Disclosure to Interpol raises concerns regarding electronic transmission of personal information
Complaint under the Privacy Act (the Act)
The complainant in this case alleged that the Canada Border Services Agency (CBSA) improperly disclosed his personal information to his country of origin.
Specifically, the complainant alleged that the CBSA disclosed his personal information without consent to the High Commission of Canada to Ghana, which then used this information to contact the International Criminal Police Organization (Interpol) in Lagos, Nigeria, and the Nigerian authorities in order to verify information regarding his criminal history.
Summary of Facts
Our investigation established that the complainant filed a claim for refugee status at the Montreal-Trudeau International Airport on November 3, 2007.
The Personal Information Form (PIF) filed by the complainant in support of his refugee claim stated that he feared persecution by the Nigerian Government for his membership in the Movement for the Actualization of the Sovereign State of Biafra (MASSOB) – a secessionist movement for the establishment of an independent state of Biafra. To support this claim, the complainant produced a decision of the High Court of Imo State, Orlu Judicial Division, Federal Republic of Nigeria, dated December 19, 2005 (the “Judgment”).
According to the Judgment, the complainant was tried in absentia and found guilty of treason pursuant to the criminal code of the Federal Republic of Nigeria for his participation in activities as a member of the MASSOB. The complainant was sentenced to life imprisonment. The Judgment was signed by a Justice of the High Court of Imo State on December 19, 2005.
According to the CBSA’s representations, other documents submitted by the complainant in support of his refugee claim were either inauthentic or obtained fraudulently. For example, the complainant self-declared that the German passport he used to travel to Canada belonged to a third party; the CBSA also submits that the seaman card he provided was obtained fraudulently. The CBSA also confirmed through an expert’s analysis that the driver’s licence he submitted was a counterfeit document.
Our investigation confirmed that, on February 4, 2009, a request was made by CBSA officials in Canada to verify the authenticity of the Judgment presented by the complainant to support his refugee claim.
An Enforcement Officer of the CBSA’s Security and War Crimes Unit in Montreal, Quebec, sent an e-mail to the First Secretary and Migration Integrity Officer (MIO) at the High Commission of Canada to Ghana in Accra (hereafter “High Commission”), requesting assistance for the verification of the document in question.
The CBSA confirmed that the MIO at the High Commission was an employee of the CBSA at the time. The e-mail was also copied to an individual confirmed by the CBSA to be legal counsel in the Immigration Directorate of the Department of Justice Canada.
The e-mail clearly indicated that neither the status or location of the subject requesting asylum should be disclosed during the verification process. The CBSA Enforcement Officer shared the following details in the e-mail with the MIO at the High Commission: the complainant’s name, the court file number, the citation for the Judgment, the date of the Judgment, and the name and contact information of the complainant’s lawyer in Nigeria.
In response, the MIO at the High Commission indicated that it would be easier to proceed with the verification if the CBSA could forward the document(s) in question.
Our investigation confirmed that the CBSA Enforcement Officer in Montreal provided a copy of the Judgment to the High Commission for the purpose of verifying its authenticity.
We confirmed that the MIO at the High Commission subsequently communicated in writing with InterpolFootnote 1 on February 25, 2009. The letter was addressed to the Commissioner of Police, Interpol Section, Force CID, Alagabon Close, Okoyi, Lagos, and requested the assistance of Interpol to verify the authenticity of the Judgment dated December 19, 2005, and signed at the High Court, Imo State, in the case between the state and the complainant.
Specifically, the letter asked Interpol to advise in writing if the Judgment was genuine, and indicated that a copy of the Judgment was being sent to Interpol by e-mail.
We confirmed that the e-mail referenced in the letter to Interpol was sent on February 25, 2009 by the assistant to the MIO in the Migration Integrity Unit at the High Commission.
The e-mail was sent to: ncblagos@yahoo.co.uk, which refers to the general e-mail address for the Interpol National Central Bureau (NCB) in Lagos, NigeriaFootnote 2.
