Protecting the Privacy of Canadians with Enhanced Driver's Licences

Remarks at the National Public Forum on Enhanced Drivers Licences

Ottawa, Ontario
March 24, 2009

Address by Chantal Bernier
Assistant Privacy Commissioner of Canada

(Check against delivery)

---

Introduction

Good morning, ladies and gentlemen. It is a pleasure to be part of this panel to discuss the development of EDL programs, and I want to applaud the International Civil Liberties Monitoring Group and the other organizers for creating this opportunity to raise awareness about enhanced drivers licences and their potential impact on privacy.

There is a tremendous amount of expertise in the room, and specialized knowledge in various aspects of this complex, multi-jurisdictional issue.

Therefore, my intent is 

• to focus on the federal role,
• to share with you the perspectives and the activities of the Office of the Privacy Commissioner of Canada in relation to this issue,
• and to leave you with some thoughts on safety, security and the elusive and vulnerable nature of privacy.

The Federal Role

As you know, drivers licences  and any security enhancements that may be contemplated for them -- fall under provincial jurisdiction.

The development of EDLs for use as international travel documents, however, falls under federal jurisdiction, just like passports. EDLs were proposed as a way to meet the requirements of the Western Hemisphere Travel Initiative, which will require secure travel documents at U.S. border points by June.

From the perspective of privacy and the handling of the personal information EDLs are of great interest to me and the Office of the Privacy Commissioner of Canada.

As such, we have taken on a national leadership role, working with the Canada Border Services Agency to co-ordinate efforts to protect the personal information of Canadians who are or will be participating in a provincial EDL program.

Position of the OPC

While respecting always the jurisdiction of the provinces on this file, my Office, the OPC, has been keeping a close watch on the privacy dimensions.

Indeed, we have been engaged on this issue from the outset.

What we saw initially was alarming, but I am happy to say that, working with the CBSA, the U.S. Department of Homeland Security and our provincial counterparts, we have been able to effect some positive changes.

And so, if I were to put our position on enhanced drivers licences in a nutshell, I would describe it as one of cautious tolerance. 

Why Caution?

There are two principal reasons why we are cautious about this development.

The first relates to the underlying technology.

In particular, my Office and other privacy proponents are concerned about the long-range radio-frequency identification (RFID) technology embedded in EDLs.

It is supposed to be able to send a signal about 10 metres, from the card to the U.S. customs official, as the cardholder approaches the border.

The information transmitted by the RFID tag is actually a unique identifying number for the cardholder. The customs officer then uses the number to call up information on the cardholder from one or more databases.

One concern about such long-distance radio signals is that you become a walking invitation to remote and covert monitoring. Technically, anyone with an RFID reader  an antenna, basically  can read the information on your card, provided they are within range.

This could expose you to unwanted identification and even tracking and surveillance. It is also possible for people with mobile readers to illegally capture the data that would allow them to clone other peoples cards.

Our second key concern relates to the personal information that will be carried on the EDLs, and how it will be used.

One of the by-products of the computer age is that information about us is constantly being collected  with or without our knowledge and consent. EDLs represent yet one more way in which this can happen.

In general, EDLs will carry the following information about the cardholder: The name, address, gender, date of birth, Canadian citizenship, and a photograph suited to facial recognition software.

Because this is, at root, a drivers licence, it will also contain a drivers licence number, a signature, and some personal details such as height and whether, for instance, the cardholder wears corrective lenses.

The information is collected and stored, and may be cross-referenced to any number of other databases, such as terrorist or other criminal watch lists.

All this information has immense value. And so we need to ensure it is properly protected, so that Canadians are not exposed to unnecessary risks, such as covert monitoring, ID theft or data-matching.

We acknowledge Americas right and responsibility to protect its borders and its population from undesirables. To the extent that Canadian authorities can help, they certainly will.

But it is equally essential that the personal information of Canadians is not abused in the process.

Why Tolerance?

With those reservations in mind, we also recognize that there is a great deal of political pressure to move this project forward.

National security is the new world order, and it is an inescapable reality. In that context, proponents favour EDLs as an effective means to strengthen border security, while at the same time enhancing trade, tourism and business travel between Canada and the United States.

For our part, we take heart in the fact that the programs that are being rolled out or proposed are entirely voluntary, and therefore not coercive.

B.C. is also making sure that potential participants are fully informed with plain-language information products.

EDLs may also be cheaper for the licensee than acquiring a passport  although I say that with some caution too, as no cost-benefit analysis has yet been made public, or even provided to my Office in confidence.

Still, the pursuit of a better way to facilitate trans-border passage between Canada and our friend, neighbour and biggest trading partner is a valid objective.

And so while the Office of the Privacy Commissioner will not stand in the way, we will continue our work on the privacy issues raised by EDLs.

Important Progress

The No. 1 issue raised by federal and provincial privacy commissioners in a joint resolution issued in February 2008 related to the storage of the personal information of Canadians that is collected under EDL programs.

