not have noticed it going across the border. Most of us complete the standard customs form. This will be a form over and above the standard customs form. You will have two forms.
Ms. Bernier: This is in advance of you making your reservation, actually.
Senator Eggleton: Would you fill in this out online, or would you have to submit it to a travel agent who is booking you? How would this work?
Mr. Baggaley: I will briefly explain the relationship. The assumption is that this would be filled out online, and, ideally, you would be informed very quickly whether or not you would receive this travel authorization. You should do this before you make the reservation. Once you make the reservation, the second program kicks in where the airline builds this set of information about your travel, and this is the information that is involved in the specific amendment to the Customs Act. There is a two-step process for certain travellers. First, you need the eTA. Your airline then provides certain information to CBSA — the API/PNR information — and then there is a second decision made about whether or not you would be allowed into the country and whether or not you would be asked to undergo secondary screening. Then, of course, there is the no fly program sitting over here some place on top of that.
Senator Eggleton: This would apply to people coming from U.K., France, other parts of Europe, Australia, New Zealand.
Ms. Bernier: Yes.
Senator Eggleton: Really? Would they have to fill this out and go through the process every time they come over or once a year or two years or something like that?
Mr. Baggaley: Our understanding is that the eTA is valid for five years.
Senator Eggleton: They would do it once and it would last for five years. You do not know what the questions are yet, but you do know what the American questions are. Presumably, if we are talking about perimeter, it would be much the same questions, would it not?
Mr. Baggaley: I would be reluctant to speculate. We do have the minister's assurance that some of the more intrusive questions will not be asked, but this is information that we look at very carefully.
Senator Eggleton: Tell me again. What are the questions that the Americans ask?
Mr. Baggaley: I cannot give you a full list. This was an issue that we provided comments to a House committee on. My understanding is that this committee is looking at a different set of amendments to Bill C-45, so the information that I am aware of that is asked by the Americans is related to health, communicable diseases and, of course, the standard questions about previous offences and whether or not you have been denied entry.
Senator Eggleton: Okay. Division 16 of the bill provides for this program to be put into effect.
Mr. Baggaley: Yes.
Senator Eggleton: It is germane to what we are doing here.
Ms. Bernier: We have expressed our opinion about that, as well.
Senator Eggleton: What have you said?
Ms. Bernier: We have the same concerns; we want to see justification and greater transparency. The other thing that may help in answering you is to give you the focus. We understand that the focus of the eTA is to determine admissibility or inadmissibility to Canada, and that refers you to the Immigration Act, which does define who is admissible and not admissible to Canada.
Senator Eggleton: Has it been proven in the United States to be burdensome on people trying to travel to that country? I am trying to figure out if this will be a detriment to tourism in this country if people have to go through a lot of rigmarole to try to get here from countries from which we usually accept people every day — the U.K., France, Australia.
Ms. Bernier: That is a question that needs to be put to the officials from the government.
Senator Eggleton: I do not think that we should let this one go.
The Chair: The response of the minister of?
Mr. Baggaley: Citizenship and Immigration.
[Translation]
Senator Boisvenu: Since the events on September 11, 2001, countries have started to negotiate the exchange of information with each other in order to ensure that they have a better knowledge of people's potential for dangerous behaviour when they get on an airplane.
We are trying to work towards setting a zero tolerance level, because we do not want to take risks and end up with a bomb on a plane. The countries that are negotiating with each other need to settle on the level of information that they will exchange. For example, Canada cannot say to the Americans: "Give us the maximum level of information on people who land here, but we will give you the minimum." The agreed-upon level of information must be comparable.
Are there countries that have received access requests that pertain to the information's level of privacy? Are there countries that have made this information available to organizations such as yours?
Ms. Bernier: No, I do not see how. Do you mean information in the form of personal information?
Senator Boisvenu: Information, no. It would be along the lines of the questions asked. That is what you want to see. Is that correct?
Ms. Bernier: That is it. And I will tell you what we are doing. From the outset, about 10 years ago, when the program was implemented, we started a dialogue with Revenue Canada and obtained changes that tightened up criteria and reduced the quantity of information collected to adapt it to what seemed more reasonable and necessary.