The e-mail was cc’d to the MIO at the High Commission, and also cc’d to another Yahoo! e-mail address, confirmed by the CBSA to be the address of a Detective responsible for coordinating requests for assistance within the Interpol NCB.
In the body of the email, the assistant to the MIO writes that he will be contacting the Detective’s office from time to time on behalf of the Migration Integrity Unit of the Canadian High Commission in Accra, Ghana, regarding the verification of Nigerian documents. The e-mail requests that the recipients see the attached request for verification of a Court Judgment from Nigeria. A copy of the Judgment was attached to the e-mail.
A follow-up e-mail was subsequently sent to the CBSA Enforcement Officer in Montreal who had initially made the request for verification. The e-mail was sent by the MIO at the High Commission on February 25, 2009, and confirmed that a request had been made to Interpol to verify the authenticity of the Judgment.
Our investigation confirmed that the complainant was granted protected person status by the Immigration and Refugee Board (IRB) on March 26, 2009.
On December 16, 2010, Interpol sent a letter of response to the High Commission advising that it had determined the Judgment to be a forged document. A copy of the Court’s report was attached to the letter and confirmed that the Judgment was not issued by the Court in issue, and that the Judge named in the Judgment had never presided at that Court.
The letter, written on Interpol letterhead, states that forgery of a document in Nigeria is a serious offence, and indicates that the Bureau would appreciate any information that could assist in the apprehension and prosecution of the author of the forged document.
The letter further apologizes for the late response to the High Commission’s request for information and is signed by the Head, PRSD/Liaison, for the Commissioner of Police, Interpol NCB of Nigeria, Nigeria Police Force CID Annex.
On the basis that the complainant had obtained protected person status as a result of directly or indirectly misrepresenting or withholding material facts relating to a relevant matter in his claim for protection pursuant to section 109 of the Immigration and Refugee Protection Act (IRPA), we confirmed that the Minister of Public Safety filed an application to vacate the Immigration and Refugee Board’s (IRB’s) decision to grant the complainant status on February 23, 2011.
While additional procedural steps were subsequently taken in relation to the complainant’s immigration status, including related proceedings before the Federal Court, this Office has only outlined those relevant in context to this complaint investigation.
Representations from the Complainant
Further to paragraph 2 of this Report, the complainant alleged that the CBSA disclosed his personal information – including a copy of the Judgment submitted as part of his refugee claim – without consent to the High Commission, Interpol and to Nigerian authorities.
The complainant submits that his lawyer and his brother were contacted by Nigerian authorities in relation to his whereabouts, and provided the following documents to support his claim:
A copy of a letter from his lawyer dated November 19, 2010, in which he advises the complainant that he was allegedly visited at his office in Imo State by an individual seeking to verify the 2005 Judgment in relation to the complainant. The lawyer alleged that the individual wanted him to negotiate a settlement, and in exchange, he would send back a positive report in relation to the complainant to the Canadian High Commission in Accra.
A copy of a letter from the Nigeria Police Force dated December 2, 2010, wherein the complainant’s lawyer was allegedly summoned to appear for an interview regarding the whereabouts of the complainant. According to the letter, a Migration Integrity Officer at the High Commission of Canada in Accra allegedly confirmed that the complainant is in Canada seeking political asylum.
A copy of a letter from the Nigeria Police Force dated August 16, 2012, in which the complainant’s lawyer was allegedly contacted regarding an interview that took place in relation to the complainant. The letter advised the lawyer that his non-collaboration on the apprehension of the subject [the complainant] is a clear indication of perjury and against the law of the Federal Republic of Nigeria.
A copy of an e-mail the complainant received from his brother on November 18, 2010. His brother alleged that an individual visited his house in Ndiowerre Village, Orlu, Imo State, claiming to be a police officer from Lagos, working with the Canadian Embassy in Ghana. His brother alleged that the individual was visiting to verify a Court Judgment in relation to the complainant.
