Fundamental privacy protections and cross-border transfer of personal information

Resolution of Canada’s Privacy Commissioners and Privacy Enforcement Officials on the Canada-US Perimeter Security and Economic Competitiveness Action Plan

April 2, 2012

CONTEXT

• In February 2011, Prime Minister Harper and President Obama signed the Beyond the Border: A shared vision for perimeter security and economic competitiveness Declaration which seeks to integrate the Canada-US border to facilitate trade and increase security;
• The declaration expresses a joint commitment to cooperate in four areas: assessing and addressing threats together, facilitating trade, economic growth and job creation, integrated cross-border law enforcement and protection of critical infrastructure;
• The recent declaration, while acknowledging the importance of privacy, does not detail how either government intends to reconcile the very different privacy regimes and policy goals that exist in the United States and Canada;
• In June 2011, the Office of the Privacy Commissioner (OPC) submitted a series of recommendations to the Government of Canada as it negotiates a set of new border initiatives;
• In December 2011, both governments released details of these measures in their Perimeter Security and Economic Competitiveness Action Plan which sets out details of how they intend to implement their Beyond the Border declaration;
• Recommendations made by the OPC in its June submission to government are not addressed in the Action Plan nor have the governments specifically addressed privacy concerns related to this initiative;
• Canada’s privacy commissioners, as part of their role in reviewing programs that have an impact on individual privacy rights, are concerned that certain perimeter security programs could have significant effects on the privacy of Canadian citizens.

WHEREAS:

• Privacy is a defining value for Canada,
• Privacy underlies other democratic rights and freedoms;
• Rigorous safeguards for personal information are vital in maintaining trust between citizens and their government;
• A perimeter security model must take into account the high value that Canadians place on protecting their personal information and privacy rights, and must not abrogate these values and rights;
• Integrated security measures must not weaken Canadian checks and controls for safeguarding citizens’ privacy rights.

THEREFORE:

• As new security programs are planned and systems initiated, the Commissioners call on the Government of Canada to:
  • Ensure that improvements to Canada-US security and commerce do not jeopardize Canadians’ privacy rights, including those of Canadians who work, live and enjoy leisure activities near the border;
  • Ensure that legal standards, values and rights established in Canadian privacy law for treatment of personal information are not eroded;
  • Restrict the use of satellites, unmanned aerial or other vehicles, remote sensors and associated surveillance technologies within Canadian borders and airspace under a proper regulatory framework;
  • Assure citizens that personal information will remain housed in Canada as required by law, under the care, control and custody of Canadian institutions and authorities, and where personal information must be stored outside Canada that reasonable measures of protection will be put in place;
  • Direct all federal departments and agencies to ensure that all personal information on individuals is collected, used and disclosed to other government bodies exclusively in accordance with defined terms set out in formalized information sharing agreements;
  • Commit to making all formalized information sharing agreements public, subject only to redactions, if any, that are strictly necessary;
  • Ensure the sharing of personal information with the US complies with Canadian standards of protection;
  • Provide that reasonable steps will be taken to ensure accuracy of information shared with US, that an appropriate process for citizens to request correction of their personal information is in place, that mechanisms for reconsideration and review are provided for, and that citizens may request details on the use of their personal information.
  • Strengthen the system of oversight for all federal national security and law enforcement organizations involved in the new perimeter security model,
  • Provide citizens with avenues for redress and remedies, for reviewing files for accuracy, for correcting inaccuracies, and for restricting information disclosures to other countries;
  • Actively involve Parliament, provincial Privacy Commissioners, academics and civil society in discussions and options for new security initiatives, engage and inform all citizens in the policy debate;
  • Provide notice to travellers in all instances where their personal information is being collected, including notice as to how it will be used;
  • Require that any Canadian government institution involved in implementation and operations conform to Canadian values, laws and jurisprudence regarding,
    • the definition of personal information,
    • the reasonable expectation of privacy.

News Release: Perimeter security: Privacy commissioners urge transparency and respect of Canadian privacy standards