Letter to the Standing Senate Committee on Social Affairs, Science and Technology on Part 8 of Bill S-6, An Act respecting regulatory modernization

BY EMAIL

May 12, 2022

The Honourable Senator Ratna Omidvar,
Chair of the Standing Senate Committee on Social Affairs, Science and Technology
The Senate of Canada
Ottawa, Ontario K1A 0A4

Dear Ms. Chair:

Thank you for the invitation to provide input on Part 8 of Bill S-6, An Act respecting regulatory modernization. I understand the government’s objective to facilitate information-sharing in the context of immigration, refugees and citizenship, but believe these disclosure authorities should come with certain safeguards, a number of which these new provisions seem to largely incorporate.

Our reading of Part 8 of Bill S-6 is that it introduces two clauses to facilitate information-sharing in the context of immigration, refugees and citizenship. Clause 159 amends the Department of Citizenship and Immigration Act to provide for some personal information under the control of Immigration, Refugees and Citizenship Canada to be shared with any federal or provincial department or agency or Crown corporation, subject to forthcoming regulations. We understand that this amendment will allow Immigration, Refugees and Citizenship Canada, when administering or enforcing legislation or exercising powers or duties under a lawful authority, to share personal information regarding a person’s identity, status, and the content or status of a document issued to that person by the Minister. Clause 160 adds a paragraph to section 150.1(1) of the Immigration and Refugee Protection Act, which authorizes making regulations for information-sharing purposes. This would empower the federal government and its agencies to share information for the purpose of cooperation.

While obtaining the individual’s consent for the disclosure of their information is the general rule under the Privacy Act, section 8 of the Act outlines certain express exemptions which allow for disclosure without consent, including for any purpose that is in accordance with an Act of Parliament or regulation.^{Footnote 1} My office has long advocated that certain disclosures of personal information under s. 8 of the Privacy Act be subject to written information-sharing agreements (ISAs). As outlined in a submission my Office made to the Standing Committee on Access to Information, Privacy and Ethics in 2016 on reform of the Privacy Act, we have recommended that such ISAs contain key elements including a definition of the specific elements of personal information being shared as well as the specific purposes for the sharing.^{Footnote 2} We further recommended that agreements limit secondary use and onward transfer, and outline other measures to be prescribed by regulations, such as specific safeguards, retention periods and accountability measures.

In our view, ISAs are critically important in supporting the exchange of personal information. When properly drafted, they help to clarify the rights and obligations of the parties, to define custody and control issues, and to establish protocols for addressing problems and incidents. They also provide positive awareness and instructions for federal employees charged with information-sharing responsibilities. Most importantly, ISAs help to ensure that institutions sharing and receiving information are in compliance with the requirements of the Privacy Act.

In line with recommendations made by my Office, the Department of Justice, in its recent proposals for modernization of the Privacy Act^{Footnote 3}, proposed that information-sharing under section 8(2)(f) be subject to written agreements with specific requirements regarding the types of clauses the agreements would have to include at a minimum. Although we believe privacy law reform remains a priority of this Government, such written agreements are not yet a requirement under the current Privacy Act.

I note that Part 8 of Bill S-6 already incorporates a number of provisions that my Office has advocated for in the context of information-sharing. This includes outlining authorized purposes for sharing personal information, defining the data elements to be shared, and outlining additional measures to be defined by regulation, including further conditions for or limits on disclosure and the specification of purposes for disclosure. However, we would recommend that consideration be given to incorporating a requirement that sharing under clauses 159 and 160 of Bill S-6 be subject to written agreement. Additionally, measures to help prevent against secondary use and onward sharing would be advisable.

In closing, it is important to reiterate that it should be possible to improve regulatory efficiency without unnecessarily infringing on privacy rights. Thank you for the opportunity to provide input on these legislative measures.

Sincerely,