We confirmed that the complainant also raised concerns directly to the Minister of Public Safety and Emergency Preparedness in February 2012 regarding his immigration status and the alleged improper disclosure of personal information to his country of origin.
The Minister’s response, dated April 27, 2012, highlights the fact that verifications with Interpol are done routinely. The letter also states that Canadian jurisprudence has determined that when information is compiled for the purpose of enforcing the IRPA, disclosing this information to a foreign state to make a decision in that respect – such as deciding whether a claimant is exluded from the definition of refugee – constitutes a consistent use under the Privacy Act.
The letter from the Minister also references two Federal Court decisions relating to the complainant: the dismissal of the complainant’s application for leave to bring an application for judicial review seeking relief in the form of mandamus to order the Minister of Citizenship and Immigration to process the complainant’s application for Permanent Residency (July 2011); and the dismissal of a motion to enjoin the Minister of Public Safety and Emergency Preparedness from proceeding with an application to vacate the decision allowing the complainant’s claim for refugee protection (January 2012).
The letter also references an application for judicial review brought by the complainant against the Minister of Public Safety and Emergency Preparedness and the CBSA (2014 FC 34) for alleged abuse of discretion by the respondents in disclosing information to the Government of Nigeria in contravention of the IRPA. The complainant sought an order restraining the respondents from any further such disclosures. We note that in January 2014, the Federal Court dismissed the application for lack of jurisdiction, since the complainant had failed to seek leave to bring the application, as required under the IRPA.
During the course of the investigation, the complainant made several submissions to this Office to support his allegations. All representations were assessed, and the evidence relevant in context to this complaint investigation is detailed in this Report.
Representations from the CBSA
The CBSA submits that a request for verification of the authenticity of the Judgment to the High Commission of Canada to Ghana was made in order to enforce the IRPA, for refugee determination purposes, and to maintain the integrity of the immigration system. This action was taken because other documents submitted by the complainant in support of his refugee claim were either not authentic or were obtained fraudulently.
Further to paragraph 7, the CBSA first shared information about the complainant with officials at the High Commission on February 4, 2009, in order to provide them with contextual information about the document to be verified.
The information in the e-mail was limited to the complainant’s name, the court file number, the citation for the Judgment, the date of the Judgment, and the name and contact information of the complainant’s lawyer in Nigeria. Upon request by officials at the High Commission, a copy of the Judgment was subsequently provided for the specific purpose of allowing the High Commission to verify its authenticity.
The Enforcement Officer expressly specified in the e-mail that the High Commission was not to disclose the whereabouts and the status of the individual concerned since he had made a claim for asylum. The following message appeared above and below the body of the email in capital letters: “Ne pas divulguer le status et la localisation du sujet. Demandeur d’asile.” According to the CBSA, it was not necessary to disclose why the individual was in Canada or his status as a refugee claimant in order to seek verification of the Judgment.
The CBSA submits that only the CBSA, the High Commission of Canada to Ghana, and the Interpol NCB of Nigeria were involved in the process of verifying the authenticity of the Judgment. The CBSA transmitted the Judgment to the High Commission, which then requested the assistance of the Interpol NCB of Nigeria. No other party was involved in this process, including the Imo State or the Nigerian Authorities.
The CBSA confirmed with officials at the High Commission in Ghana that the Detective to whom the e-mail and attached Judgment was sent was an employee at Interpol at the time the request for assistance was made. He was responsible for coordinating requests for assistance within the Interpol NCB in Lagos. According to the CBSA, the Detective assigned his colleague to respond to the request for verification.
The CBSA further submits that it is a common practice for CBSA Liaison Officers to communicate with foreign government officials in some parts of Africa through commercial e-mail service providers, such as Yahoo!, because many of these countries do not maintain their own e-mail services. According to the CBSA, communicating through e-mail is an acceptable practice when the personal information is not particularly sensitive. It submits that the Judgment was not considered particularly sensitive because, if genuine, it would have been a public record.
