Divisions 13, 14 and 15 of Bill C-59, Economic Action Plan 2015, No. 1

Submission to the Standing Senate Committee on National Finance

June 1, 2015

The Honourable Joseph A. Day, Senator
Chair, Standing Senate Committee on National Finance
The Senate of Canada
Ottawa, Ontario  K1A 0A4

Mr. James Rajotte, M.P.
Chair, Standing Committee on Finance
House of Commons
Ottawa, Ontario  K1A 0A6

Dear Chairs:

I am pleased to present the views of the Office of the Privacy Commissioner of Canada (OPC) in connection with Divisions 13, 14 and 15 of Bill C-59, Economic Action Plan 2015, No. 1. We hope that our written comments will assist in your study of the Bill. The specific provisions before you represent a range of changes, which this submission addresses in the order of their appearance in the legislation.

Amendments to PIPEDA to extend its application to the World Anti-Doping Agency (Division 13 of Part 3)

This division of the bill will extend PIPEDA’s application to the World Anti-Doping Agency (WADA), in respect of its international activities. We understand that this is meant to provide a solution to concerns that Quebec’s private sector privacy law may not provide an adequate level of privacy protection for transfers of sensitive personal information on athletes from European Union countries to WADA headquarters in Montreal.

The new provision would put in place a precedent for broadening the scope of the application of the Act to include organizations that are not federal works, undertakings or businesses, or otherwise engaged in commercial activities. The extension of PIPEDA’s application to WADA, however, will not remove the application of substantially similar Quebec privacy law as it applies to collections, uses and disclosures of personal information within the province of Quebec.

Amendments to the PCMLTFA to allow FINTRAC disclosure to provincial bodies that administer securities legislation relevant to investigating or prosecuting an offence (Division 14 of Part 3)

As you are aware, my Office has appeared on a number of occasions for amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). As I have said before, and I would like to mention at this Committee, my Office supports efforts to combat money laundering and terrorist financing, and I understand the need to share information for these purposes.

Division 14 of Part 3 of Bill C-59 proposes to amend section 55(3) of the PCMLTFA, to “require” the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) to disclose designated information to provincial securities regulators.

We do not have major concerns with this new amendment, as it appears to be limited in scope and tied to the objects of the legislation.

Under section 55(3), FINTRAC is required to disclose designated information to an appropriate police force if it has reasonable grounds to suspect that designated information would be relevant to investigating or prosecuting a money laundering offence or a terrorist activity financing offence. If FINTRAC has reasonable grounds to suspect that the information also relates to certain other offences or matters, it must, in addition to disclosing the information to the appropriate police force, disclose the information to certain other agencies.

At present, these agencies are the Canada Border Services Agency (CBSA), Canada Revenue Agency (CRA), and the Communications Security Establishment of Canada (CSEC). Bill C-59 would expand the agencies to which FINTRAC is required to disclose designated information to include provincial securities regulators in situations where FINTRAC has reasonable grounds to suspect that the information would also be relevant to investigating or prosecuting an offence under securities legislation of a province.

We read the amendment to the PCMLTFA in Bill C-59 as requiring that disclosures may only be made to provincial securities regulators where both the opening words of s. 55(3) and the condition in the amendment have been met. As such, FINTRAC would not be able to disclose information to provincial securities regulators if it does not, in the first place, have reasonable grounds to suspect that designated information would be relevant to investigating or prosecuting a money laundering offence or a terrorist activity financing offence. In our view, this represents an important limitation on potential disclosures.

However, given this increased requirement to share information, we note that it is essential that the information disclosed be accurate, relevant, and related to the purposes as outlined in section 55(3).

As per 55(5.1) of the PCMLTFA, the reasons for disclosures under section 55(3) shall be recorded. In our first audit of FINTRAC we had recommended that FINTRAC should establish a set of written criteria to guide in the determination of when the threshold for disclosures to CBSA and CSEC has been met, which our subsequent audit found FINTRAC had established. We therefore recommend that if this amendment passes, a similar set of criteria be established with respect to each provincial security regulator.

While there may be legitimate reasons for disclosures to provincial regulators to combat money laundering and terrorist financing, our Office has observed over-reporting by financial institutions to FINTRAC of information not related to its mandate, and as a result, we caution that all disclosures made under section 55(3) should be made with information that is relevant and as per the limits defined under that section.

Amendments to the Immigration and Refugee Protection Act (IRPA) to expand collection of biometric information (Division 15 of Part 3)

At the federal level, the use of biometric identifiers is governed by the provisions of the Privacy Act, which regulates the collection, use, disclosure, and access to, personal information “that is recorded in any form”. Under the Act federal organizations are supposed to establish certain protection measures, limit the use of information for secondary purposes and establish the list of their data bases publically, regardless of the citizenship of those affected.

