Language selection

OPC Logo Office of the Privacy Commissioner of Canada

Search

Investigation of Immigration, Refugees and Citizenship Canada’s disclosure of personal information to the Canada Border Services Agency

Complaint under the Privacy Act (the “Act”)

September 11, 2023

Report of findings

Overview

  1. The complainant alleges that his Permanent Resident CardFootnote 1 (“PRC”) renewal paperwork, collected by Immigration, Refugees and Citizenship Canada (“IRCC”), was inappropriately disclosed to the Canada Border Services Agency (“CBSA”) and used in support of an “Application to Cessate Refugee Protection” (“cessation application”) contrary to the purpose for which IRCC originally collected the information.
  2. In support of his allegation, the complainant provided an email that confirmed that IRCC did share the complainant’s “Application for a Permanent Resident Card” (“PRC renewal application”) and supporting documentation with the CBSA.
  3. At issue then, is whether IRCC was authorized to disclose the complainant’s personal information to the CBSA, which the CBSA subsequently used,Footnote 2 in accordance with paragraph 8(2)(a), which states that information may be disclosed for a purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose.
  4. After reviewing submissions from the complainant and both IRCC and the CBSA, we found that IRCC’s disclosure of the complainant’s personal information to the CBSA was consistent with the purpose for which the information was collected, and therefore, we find the complaints against both departments to be not well-founded.
  5. Due to the interconnectedness of the matter at issue, all parties agreed to a combined report of findings to address both complaints and the related investigations.

Background

  1. On April 14, 2010, the complainant entered Canada and initiated a refugee claim with a CBSA officer, and on January 13, 2011, was found to be a “Convention refugee” by the Immigration and Refugee Board (“IRB”). Following the IRB decision, the complainant applied for and was granted permanent residence on April 25, 2012, and was issued a PRC.
  2. In June 2012, the Immigration and Refugee Protection Act (“IRPA”) was amended and sections 40.1 and 46(1)(c.1) were added. Section 40.1 provides for the loss of permanent resident status upon determination by the IRB that refugee protection has ceased for reasons described in paragraphs 108(1)(a) to (d) of the IRPA. In other words, following the reform to the cessation regime, a permanent resident could lose their status upon a successful cessation application. 
  3. Upon the complainant’s return to a Canadian port of entry on May 24, 2013, following travel to his country of nationality, a CBSA Border Services Officer (“BSO”) submitted a letter of concern to the CBSA’s Enforcement and Intelligence Operations Division in Toronto, documenting reasons that he was of the view the complainant no longer required refugee protection, including total visits to and obtaining a new passport from his country of nationality. This prompted the review of a possible cessation matter in June 2013.
  4. On December 5, 2014, the CBSA completed a “Cessation Intake and Screening Form,” and the matter was assigned for investigation to a CBSA Hearings Officer (“HO”) in Toronto. The investigation was entered into the Global Case Management System (“GCMS”) in 2016.
  5. The complainant submitted the PRC renewal application to IRCC, signed June 10, 2017, and a renewed PRC was granted on January 30, 2018.Footnote 3
  6. In April 2019, the cessation investigation was transferred to another CBSA HO, who on April 17, 2019, requested the PRC renewal application from IRCC. On April 24, 2019, an employee of the Client Service Unit at IRCC confirmed to the CBSA HO that the PRC application had been uploaded to the mutually accessible GCMS.
  7. In June 2020, the CBSA reassigned the cessation investigation to another HO in Toronto, and in July 2020 to an HO in the Pacific region where the complainant resides.
  8. On August 14, 2020, the CBSA initiated a cessation application at the IRB to cessate the complainant’s refugee protectionFootnote 4 on the basis that he had “voluntarily re-availed himself of the protection of his country of nationality.”Footnote 5 The complainant’s June 2017 PRC renewal application was included in support of the cessation application.

Analysis

Issue: IRCC was authorized to disclose the complainant’s personal information to the CBSA