Since that time, as you know, we have started negotiating the security perimeter with the United States, and a whole new series of programs have come out of that, so we decided to narrow down the dialogue, a dialogue supported by regular meetings with the Border Services Agency. We are working with them in order to obtain the most information possible on what they intend to launch, and to obtain from them what are called privacy impact assessments, so that we may examine them and make recommendations that strike the right balance between security imperatives and the fundamental right to privacy.
Senator Boisvenu: So I am coming back to my initial question. Are there countries that have made this information available to organizations such as yours? I do not mean the information collected, but the type of information that is requested.
Ms. Bernier: You mean my counterparts, for example, in France and the United Kingdom? I really could not say. However, it would be easy to let you know. We have very close ties, so we could certainly do a little survey, so to speak, among our European counterparts, for example, to ask them what type of relationships they have established with their security authorities and what their level of transparency is. Does that answer your question?
Senator Boisvenu: Yes. My last question is the following: if, for example, these countries' organizations were not able to receive the information, would not it be dangerous for Canada to make it available when other countries do not do the same?
Ms. Bernier: In our experience, we are talking about all of the criteria that could imperil security measures. For example, if a security agency is asked to say exactly which criteria it uses to exclude such and such a person, the answer would be that it cannot disclose the information because it is too secret, or that the information can only be the disclosed to your auditor X, for example, who has the proper security clearance, or the agency can give us the information. But when the criteria are protected by national security, these agencies do not share them with us. And we respect the fact that, of course, certain measures must remain secret. That is why I was saying in my presentation that we understand that the effectiveness of certain security measures requires a certain degree of secrecy.
Senator Boisvenu: Are you still negotiating with Canadian stakeholders to obtain access to this information?
Ms. Bernier: Yes indeed. As I was telling you, regular meetings with the Canada Border Services Agency are taking place. They occur regularly, and are even a bit more frequent now, because there are so many programs that are increasingly intrusive.
Senator Boisvenu: In your opinion, are they open to being cooperative?
Ms. Bernier: Let us say that we have to insist. That being said, our experience with the Government of Canada is that they are good players who truly understand how important it is for Canadian democracy to preserve the right to privacy, even in a security context.
Senator Boisvenu: So, you are optimistic?
Ms. Bernier: Yes.
Senator Carignan: It is my understanding that you are concerned about the amendment "should be on board". If someone cancels their trip at the last minute, or does not get on the plane, you want this information to not be sent. Since the person did not take the plane, you seem to feel that it is not relevant to have this information. Did I understand your testimony correctly?
Ms. Bernier: Yes. You have understood it very well. Until now, according to the way that the program is built and justified, Canadian authorities need to know who is coming to Canada to manage the risk, as the case may be. If the person does not come to Canada — if, for some reason or other, he or she decided not to leave at that time —, there is no reason to send the information.
Senator Carignan: I do not know any terrorists, I have never met any. I do not know any kamikazes either. However, it seems to me that, logically, if my intention were to blow up a plane and I did not necessarily want to die, I would perhaps arrange to get a suitcase with the bomb onto the plane, and at the last minute, I would find a reason not to get on. I would still try to make sure that the suitcase got onto the plane anyway.
The fact that the person does not get on could be relevant. Do you not think so? It is my understanding that many planes do not take off. Normally, the plane does not take off if the suitcase and the passenger do not get on. However, not all countries are as rigorous. Having seen luggage unaccompanied by passengers when chasing after a suitcase, I believe that that is not necessarily strictly enforced.
Ms. Bernier: I would suggest that you ask security authorities to answer that question. What we are really trying to get at is the necessity of collecting this information. Why would they need information on a passenger who is no longer a passenger, a person who is not coming to Canada anymore? The rationale does not hold up as it stands. If we are missing the rationale, the Canadian authorities will have to provide it.
Senator Carignan: So you are not convinced that, from a security perspective, not getting on can be just as relevant as getting on?
Ms. Bernier: I would say that, first of all, the authorities have already planned for this situation. Lessons have been learned from previous tragedies. I have not heard this argument from security authorities. We have not yet heard a convincing argument. There may be one, but we have not heard it.
Senator Carignan: I am telling you.
Ms. Bernier: I think that the issue of the suitcase is dealt with elsewhere. It is clear, you know. You may all have had the misfortune of being stuck on a plane that is not taking off because a person whose baggage was checked is not on board. So, that is a basic rule.
It must not be forgotten that this principle is not just applied to terrorists, but to everyone. It applies to people who are completely honest, and whose right to privacy cannot be restricted except for reasons that can be justified in a free and democratic society.