Division 15 of Bill C-59 proposes to expand the collection of biometric information from a foreign national, as prescribed by the regulations, who makes an application for temporary residency, a study or work permit to a person who makes a claim, application or request under IRPA, also subject to regulations.

We certainly support the objective of promoting the integrity of Canada’s immigration system, and understand the challenges posed by identity verification and document fraud. We have also asserted that special precautions should be taken into account when collecting biometric information. For example, our Office has recommended:

• Matching Biometric Information to Verify Identity - Biometric information can be a powerful tool to verify someone, but it is not error-free. Comparing a fingerprint to all available records in a biometric system raises privacy concerns because of the heightened risk of false matches. Even low failure rates can have a significant impact when a system is scaled up to involve thousands or even millions of people.
• Establishing Technically Protective Measures – As centralized storage heightens the risk of data breaches, high standards for the integrity and security of biometric and other identity information must also be put in place. Privacy enhancing technologies could and should be applied to initiatives that use biometrics.
• Provisions for full notice - In many types of interactions with government, individuals have no choice but to relinquish personal information – often very sensitive. This represents a loss of individual control over personal information and therefore every effort should be made to inform the individual about the purposes of collection and whether information will or may be shared with another jurisdiction, especially if the information may be used for purposes that it was not originally collected.

The current regulations limit the collection of biometric information (photograph and fingerprints) to foreign nationals from 29 countries and 1 territory, with some exceptions. We understand from testimony by government officials appearing before the House of Commons Standing Committee on Citizenship and Immigration that new regulations are expected by 2018-19 which will apply globally. We will anticipate any new regulations prescribing the collection of biometric information and look forward to commenting on them from a privacy perspective, as we have done in the past. We want to ensure that the legal standards, values and rights established in Canadian privacy law for the treatment of personal information are not eroded and that any sharing of personal information with other jurisdictions or states complies fully with Canadian standards of protection.

With respect to the amendments regarding electronic administration of IRPA, we recognize that government services are increasingly moving online. Online service delivery does not come without privacy risks, so we would expect that such means include robust governance structures and properly protect personal information from privacy breaches, cyber security threats, and inappropriate uses. We would also expect that any new electronic systems be subject to a privacy impact assessment, use accepted technical standards and that our office would be informed in a timely manner.

It is imperative that government institutions and other organizations think carefully before proposing initiatives that call for the expanded collection, use or disclosure of biometric information. The challenge is to design, implement and operate a system that actually improves identification services, without unduly compromising privacy. 

Exempting Long-gun Registry records from the Privacy Act

As for removing the Privacy Act’s application to the Long-gun Registry, we do have some concerns with the approach in Bill C-59.  Given the clear will of Parliament articulated with passage and Royal Assent of the Ending the Long-Gun Registry Act in April 2012, we supported deletion of data no longer needed. This is in keeping with basic data protection principles. However, a blanket exemption from Privacy Act requirements, backdated to 2011 as proposed in Bill C-59, also creates issues.

To ensure accountability, for past treatment of personal information contained in the Long-gun Registry, Parliament should consider the exemptions provided for in Bill C-59 quite carefully.  As drafted, all avenues of remedy and review are essentially removed for individuals who have sought to challenge the government’s handling of their personal information. We are also concerned about the impact of this measure on any remaining Long-gun Registry records in the hands of government.

Generally, if the government holds personal information about individuals it must be protected under the Privacy Act. Moreover, individuals have an opportunity to challenge the government’s treatment of their personal information, for example, by way of a complaint to the Privacy Commissioner. By removing the wholesale application of the Privacy Act to Long-gun Registry records, fundamental protections, for example, from inappropriate uses and disclosures of personal information, will no longer be available in respect of any personal information in these records.

We would recommend, therefore, that Parliament consider allowing existing complaints and proceedings to remain open until these are exhausted.  This will ensure that a basic standard of protection for personal information involved in these proceedings is preserved.  We would also recommend conserving the approach in the Ending the Long-Gun Registry Act, which retained general protections for personal information whilst allowing deletion to proceed.

Thank you again for considering our views related to amendments in Bill C-59, Economic Action Plan 2015, No. 1. We hope that this information will assist in your study of the Bill and my Office would be pleased to follow up with whatever information you may require.

Sincerely,

c.c.:
Mr. David Tilson, M.P.
Chair, Standing Committee on Citizenship and Immigration

The Honourable Irving Gerstein, Senator
Chair, Senate Standing Committee on Banking, Trade and Commerce

The Honourable Kelvin Kenneth Ogilvie, Senator
Chair, Senate Standing Committee on Social Affairs, Science and Technology

Ms. Jodi Turner, Committee Clerk (NFFN)
Ms. Christine Lafrance, Committee Clerk (FINA)
Ms. Keli Hogan, Committee Clerk (BANC)
Ms. Jessica Richardson, Committee Clerk (SOCI)
Mr. Michael MacPherson, Committee Clerk (CIMM)