The CBSA attests that it provided the Judgment to the High Commission in Ghana for the purpose of verifying its authenticity. As the Government of Canada does not have a strong bilateral relationship with the Government of Nigeria, the CBSA expected that an alternative method of verifying the authenticity of the Judgment would be employed by the High Commission on its behalf. In the circumstances, the CBSA asserts that a request for assistance to the Interpol NCB in Lagos was considered to be the best mechanism to accomplish this with minimal impact on the individual.
The CBSA further attests that no one from the High Commission went to the Imo State in Nigeria or communicated about the complainant with Nigerian authorities. Furthermore, the CBSA submits that Interpol did not make area trips in order to verify the Judgment on its behalf. The verifications were conducted through central registry or by phone.
The CBSA submits that the request for assistance to verify the authenticity of the Judgment was limited to the document itself. No additional information regarding the complainant, his lawyer, or any of his associates was provided to Interpol.
Further, the request for assistance clearly stated that the information was being disclosed for the purpose of verifying the document’s authenticity. Article 10 of Interpol’s Rules on the Processing of Data specifically limits NCBs from using information provided for the purpose of international police cooperation for a secondary purpose. According to the CBSA, Interpol member countries are bound by the organization’s Constitution and associated regulations, which limit the secondary use of information provided as part of a request for assistance. Any subsequent use or disclosure of the information by the NCB in Lagos could indicate a violation of Interpol’s governance framework.
The CBSA asserts that the Enforcement Officer was aware that the complainant’s country of origin was Nigeria. There was no wrongful communication by the CBSA officer in disclosing the Judgment to the High Commission, or in the High Commission’s subsequent disclosure of the Judgment to the Interpol NCB of Nigeria. The request for verification was submitted because other documents submitted by the complainant in the context of his claim for refugee status were found to be counterfeit or to have been obtained fraudulently.
It is the CBSA’s position that the complainant’s consent was not required for it to disclose his personal information, including a copy of the Judgment, to the High Commission for the purpose of verifying the authenticity of the Judgment. The disclosure to the High Commission was authorized by the IRPA for refugee determination purposes and constituted a consistent use under paragraph 8(2)(a) of the Privacy Act.
During our investigation, we also reviewed an Affidavit sworn by the CBSA Enforcement Officer that sent the initial request for verification to the High Commission. The Affidavit was sworn on August 29, 2012. In addition, we reviewed the Enforcement Officer’s sworn responses to the complainant’s written examination, dated October 11, 2012.
In the Affidavit, the Enforcement Officer attests that the only information about the complainant that was communicated to the High Commission was the information contained in the Court Judgment. The Judgment document did not contain any information regarding the complainant’s family or his legal counsel.
The Affidavit also references statements made by an Immigration Counsellor at the High Commission who confirmed that the document sent to Interpol was the Imo State Court Judgment outlining the charges and alleged conviction of the complainant, his age, the ward where he lived, and rank within MASSOB. He confirmed that no other document was provided to Interpol, and that the Judgment makes no reference to the complainant’s counsel in Nigeria.
The Immigration Counsellor confirmed that the Interpol verification results were received by mail almost two years after the initial request was made. According to the Interpol Police Superintendent, Canadian requests are low on Interpol’s list of priorities.
The Enforcement Officer attests that the Judgment was communicated to the High Commission, which in turn transferred it to the Interpol NCB of Nigeria, before the Refugee Protection Division of the IRB rendered a decision regarding the complainant’s refugee protection claim.
In addition, while the letter of response from Interpol states that forgery of a document in Nigeria is a serious offence, and indicates that the Bureau would appreciate any information that could assist in the apprehension and prosecution of the author of the forged document, the Enforcement Officer attests that neither the High Commission or the CBSA replied to this request.