  1. Subsection 8(1) of the Act states that personal information can only be disclosed with an individual’s consent, or in accordance with one of the categories of permitted disclosures outlined in subsection 8(2) of the Act. Paragraph 8(2)(a) of the Act states that personal information may be disclosed for the purpose for which the information was obtained or compiled by the institution, or for a use consistent with that purpose. To qualify as a ‘consistent use’, an institution’s use of personal information need not be identical to the purpose for which the information was obtained. There need only be a sufficiently direct connection between the two, such that an individual could reasonably expect that the information could be used in the manner proposed.Footnote 6
  2. The complainant alleged that IRCC did not have the authority to disclose his personal information to the CBSA, because the purpose of the disclosure was different from the purpose for which the information was collected. Specifically, the complainant argued that the travel details provided to IRCC in the context of his PRC renewal application were only for that process, and that he did not provide consent for this information to be disclosed to or used by the CBSA for the purposes of a cessation application.
  3. In its submission to our Office, IRCC explained that applications and the supporting documents are only accessed to respond to requests such as those related to Access to Information or Privacy or investigations, for example, and are also only uploaded to the GCMS upon request.Footnote 7 In the matter at hand, the CBSA had requested the information specifying that the request was related to an ongoing cessation investigation.
  4. Both IRCC and the CBSA provided a Memorandum of UnderstandingFootnote 8 between them, which includes an Information Sharing Annex. Section 5.2 of the Annex explains that because of the departments’ shared mandate under IRPA, information sharing between them for the administration and enforcement of IRPA is considered a “consistent use,” in accordance with paragraph 8(2)(a) of the Act. It also states both departments may collect immigration information held in the GCMS.
  5. To renew his PRC, the complainant completed and signed the application form, which included a privacy notice that stated:
    The information you provide on this form is collected under the authority of the Immigration and Refugee Protection Act and will be used to determine whether the term and conditions of your permanent residency were maintained and whether you should be granted a Permanent Resident Card. It will be retained in the Personal Information Bank (“PIB”) CICFootnote 9 PPU 067 entitled Permanent Resident Card as identified in Infosource. It may be shared with other organizations in accordance with the consistent use of information under the Privacy Act. (emphasis added)
  6. The “Consistent Uses” section of the PIB CIC PPU 067 states that:
    The information may be disclosed to the Canadian Security Intelligence Service (CSIS), the Royal Canadian Mounted Police (RCMP) and the Canada Border Services Agency (CBSA) for the purpose of conducting security reviews or investigations related to immigration legislation. (emphasis added)
  7. We note that in 2016, PIB PPU 067 and select other IRCC PIBs were combined into CIC PPU 068 and renamed “Migration Control and Security Management”, but reference to the updated PIB was not reflected on the application form at the time the complainant completed it. PPU 068, however, does indicate that information described in the previous PIB PPU 067 (and others) is now described in 068. During the investigation we reviewed the consistent uses of the updated PIB PPU 068Footnote 10 and we are satisfied that the disclosure was still in accordance with the consistent uses described in the updated PIB. At the time of this report, the application formFootnote 11 had been updated to reference IRCC PPU 068.
  8. Consistent uses of personal information collected by IRCC were defined in the PIBs. Specifically, the PIB stated that personal information could be shared with the CBSA for the purpose of investigations related to immigration legislation. The purpose of a cessation investigation is to establish if there is enough evidence to submit a cessation application to the IRB. We agree with CBSA’s submission that the CBSA can use information collected under the IRPA for a client to enforce IRPA on the same client, which the consistent uses described above allows for, and is permitted pursuant to paragraph 7(a) of the Act.
  9. IRCC explained that the CBSA and IRCC have shared responsibilities for the administration and enforcement of the IRPA. IRCC is responsible for facilitating the arrival of people and their integration into Canada, including refugees, while the CBSA is responsible for managing the flow of travelers at Canadian ports of entry, for intelligence, interdiction of irregular migration and immigration enforcement related to offences under the IRPA.
  10. With respect to cessation matters, IRCC is responsible for the development and oversight of policies, and the CBSA is responsible for administering the operational delivery of cessation policies, and more specifically, HOs are responsible for filing applications for cessation.
  11. The CBSA confirmed that, at the time of the disclosure, the complainant was the subject of a CBSA cessation investigation for reasons highlighted in 2013 including (i) his travel history to the country from which he had sought protection and (ii) the fact that the complainant had obtained a new passport from “the very agents of his alleged persecution.” In this context, the CBSA requested the PRC renewal application from IRCC, as it included travel details relevant to the cessation investigation.
  12. The CBSA went on to explain that:

    The BSO’s notes were not sufficient to be used as credible evidence because the BSO’s notes did not specify what the client said about the return to [his country of nationality] and whether an interpreter was used for the interview at the port of entry.

    The evidence in the PR application made the case much stronger and completely different, because the client admitted to a total of eight return trips to [his country of nationality], and included the number of days spent in [his country of nationality].

    […]

    a client’s own application form, which provides specific dates of entries/exits, and reasons for travel, and includes a sworn declaration that the content is truthful is the best, and strongest documentary evidence that would be available.

  13. In light of the above, we are of the view that the complainant could have reasonably expected that IRCC could disclose his PRC renewal application to the CBSA as described in both the privacy notice on the application form and the PIB.
  14. Accordingly, we consider IRCC’s disclosure of the complainant’s personal information to the CBSA and its subsequent use, both in the context of a cessation investigation, were for a use consistent with the purpose for which the information was originally collected by IRCC, and the complaints are not well-founded.
Date modified: