Spy agencies must be accountable to Canadians for what they do with personal information, says interim privacy commissioner Chantal Bernier in a special report released today.

The report addresses the growing concern of whether privacy rights are protected in the context of national security and offers a number of recommendations for better oversight of spy agencies, especially in an increasingly technological age of intelligence gathering.

Communications Security and Establishment Canada (CSEC), which specializes in cybersecurity, and Canadian Security and Intelligence Service (CSIS), dealing with human intelligence, are the country's two spy agencies. 

The report says the changing face of terrorism, spurred on by ease of global mobility and greater use of internet tools, means intelligence activities now zero in on individuals within general populations. 

And that activity is being carried out online and on social networking sites such as Facebook and Twitter, which have "the potential to become the predominant collection channel."

"The potential for intrusion upon privacy within this new context is such that it calls for commensurate privacy protection," the report says.

Among other things, the report recommends an overhaul of current privacy legislation — namely, the Privacy Act and Personal Information Protection and Electronic Documents Act (PIPEDA) — to curb over-collection. It calls for government departments to prove a need to gather personal information, as well as to report publicly how telecommunications companies give information to national security agencies without going through the courts. 

The interim privacy commissioner also calls for CSEC to disclose when it works with other federal agencies, as well as an annual report detailing its activities and risk assessments.

Generally, the report urges more transparency to give Canadians a better understanding of the collection, use or disclosure of personal information in the context of federal intelligence activities.

Expectation of personal privacy 'not held up'

The New Democrats agree with Bernier's findings.

Defence critic Jack Harris said the current system is outdated and needs to be modernized. He pointed out the Privacy Act hasn't been updated since 1983.

"There wasn't even an internet in 1983 that people were using," he said.

People have an expectation of privacy even as they interact online, said Harris, but it's not being held up "based on how technology works today."

"We've got technology that's being used — and misused — by our governmental agencies and we haven't got a handle on it." 

The NDP called for parliamentary oversight of Canada's security and intelligence activities back in October. Harris sought unanimous consent for a motion to create a special committee that would study and make recommendations on how best to oversee the spy agencies.

The motion was ultimately defeated.

The Conservative government offered a more muted response to the report and said it will "have a dialogue" with Bernier.

"We, of course, are also charged with the responsibility of national security," said Treasury Board President Tony Clement. "So it's always a balancing of interests."

Spy watchdogs operate in silos

A major concern expressed in the report is the inability for watchdogs to keep a close eye on Canada's spy agencies.

The Security Intelligence Review Committee oversees CSIS, while CSEC falls under the purview of its own commissioner. The problem is that information is being shared more and more among spy agencies, but oversight committees still work with a limited mandate. The two watchdogs operate in silos and there are no provisions under current legislation for joint reviews or investigations. 

The office of the privacy commissioner also wants in.

Though it's responsible for protecting the privacy of Canadians, under the Privacy Act, OPC is not allowed to co-operate with the spy watchdogs when it comes to matters of national security. And so it recommends that the act be amended to enable co-operation.

"Independent review mechanisms ensure this accountability of security agencies, safeguard public trust and verify demonstrable respect for individual rights," reads the report. 

Other recommendations include:

  • Extend existing reporting requirements on use of surveillance, including separating domestic and foreign mandated activities.
  • Update the overview of Canada's intelligence community, and describe how intelligence is gathered and what internal controls exist.
  • Regulate access to open-source information and investigations exploiting publicly available personal information.
  • Increase the role of Parliament in intelligence oversight, including regularly calling on members of the intelligence community to appear before committees. 

CSEC said the government will review the commissioner's findings and noted it is taking steps to better inform Canadians, including publishing new fact sheets on its website.

"We have rigorous policies and procedures in place to ensure we follow the law and protect the privacy of Canadians," the agency said in a statement.

CSEC also noted that its activities are reviewed by the commissioner, "who over 16 years has never found CSE to have acted unlawfully."

"In fact, he has specifically noted our culture of lawful compliance and genuine concern for protecting the privacy of Canadians."

Read the interim privacy commissioner's report below.

Mobile users, read the report here