Senator Boisvenu: Ms. Bernier, I worked in police investigations for about 15 years. When information is collected, it is not just to know if a person is really on board. It is also to investigate criminal behaviours. An individual could register and not get on the plane, but then possibly decide to take another flight, or not take any flight at all, or do it repeatedly. If I were a police officer, this suspicious behaviour could lead me to believe that this individual might be dangerous. Action must be taken before and during such events. Detection systems might give us a chance to identify an individual who has a bomb before they get on the plane. These individuals usually get on the plane with the bomb.
Do you not think that this type of information, on the behaviour of those who have second thoughts when considering a crime that they might commit, fear being the mother of wisdom, could potentially be of interest to those who study terrorist behaviour?
Ms. Bernier: Once again, I think that is a theory that you have every right to present to the government authorities who developed the program, to see if, indeed, that is the rationale. However, the fact remains that with this program, a completely honest person who cancels their flight for a very good reason will still be caught up in a fairly intrusive system, without any justification.
Senator Boisvenu: What type of justification would lead you to agree with the system's administrators, if they were to raise arguments like Senator Carignan's? How far would they have to go to prove the level of risk?
Ms. Bernier: That is an excellent question, and it gives me the opportunity to explain our analytical framework to you. I think that would be very useful to help give our arguments more weight in such a case. In passing, if you are interested, this analytical framework is described in a document posted on our Web site called A matter of trust, which aims to integrate security issues and privacy protection issues.
This analytical framework is based on four stages. The first stage is that of legitimacy. The government agency must demonstrate the necessity, the proportionality, and the effectiveness of the measure in question. I will give you a concrete example: body scanners. You will recall that they were rather shocking.
The initiative was examined by questioning its legitimacy. The Air Transport Security Authority was asked to justify their use by telling us how it intended to limit its intrusion to what was strictly necessary, in other words: "Was it necessary?", or "Does a less intrusive alternative exist?"
They raised convincing arguments which demonstrated that they had done their homework, and that they were ready to keep information collection and privacy violations to a strict minimum. They also assured us that the use of body scanners was strictly optional, because a person could choose the scanner or a pat down.
Once the legitimacy test has been passed, the next question is: "Tell us how you will protect this information so that it is not disclosed willy-nilly, so that it is used only to meet these objectives?" Thirdly, they are asked: "How will you ensure, through your internal mechanisms, that you follow these rules?" Finally, the fourth question is: "What surveillance entity will monitor you to ensure that you follow these rules?"
You will probably recall that we said that the authority followed all of our recommendations, and that by doing so, it did indeed strike the right balance between security imperatives and the protection of privacy. So it is entirely achievable.
Senator Boisvenu: Thank you.
[English]
Senator Eggleton: You mentioned that the eTA would be an online application and would last for five years, but not everyone goes online. Grandma and grandpa from England might be coming over regularly but they are not computer savvy so what happens to them? How do they get into the country? They have to complete this eTA to get into the country.
Mr. Baggaley: That is a good question. In a country like England, where Canada has a mission that has embassies, that in fact is probably easier than it would be in some other countries where people would find it much harder to get to a Canadian embassy or a Canadian mission. That is an issue. There are a lot of questions about the program and we do not have the answers. We are looking forward to receiving the answers.
Senator Eggleton: Mr. Chair, I would hope in our commentary back to the Senate that we perhaps would ask the minister, when he has the regulations together or whatever the implementation of this program is, to come back to the committee and talk to us about it.
The Chair: As you know, in addition to tabling this to the Finance Committee, we will be tabling it in the Senate. People who want to comment on the report will be allowed to comment. We will talk about the report after we have freed the witnesses.
Ms. Bernier and Mr. Baggaley, thank you very much for your presentation. As you can tell, there is a strong interest. Your comments have been noted by some of the senators and you will probably be hearing some of these comments repeated in the future.
We will adjourn for one or two minutes. Before we get to the in camera portion of the meeting, our next meeting is Tuesday, December 4. We will return to the northern and regional portion of our airline study. The witnesses will be Mr. Terry Audla, President of the Inuit Tapiriit Kanatami Airlines; and Captain Peter Black, Chairman of the Presidential Commission on Remote Operations for the Airline Pilots Association International.
(The committee continued in camera.)