Initially, the data were to be transferred in their entirety to the U.S. on CDs shipped in the mail. The personal information of Canadians was to be housed on U.S. customs databases, and would be available anywhere in the U.S. through the Department of Homeland Security.

Since last May, my Office has been working with the CBSA to address this critically important issue.

As a result of our negotiations, it was agreed that the personal information of Canadians would now be stored on CBSA databases, under federal government control, and would therefore be protected under the Canadian privacy law. 

Moreover, an agreement being developed now between the CBSA and U.S. Customs states that EDL data will only be used for border processing purposes.

In fact, I am happy to report that the CBSA has been very co-operative on the EDL file. It has worked with my Office through the federal Privacy Impact Assessment process to identify, mitigate and otherwise address a host of privacy concerns.

Many jurisdictions have also been working on solutions, and I want to take this opportunity to express my particular appreciation and admiration for David Loukidelis, B.C.s Information and Privacy Commissioner for his tireless efforts in that regard.

There are a couple of promising initiatives now on the horizon to mitigate the risks posed by EDL technology.

One potentially viable solution is a special sleeve that prevents the RFID chip in the cards from emitting radio signals when the card holder is nowhere near a border.

Another idea garnering considerable interest and support, particularly in Ontario, is a special switch technology that would turn the RFID chip on and off. Right now, though, it is not yet clear that the switches will work in EDL cards, or even be allowed under the U.S. specifications.

In short, when we consider where weve come from, it is heartening to see that privacy concerns have grown into top-of-mind issues  on the ground in the B.C. pilot project, within the CBSA, and in other provinces such as Manitoba now as well.

So much so, in fact, that the government of Saskatchewan moved earlier this month to suspend EDL enabling legislation, in response to concerns raised by the provinces Information and Privacy Commissioner, Gary Dickson.

Mr. Dickson pointed out that there had been no meaningful cost-benefit analysis to justify an EDL program in Saskatchewan, and expressed reservations about that the consent provisions and the potential privacy risks  particularly related to the RFID chips and the handling of personal information.

Next Steps

And so, as we at the Office of the Privacy Commissioner of Canada watch the provincial initiatives unfold, we will continue to maintain an active role in the discussions.

My Office will continue to monitor the plans of the CBSA and to talk to U.S. officials.

Earlier this month, for instance, the Commissioner met with U.S. Homeland Security officials to discuss some of the concerns that have arisen as various provinces explore EDL programs.

Like the Privacy Commissioner in Saskatchewan, we too would like to see some sort of analysis that demonstrates that enhanced drivers licences are the right solution to the problem, and that they can meet the requirements in a secure and cost-effective way without compromising the privacy of Canadians.  

My Office will also participate in a new federal-provincial working group, chaired by David Loukidelis from B.C.

While the provinces, of course, remain autonomous, the aim of the group is to ensure that any privacy-enhancing feature or initiative developed in one jurisdiction will be made known and available to every other province considering EDLs. 

Issues Ahead

I want to leave you with one final thought: A more secure society is not necessarily a safer one. 

Consider, for example, the situation that prevails today in the U.K., which may be one of the most secure nations in the Western world.

In the hopes of combating crime and terrorism, the U.K. now boasts more than four million closed-circuit surveillance cameras, many with automatic licence plate recognition software. The cameras, moreover, are starting to be networked together to enable the state to track peoples movements.

National ID cards with biometric features are also starting to be rolled out in stages, with foreign-born residents first to be required to carry them.

The Home Office has plans to expand the powers of police and security officials to monitor any e-mail, telephone call, text message or Internet activity.

And theres a proposal in the works for a national e-borders scheme, in which authorities could collect and share a vast array of data related to an estimated 250 million journeys per year.

Without question, such initiatives make a nation more secure.

But is it safer?

Or do these measures merely constitute a series of incremental steps toward a surveillance society?

Worse, do they divert previous resources that should be going to other measures, such as social development, education, drug and alcohol treatment and poverty reduction?
 
Are we, in short, giving up important freedoms for fear of each other? 

Conclusion

Our challenge is that, if we hold up security in this hand, and privacy in that, we set up an unfair trade-off.

Security is a tangible good. We can count fences and locks and surveillance cameras, and we can increase their number if we feel threatened or exposed.

Privacy, by contrast, cannot be weighed or measured; it can barely be defined, except in other equally ephemeral terms, such as identity, autonomy, liberty and freedom from state control.

And so it is always vulnerable. Like any delicate and precious thing, privacy demands our protection.

We must not only guard it against the big and direct threats, but against the less obvious, more insidious ones as well.

And we must guard against the stealthy developments, the function creep that, for example, can convert a commonplace permit to drive into a very valuable citizenship document, laden with personal information.

If, as predicted, some 2.8 million Canadians will be carrying enhanced drivers licences by 2012, ensuring that meaningful safeguards for their privacy are built into the programs will be our immense and shared challenge.