Further to this Office’s request for any relevant procedures or guidelines for conducting verifications of this nature with the country of origin and Interpol, the CBSA provided a copy of a procedure entitled, “ENF 13 CPIC Access and Warrant Management, and Interpol Procedures” (the “Procedure”).
However, the CBSA indicated that this Procedure was not yet in force at the time the request was made to the High Commission; therefore, the initial request to the High Commission would not have been captured by it. The CBSA confirmed that the Procedure came into force in May 2013.
In addition to our review of the CBSA’s submissions during the investigation, our Office also provided a preliminary Statement of Facts (Statement of Facts) to the CBSA on September 30, 2014. The purpose of the Statement of Facts was to provide the CBSA an opportunity to confirm the accuracy of the facts as understood by our Office, and to seek clarification in relation to some of the CBSA’s representations.
The CBSA responded to the Statement of Facts with two sets of submissions, received by our Office on January 15, 2015 and February 13, 2015.
Application
In making our assessment, we considered sections 3, 7 and 8 of the Act.
Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing: information relating to race, national or ethnic origin, colour, religion, age, marital status, education, medical, criminal or employment history, financial transactions, identifying numbers, fingerprints, blood type, personal opinions, etc.
Paragraph 7(a) of the Act states that personal information shall not, without the consent of the individual to whom it relates, be used by the institution except for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose.
The Act states that personal information can only be disclosed with an individual’s consent – subsection 8(1) – or in accordance with one of the categories of permitted disclosures outlined in subsection 8(2) of the Act.
Analysis
The information disclosed by the CBSA for the purposes of verifying the authenticity of a Judgment produced by the complainant – including a copy of the Judgment which identified the complainant’s name, age, the ward where he lived, rank within MASSOB, and charges and conviction – is clearly personal information as defined by section 3 of the Act.
At issue is whether the CBSA is in contravention of section 8 of the Act in this case for the disclosure of the complainant’s personal information without consent to the High Commission in Accra, Ghana, which then disclosed this information to Interpol for the purpose of requesting assistance to verify the authenticity of the Judgment.
The following paragraphs outline our analysis and findings based on the evidence gathered in the course of our investigation.
Disclosure of the complainant’s personal information for the purpose of verifying the authenticity of a document during the refugee determination process was a consistent use under paragraph 8(2)(a) of the Act
Our investigation confirmed that on February 4, 2009, a request was made by CBSA officials in Canada to verify a 2005 Judgment produced by the complainant to support his refugee claim.
The CBSA submits that this action was taken because other documents submitted by the complainant in support of his refugee claim were either inauthentic or obtained fraudulently. The request for verification of the Judgment was made pursuant to the IRPA for refugee determination purposes.
Our review confirmed that the request for assistance was initially made by a CBSA official in Montreal, to the High Commission in Accra, Ghana. The initial request was sent by e-mail and included details from the Judgment as well as details about the complainant’s lawyer. The e-mail clearly indicated that neither the status nor location of the subject should be disclosed during the verification process. The initial e-mail did not include any attached documents.
In response, the High Commission requested a copy of the Judgment in order to proceed with the verification. We confirmed that a copy of the Judgment was forwarded to the High Commission. Based on the evidence before us, we are satisfied that no other document or information concerning the complainant was forwarded to the High Commission.
On February 25, 2009, the MIO at the High Commission communicated in writing with Interpol and requested verification of the authenticity of the Judgment. The letter also indicated that a copy of the Judgment was attached to an e-mail that was also forwarded to Interpol. We confirmed that the e-mail was sent on this same date to the general e-mail address for the Interpol NCB in Lagos, Nigeria, and cc’d to the MIO at the High Commission, as well as to a Detective, who was confirmed to be an Interpol employee at the time the request for assistance was made. A copy of the Judgment was attached to the e-mail.
