Aviation Security and Privacy

Remarks at the Roundtable Forum on Aviation Security

February 10, 2010
Ottawa, Ontario

Address by Chantal Bernier
Assistant Privacy Commissioner of Canada

(Check against delivery)

---

Overview

I would like to thank you for inviting the Office of the Privacy Commissioner to attend today’s roundtable forum. The right to privacy is the central issue in the debate on aviation security and I am delighted to be able to discuss this with you today.

First, allow me to give you an overview of my presentation:

1. The convergence of security and privacy – how these two issues are related 
2. Balance between security and privacy – how to reconcile security and privacy
   • The position of the Canadian courts
   • The position of the Office of the Privacy Commissioner of Canada
3. Aviation security and privacy
4. Body scanners
5. Questions for the future

1. Convergence of security and privacy 

Out of the four questions put forward today, three are decisive with regard to security and privacy:

1. What is the nature and extent of the threat to aviation security? This question determines the legitimacy of the limitations imposed on privacy.
2. Will the measures adopted be effective? A security measure that limits privacy is legitimate only if its effectiveness can be demonstrated.
3. Are there any alternative measures to those that limit privacy? If so, upholding the right to privacy calls for the use of these alternatives.

• So this is where the questions put to us today on airline security intersect with the protection of privacy. They intersect on:
  • Necessity;
  • Effectiveness; and
  • Existence of alternatives, if any.

2. Canadian law on privacy and security

Canadian law recognizes privacy as a human right in a hierarchy of human rights. Security may trump privacy, but only according to very specific considerations, namely: 

• The nature of the apprehended risk
• The likelihood that it will materialize
• The potential consequences of not taking protective measures
• The availability of alternative measures.

Moreover, the legitimacy of any intrusion upon privacy requires that it be justified according to valid objectives and assessed against reasonable expectations of privacy. The notion of “reasonable expectations of privacy” varies according to context.

The OPC approach

The OPC is responsible for ensuring compliance with the Privacy Act which governs the protection of personal information by 250 federal institutions. We ensure compliance through:

• Investigations of complaints
• Audits – for example, on the Passenger Protect Program
• Privacy Impact Assessment  reviews – for example, on CATSA MMW body scanners 
• Analysis of proposed legislation

The Privacy Act must be interpreted in light of the Canadian Charter of Rights and Freedoms. Consequently, government measures limiting privacy must meet a four-part test of:

• Necessity
• Proportionality
• Effectiveness
• Lack of alternatives.

3. The specific context of aviation security

In the specific context of airline security, we must therefore consider this:

• The apprehended risk is significant;
• The likelihood of occurrence is low, but the potential consequences of not taking protective measures are catastrophic;
• The availability of alternative measures is debatable – hence the importance of this roundtable to examine the wide array of relevant measures;  
• Intrusion of privacy is based on security objectives; and
• The reasonable expectation of privacy is relative.

4. Whole Body Imaging

In reviewing the proposal by the Canadian Air Transport Security Administration of Canada (CATSA) to implement millimeter wave whole body imaging in Canada, the OPC applied the Privacy Act and the four-part test set out in the Charter of Rights and Freedoms.

The OPC first became involved in this issue with the Preliminary Privacy Impact Assessment in 2008 regarding a pilot project in Kelowna.

Two analysts were assigned to the file – a man and a woman – to ensure privacy concerns were addressed from the perspective of both women and men.

The OPC made a series of recommendations at that time, which I will turn to in a moment, as they were implemented in the final proposal for Millimeter Wave Whole Body Imaging in Canada. 

In the summer of 2009, the OPC received a Privacy Impact Assessment for the implementation of millimeter wave body scanners in major airports in Canada.

On the basis of the four-part test and the outcome of the pilot project, the OPC challenged the proposal with respect to:

• The necessity of the measure;
• The safeguards to be applied to ensure the limitation of privacy was proportionate to necessity;
• The effectiveness issues that had been raised in the pilot project;
• The existence of alternate, less invasive measures.

The final discussion with CATSA occurred in October 2009.

On necessity, CATSA demonstrated to base its threat analysis on solid intelligence about the risk for passenger born, non-metallic explosives and weapons.  We did not verify their analysis – that is not within our purview – but  we were satisfied that CATSA had exercised due diligence in that regard.

On proportionality, CATSA agreed to:

• Restrict the body scanners to secondary search
• Ensure anonymity – remote location, no correlation with identity
• Ensure discretion – no phones, no broadcasting devices, alone
• Impede retention – no retention capacity in the equipment.

On effectiveness, CATSA explained how effectiveness issues raised in the pilot project report had been addressed and how the scanners had been tested to detect non-metal explosives and weapons – again, we did not verify the effectiveness of the scanners– this remains to be proven – but we were satisfied that CATSA had exercised due diligence in that regard.

On alternatives, CATSA agreed that the scanners would be optional, leaving the alternative of the pat down.

On October 2009, therefore “not in the heat of anxiety” after December 25  but, rather, on the basis of rigorous analysis of privacy law, applied to objective facts, the OPC wrote to CATSA to express that:

• It would not oppose the implementation of the scanners – we do not approve or disapprove, we merely review PIAs
• Provided that
  • They were strictly for secondary search
  • Optional
  • Anonymous and Discrete
  • With no image retention capacity
• And we reserved the right to review this position if experience shows they are not effective, committing to monitor the issue closely.

5. Privacy Concerns

CATSA and Transport Canada (TC) accepted all of the OPC’s recommendations.

Collaboration with CATSA and TC on the body scanners proved fruitful, because both organizations were committed to the protection privacy, but the future of aviation security raises several privacy concerns that remain to be addressed. I would like to leave you with these thoughts for further reflection.

Privacy issues as we move forward

It must be kept in mind as we move forward in developing aviation security measures that,

• The effectiveness of invasive security measures remains to be proven, and therefore their legitimacy is not a given;
• The potentially catastrophic consequences of a security breach must not blind us to the need to protect privacy;
• Protection of privacy must be integrated with security measures to ensure the fulfilment of both;
• In fact, excessive violation of privacy undermines security – consider this:
  • an excessive amount of personal information becomes unmanageable,
  • routine violation of privacy leads to complacency in security,
  • personal information that is relevant to security drowns in irrelevant information.

Conclusion

In conclusion, as the protection of security and the protection of privacy intersect on necessity, effectiveness and the existence of alternatives if any, success in ensuring both privacy and security means that:

1. The nature and extent of aviation security threat must be defined with much greater clarity to develop security measures that are, at the same time, more tailored to the risk and more proportionate in the invasion of privacy;
2. The effectiveness of aviation security measures must be constantly reassessed to ensure both security and the legitimacy of privacy limitations; and,
3. Less invasive measures must always be sought so that we may protect both our people and our values.    

Thank you.