SAFEGUARDING CANADA’S NATIONAL SECURITY WHILE PROTECTING CANADIANS’ PRIVACY RIGHTS: REVIEW OF THE SECURITY OF CANADA INFORMATION SHARING ACT (SCISA) Report of the Standing Committee on Access to Information, Privacy and Ethics Blaine Calkins Chair MAY 2017 42nd PARLIAMENT, 1st SESSION Published under the authority of the Speaker of the House of Commons SPEAKER’S PERMISSION Reproduction of the proceedings of the House of Commons and its Committees, in whole or in part and in any medium, is hereby permitted provided that the reproduction is accurate and is not presented as official. This permission does not extend to reproduction, distribution or use for commercial purpose of financial gain. Reproduction or use outside this permission or without authorization may be treated as copyright infringement in accordance with the Copyright Act. Authorization may be obtained on written application to the Office of the Speaker of the House of Commons. Reproduction in accordance with this permission does not constitute publication under the authority of the House of Commons. The absolute privilege that applies to the proceedings of the House of Commons does not extend to these permitted reproductions. Where a reproduction includes briefs to a Standing Committee of the House of Commons, authorization for reproduction may be required from the authors in accordance with the Copyright Act. Nothing in this permission abrogates or derogates from the privileges, powers, immunities and rights of the House of Commons and its Committees. For greater certainty, this permission does not affect the prohibition against impeaching or questioning the proceedings of the House of Commons in courts or otherwise. The House of Commons retains the right and privilege to find users in contempt of Parliament if a reproduction or use is not in accordance with this permission. Also available on the Parliament of Canada Web Site at the following address: http://www.parl.gc.ca SAFEGUARDING CANADA’S NATIONAL SECURITY WHILE PROTECTING CANADIANS’ PRIVACY RIGHTS: REVIEW OF THE SECURITY OF CANADA INFORMATION SHARING ACT (SCISA) Report of the Standing Committee on Access to Information, Privacy and Ethics Blaine Calkins Chair MAY 2017 42nd PARLIAMENT, 1st SESSION STANDING COMMITTEE ON ACCESS TO INFORMATION, PRIVACY AND ETHICS CHAIR Blaine Calkins VICE-CHAIRS Daniel Blaikie Nathaniel Erskine-Smith MEMBERS Bob Bratina Pat Kelly Emmanuel Dubourg Wayne Long Eli Ehsassi Raj Saini Matt Jeneroux OTHER MEMBERS OF PARLIAMENT WHO PARTICIPATED Mike Bossio Marc Serré Colin Carrie Ramesh Sangha Pierre-Luc Dusseault Brenda Shanahan Bernadette Jordan Robert Sopuck Joël Lightbound Filomena Tassi Rémi Massé Nick Whalen Pierre Paul-Hus CLERK OF THE COMMITTEE Hugues La Rue LIBRARY OF PARLIAMENT Parliamentary Information and Research Service Michael Dewing, Analyst Chloé Forget, Analyst iii THE STANDING COMMITTEE ON ACCESS TO INFORMATION, PRIVACY AND ETHICS has the honour to present its FIFTH REPORT Pursuant to its mandate under Standing Order 108(3)(h)(vi), the Committee has studied the Security of Canada Information Sharing Act (SCISA) and has agreed to report the following: v TABLE OF CONTENTS LIST OF RECOMMENDATIONS .................................................................................... 1 CHAPTER 1: INTRODUCTION ....................................................................................... 5 1.1 Mandate ............................................................................................................... 5 1.2 Overview of the Security of Canada Information Sharing Act .............................. 5 1.2.1 Purpose and Principles of the Security of Canada Information Sharing Act ............................................................................................................. 5 1.2.2 New Information-Sharing Authorities ........................................................... 6 1.2.2.1 Authorities in General ....................................................................... 6 1.2.2.2 Definition of “Activity That Undermines the Security of Canada” ...... 7 1.2.2.3 Civil Immunity ................................................................................... 7 1.2.2.4 Regulations ...................................................................................... 7 CHAPTER 2: CONCERNS REGARDING THE SCOPE OF INFORMATION- SHARING AUTHORITIES IN THE SECURITY OF CANADA INFORMATION SHARING ACT AND ITS PRIVACY IMPACTS ............................................................... 9 2.1 Importance of Finding the Right Balance Between National Security and Privacy .................................................................................................................. 9 2.2 Concerns Regarding the Security of Canada Information Sharing Act .............. 