Based on the above, the disclosure in question took place in two stages – the first from the CBSA in Canada to the High Commission in Accra, Ghana; the second from the High Commission to Interpol. Our investigation confirmed that both disclosures are disclosures for which the CBSA is accountable.
In this case, the CBSA sought to verify the authenticity of the document presented by the complainant to support his allegation of a well-founded fear of persecution in his country of origin. According to the CBSA, the request was made because several other documents on which the complainant’s claim was based were found to be inauthentic or were obtained fraudulently.
To this end, we are satisfied that the sharing of information with officials at the High Commission in Ghana – confirmed to be CBSA employees – was for the specific purpose of seeking assistance to verify the authenticity of the Judgment submitted by the complainant as part of the refugee determination process.
We are of the view that the information shared with the High Commission was necessary and relevant to provide context to the request, including sharing a copy of the Judgment.
However, we note that the Enforcement Officer’s Affidavit evidence appears to be a narrow description of the facts in this case. In particular, while we are satisfied that the Judgment document did not contain any information regarding the complainant’s family or his legal counsel, we highlight that the initial e-mail sent to the High Commission by the Enforcement Officer did in fact include details regarding the complainant’s lawyer.
Based on the CBSA’s representations, we are nevertheless satisfied that this information was necessary and relevant to provide context to the CBSA’s request to its liaison officials at the High Commission.
We are also satisfied that the subsequent disclosure of the complainant’s personal information by the High Commission to Interpol was for the specific purpose of seeking assistance in verifying the authenticity of the Judgment. We are of the view that the disclosure was appropriately limited to the information necessary for Interpol to verify the authenticity of the document – specifically, a copy of the Judgment.
The investigation revealed no evidence that Interpol was provided with any information beyond that contained in the Judgment, or that Interpol was advised by the CBSA that the request for verification was being made in the context of the complainant’s claim for protection in Canada.
Consequently, we are satisfied that the disclosure of the complainant’s personal information to the High Commission and Interpol was permitted under paragraph 8(2)(a) of the Act, as it was necessary to fulfil the original purpose for which the information was collected by the CBSA – namely, for refugee determination purposes and the enforcement of the IRPA.
CBSA procedures for document verification insufficient
Notwithstanding the above, our investigation also assessed the manner in which the disclosure occurred, and in particular, whether the request for verification was governed by any CBSA procedure.
In its representations to our Office, the CBSA provided a copy of its internal procedure entitled, “CPIC Access and Warrant Management, and Interpol Procedures” (the “Procedure”). While the CBSA confirmed that the Procedure was not in force at the time the request was made to the High Commission, it confirmed that it came into force in May 2013. To this end, we reviewed the Procedure and take this opportunity to provide our comments to the CBSA.
In our view, the Procedure appears to relate specifically to requests for criminal history checks, including for refugee claimants. The Procedure outlines the grounds for which they are to be conducted, and that requests are to be mailed to the Information and Identification Services branch of the Royal Canadian Mounted Police (RCMP).
We note in this case that the request for assistance was not a request for a criminal history check, but rather, a request for verification of the authenticity of a Judgment in a criminal proceeding. Therefore, it is not clear that the Procedure would have governed the disclosure to Interpol in the circumstances of this complaint even if it had been in force at the relevant time.
Nevertheless, it is interesting to note that the Procedure underlines the need to exercise caution in seeking Interpol’s assistance in cases involving refugee claimants. According to the Procedure, such requests should only be made in the most serious cases and require taking all possible measures to avoid creating risk to the claimant or his or her family.
While we are satisfied that the disclosure to Interpol in this case was in line with the administration and enforcement of the IRPA, we are nevertheless concerned that the request for assistance may not have been governed by any established CBSA procedure at the time to prescribe the grounds and limitations for such a request.
Concerns regarding the electronic transmission of personal information
According to the CBSA, it expected the High Commission to use an alternative method to verify the authenticity of the Judgment on its behalf. The request for assistance to the NCB in Lagos was considered to be the best mechanism to accomplish this with minimal impact on the individual.
Our investigation revealed that the communication of the verification request by the High Commission to the Interpol NCB was made in writing – both by letter to the attention of the Commissioner of Police, Interpol Section; and by e-mail to the attention of a Detective responsible for coordinating requests for assistance within the Interpol NCB.
Further to paragraphs 16 and 17 of this Report, we highlight that the e-mail was forwarded to the general e-mail address of the Interpol NCB in Lagos, Nigeria, at ncblagos@yahoo.co.uk; and it was also cc’d to a Yahoo! e-mail address confirmed to be a Detective at Interpol.
The CBSA submits that it is common practice for CBSA Liaison Officers to communicate with some foreign government officials in Africa through commercial e-mail service providers, because many countries do not maintain their own e-mail services. The CBSA further submits that this is an acceptable practice when the personal information is not particularly sensitive – the CBSA determined that the Judgment was not considered particularly sensitive because, if genuine, it would have been generated by the Nigerian judiciary and should therefore have been a public record.
As an institution subject to the Act, the CBSA is required to take reasonable measures to protect the personal information under its control from risks such as unauthorized access, use or disclosure. Accordingly, this includes the implementation of measures for the secure handling, communication, or transmission of personal information.
We note in this case that the request for assistance was sent to Interpol by regular mail, as well as e-mail. In our view, e-mail is not a secure and reliable method to communicate personal information, particularly commercial e-mail service providers such as Yahoo! that do not provide a reasonable level of privacy protection, or safeguards such as data encryption.
We also highlight that that the assessment of the sensitivity of personal information is highly contextual. The disclosure of personal information concerning a refugee claimant to his or her country of origin will often be inherently sensitive, since the individual’s claim for refugee status must be based on a well-founded fear of persecution in their country of origin. Moreover, even where the context of the request isn’t disclosed, officials in the country of origin can infer possible reasons for such a request.
Consequently, while it may be common practice to communicate with some countries in Africa via e-mail, there must then be procedural safeguards in place to minimize any risks to the personal information being communicated, including an assessment of the potential risk for harm to the safety and security of the individual seeking protection under Canada’s refugee program.
Further to paragraph 82 of this Report, we again raise concerns that the request for assistance in this case may not have been governed by any CBSA procedure, including any procedure that prescribes the acceptable manner by which the verification is to be conducted.
Alleged contact by the Nigerian Police Force: beyond the jurisdiction of the OPC
The complainant in this case also alleged that his lawyer and his brother were contacted by Nigerian authorities in relation to his whereabouts and provided documentation to support his claim.
To this end, we understood the complainant’s allegations to also concern the possible secondary disclosure of personal information by the Interpol NCB to the Nigerian authorities.
While we have assessed the evidence presented by the complainant in this case, we highlight that this Office has jurisdiction to examine the disclosure of information by the CBSA to Interpol. This Office does not have jurisdiction over the personal information handling practices of Interpol or the Nigerian Police Force.
Nevertheless, we highlight that the CBSA has attested that no one from the High Commission went to the Imo State in Nigeria, or communicated about the complainant with Nigerian authorities. Furthermore, the CBSA submits that Interpol did not make area trips in order to verify the Judgment on its behalf.
The CBSA has also underlined that Interpol member countries are bound by its Constitution and associated regulations which limit the secondary use of information provided as part of a request for assistance. In particular, Article 10 of Interpol’s Rules on the Processing of Data specifically limits NCBs from using information provided for the purpose of international police cooperation for a secondary purpose.
Based on the complainant’s representations in this case that the information in question may have been used for a secondary purpose, we would nonetheless encourage the CBSA to discuss with the RCMP’s Information and Identification Services – Canada’s official Interpol representatives – the options available where secondary uses are suspected.
