Bill C-19: An Act to amend the Criminal Code and the Firearms Act

Submission to the Senate Committee on Legal and Constitutional Affairs

March 26, 2012

The Honourable John D. Wallace, Chair
Senate Committee on Legal and Constitutional Affairs
The Senate of Canada
Ottawa, Ontario
Canada, K1A 0A4

Dear Honourable Senator:

I wish to thank you and your Committee for the opportunity to submit this written statement concerning Bill C-19, An Act to amend the Criminal Code and the Firearms Act. As you know, I previously appeared before the House of Commons Standing Committee on Public Safety and National Security, on November 22, 2011, to testify on this issue.

As I stated at that time, there are two main issues regarding personal information arising from the Bill: first, regulatory requirements under the Privacy Act on retention of personal information; and second, safeguards in how personal information is disposed of by government institutions. I would like to reiterate these points in my written submission to you.

Retention of personal information under the Privacy Act

The Privacy Regulations flowing from the Privacy Act require institutions to retain personal information for at least two years after it has been used by a government institution for an administrative purpose. Under Clause 29 of Bill C-19, however, firearms records are to be disposed of “as soon as feasible”. Clause 29 would appear therefore to exempt the destruction of these records from the two-year retention requirement under the Privacy Regulations.

As I acknowledged in my appearance before the House of Commons on Bill C-19, the Government does have the authority to enact an exemption to the retention provision under the Privacy Act. I would caution however against moving too quickly with the destruction of records. There are situations where the retention of certain information might be important – for instance in any ongoing court action. Ensuring that individuals have an opportunity to gain access to their personal information is very important in such a context. Indeed, access to information can often be a necessary precondition to correction, redress and remedy.

Disposal of personal information

With respect to the manner and means of information disposal, I wish to underscore that – whatever timing the Government decides to follow – it should allow the institutions involved sufficient scope and resourcing to properly and securely dispose of the personal information in the main, secondary and related registry databases. It would be unfortunate if, in aiming to eliminate one privacy issue the Government were to inadvertently create another through accidents or oversights.

Disposing of data is a complex process. In 2010, my office published an audit report entitled Personal Information Disposal Practices in Selected Federal Institutions and we have enclosed a copy for reference. That exercise found that certain departments had inadequate control mechanisms and inconsistent practices when discarding information technology used to store personal information. It would be my hope that all government institutions implicated by Bill C-19 take all necessary steps to ensure no breach of personal information occurs.

I hope you have found these reflections useful and I thank you once again for providing me an opportunity to share my thoughts on Bill C-19.

Sincerely,

cc: Honourable Vic Toews, Minister of Public Safety
Shaila Anwar, Clerk of the Committee (LCJC)