10 2.2.1 Scope of Sharing Under the Act ................................................................ 10 2.2.1.1 Bulk Information Sharing ................................................................ 12 CHAPTER 3: ROLE OF THE SECURITY OF CANADA INFORMATION SHARING ACT .............................................................................................................................. 13 3.1 Views of Federal Institutions on the Role of the Act ........................................... 13 3.2 Views of Various Witnesses on the Role of the Act ........................................... 16 3.2.1 Need for Evidentiary Basis ........................................................................ 16 3.2.2 Pre-existing Authorities .............................................................................. 18 CHAPTER 4: USE AND APPLICATION OF THE SECURITY OF CANADA INFORMATION SHARING ACT TO DATE ................................................................... 21 4.1 Survey by the Office of the Privacy Commissioner ............................................ 21 4.2 Use of the Act by Federal Institutions ................................................................ 21 4.3 Meaning of a “Disclosure” Under the Security of Canada Information Sharing Act ...................................................................................................................... 22 CHAPTER 5: THE NEED FOR LEGAL STANDARDS TO PROTECT PRIVACY ......... 25 vii 5.1 General Concerns About the Lack of Legal Standards ...................................... 25 5.2 Institutions Able to Disclose Information Under the Security of Canada Information Sharing Act and Recipient Institutions in Schedule 3 ....................... 26 5.3 Definition of “Activity That Undermines the Security of Canada” ........................ 28 5.4 Established Thresholds for Sharing Information ................................................ 33 5.5 The Legal Effects of the Security of Canada Information Sharing Act, and its Interaction with Other Judicial Authorities ........................................................... 38 5.5.1 The Interaction Between the Security of Canada Information Sharing Act and the Privacy Act ............................................................................ 38 5.5.1.1 The Perspective of Some Witnesses .............................................. 39 5.5.1.2 The Perspective of Federal Institutions .......................................... 40 5.5.1.3 The Committee’s Recommendations .............................................. 40 5.5.2 Broadening the Mandate of Federal Institutions and Requiring a Warrant to Obtain Certain Information ..................................................... 41 5.5.2.1 Broadening the Mandate of Federal Institutions ............................. 41 5.5.2.2 The Requirement for a Warrant to Obtain Certain Information ....... 42 5.5.2.3 The Committee’s Recommendations .............................................. 43 CHAPTER 6: OVERSIGHT ........................................................................................... 45 6.1 The Importance of Oversight.............................................................................. 45 6.2 Currently Existing Oversight Agencies ............................................................... 48 6.2.1 The Office of the Communications Security Establishment Commissioner, the Security Intelligence Review Committee and the Civilian Review and Complaints Commission for the RCMP ................... 48 6.2.2 The Privacy Commissioner of Canada ...................................................... 49 6.2.3 The Importance of Cooperation ................................................................. 49 6.3 The Best Oversight Model ................................................................................. 50 6.3.1 The Need for Expert Oversight .................................................................. 50 6.3.2 The Choice of One “Super-Agency” or Several Agencies for Oversight .... 50 6.4 The Role of the Privacy Commissioner .............................................................. 54 6.5 A Parliamentary Review ..................................................................................... 55 6.6 Resources, Independence of Oversight Agencies and Access to Information ... 55 6.7 Record-Keeping ................................................................................................. 56 6.8 The View of Federal Institutions ......................................................................... 57 6.9 The Committee’s Recommendations ................................................................. 58 viii CHAPTER 7: PRIVACY SAFEGUARDS ......................................................................