Findings
As a result of our investigation, we are satisfied that the disclosure of the complainant’s personal information in this case was for a purpose consistent with that which originally justified its collection, and that the disclosure is therefore authorized by paragraph 8(2)(a) of the Act.
Accordingly, we have concluded that the matter is not well-founded.
Notwithstanding the above, we take this opportunity to remind the CBSA of its obligations under the Act to ensure the ongoing protection of the personal information disclosed in furtherance of its legislative mandate under the IRPA – particularly in the context of requests for assistance to international counterparts such as Interpol.
Compliance with the Privacy Act should not unduly hinder the CBSA in carrying out its immigration and refugee-related enforcement activities; however, the CBSA’s authority to disclose personal information under the IRPA in the furtherance of these objectives must be read in light of its obligations under the Privacy Act in order to avoid inappropriately broad disclosures of personal information.
Despite the discretionary nature of the decision under paragraph 8(2)(a) of the Act, in the immigration context and especially in the case of refugee claimants, the Minister has a duty to ensure that any disclosure pursuant to paragraph 8(2)(a) is limited and proportionate.
While we are satisfied that the disclosure in this case was appropriately limited to the information necessary for Interpol to verify the authenticity of the document relied on by the complainant in his claim for refugee status, we are concerned that the request for assistance was not governed by any CBSA procedure at the time.
Given the potential risk to a refugee claimant or his or her family when personal information is disclosed to the country of origin, such a procedure could provide guidance as to the circumstances that justify such requests for assistance, underline the importance of limiting the information disclosed, and outline acceptable methods for conducting such verifications – all with a view to reducing the risk to the affected individual.
The disclosure of personal information in the context of requests for assistance to international counterparts should take place according to clear and comprehensive procedures that are strictly followed in order to minimize potential risk of harm to refugee claimants and their family members, in particular by alerting authorities in the country of original to the individual’s status and location.
To this end, the manner in which the verification is conducted must be tailored to ensure that the claimant’s right to privacy is respected and that his or her safety is not endangered by the disclosure. This includes consideration for the manner in which the information will be transmitted (e-mail, regular mail, etc.), as well as any prescribed security measures to ensure the security of the information during and after transmission.
It also stands to reason that proper guidance and training is crucial to support the consistent implementation of the procedures established for all requests for assistance. The CBSA has an obligation to ensure its liaison officials abroad are aware of and implement these policies and procedures, including the need to exercise due caution when disseminating sensitive information relating to refugees and refugee claimants.
Further to paragraph 97 of this Report, we would also encourage the CBSA to discuss with the RCMP the recourse options available where secondary disclosures of personal information by Interpol or its NCBs are suspected.
We are pleased that the CBSA’s Procedure entitled “CPIC Access and Warrant Management, and Interpol Procedures” is now in force. However, we encourage the CBSA to review the Procedure in consideration of our comments noted herein with a view to strengthening its verification process, particularly in the context of requests for assistance to international counterparts such as Interpol.
Other
We now take this opportunity to comment on the length of time it has taken to conclude this investigation. We first want to apologize to the complainant that it has taken over two years for our Office to finalize our investigation and to report our findings.
Our Office depends on the timely submission of representations from government institutions as a crucial element in the fulfillment of our duty to investigate complaints under the Privacy Act.
We note that it took one year for the CBSA to provide its initial representations to our Office in response to this complaint. We recognize that some delay on this file may be attributable to the international consultations required by the CBSA to obtain the relevant information requested by our Office. We also appreciate that the CBSA reported resource-related challenges during that time period.
Nevertheless, we want to emphasize the importance of improving efforts to reduce the turnaround time to respond to our Office. When federal institutions provide timely responses to our requests, it strengthens transparency and accountability for the handling of personal information, and helps institutions meet their obligation to ensure that personal information is not used or disclosed in a manner contrary to the Act. It also helps ensure that when issues of concern are identified, they are addressed in a timely manner.
