Appearance before the Standing Senate Committee on Transport and Communications on Division 12 of Part 4 of Bill C-45, The Jobs and Growth Act 2012, pertaining to advance passenger information and passenger name records (API/PNR)

November 28, 2012
Ottawa, Ontario

Opening Statement by Chantal Bernier
Assistant Privacy Commissioner of Canada

(Check against delivery)

---

Introduction

Thank you Chair and members of the Committee for the opportunity to address the privacy issues arising from Division 12 of Bill C-45. I am Chantal Bernier, Assistant Privacy Commissioner, and with me is Carman Baggaley, our Senior International Research and Policy Analyst. The Commissioner sends her regrets that she is unable to appear here today.

First I will briefly describe the amendment before us. I will then provide an overview of the program to which it pertains, and then conclude by commenting on the privacy issues it raises.

The amendment in question amends subsection 107.1 (1) of the Customs Act to require carriers to provide passenger information about persons “expected to be on board” a conveyance.  The practical purpose of this amendment is that it will specifically allow CBSA to collect information about air travellers on international flights to Canada prior to the departure of the aircraft. 

While the amendment may be relatively minor in and of itself, it relates to a program that involves the collection, use and disclosure of large amounts of potentially sensitive personal information about airline passengers arriving in Canada.  From that perspective, it merits a broader-based reflection about the transparency of the program and its relation with other travel programs.

The API/PNR Program

The prescribed information consists of two distinct but related types of information.  Advanced Passenger Information (API) consists of the “biographical” information found in a passport or travel document.  Passenger Name Record (PNR) information consists of data typically found in a reservation system; information about the flight or trip in question such as the manner in which the ticket was paid for, the number of bags checked, seat information and various dates such as when the ticket was issued and the date of travel. 

API is essentially static; PNR information changes from trip to trip. PNR information is potentially much more revealing because it provides information about travelling companions, who purchased the ticket and the traveller’s itinerary.  Even a special fare to attend a conference or event can reveal information about the traveller.  PNR is valuable to border officials specifically because it can be used to create profiles and draw inferences. 

Our Office has a long standing interest in the API/PNR program. We had a number of concerns when the API/PNR Program was first announced about a decade ago. The Minister of National Revenue who was in charge of the Program at that time made a number of changes in April 2003 that addressed some of our concerns. 

Further changes to the Program were made following negotiations with the European Union.   As a result of these changes, API/PNR information can only be used for a specific set of purposes, it is depersonalized after 72 hours and access to the information is restricted.  The information is deleted after three and a half years unless it has been used for administrative or enforcement purposes.

I would now like to bring to your attention two key privacy concerns that we have with respect to the proposed amendments. The first relates to what appears to be the collection of personal information beyond the purpose of the program. The second is about the lack of openness and transparency.

Collection Beyond the Purpose of the Program

Through the amendments contained in C-45, we understand that information on travellers will be provided to CBSA in advance of their actual departure.  Practically speaking, this means that CBSA could be collecting API/PNR information on individuals who change their plans and never ultimately come to Canada.  If this is the case, we would be concerned that personal information is being collected without any justification since the person is not traveling to Canada.  If an individual never actually boards a flight to Canada, the purpose for which the Government is collecting and using their information becomes unclear.

We believe that this is an important issue that needs to be addressed by CBSA officials. 

Openness and Transparency

With respect to openness and transparency, the issue arises with respect to the relationship between API/PNR and similar programs, and to Parliamentary oversight.

The API/PNR program should be viewed in relation to other travel programs, specifically the proposed Electronic Travel Authorization (eTA) program and the Passenger Protect Program – the “no-fly program” or PPP. Division 16 of Bill C-45amends the Immigration and Refugee Protection Act to establish the eTA program.  The eTA program will require people from visa-exempt countries, for example, Australians, New Zealanders and most Europeans, to complete an application form and submit it to Citizenship and Immigration Canada (CIC) prior to travelling to Canada.  Our understanding is that CIC will use this information to identify individuals who may be inadmissible to Canada. 

The PPP has been in place since 2007.  This program is intended to identify individuals who may pose a threat to aviation security and prevent them from boarding an aircraft.  The Passenger Protect Program is administered by Public Safety Canada and Transport Canada.

The relationship of the API/PNR program to the proposed eTA program and the PPP is not clear to us, and if it is not clear to us we doubt that most Canadians will understand how they relate to one another. Rather than being examined in isolation, these programs should be studied as a whole to obtain a better sense of how they overlap and interact with one another.  Individuals could be prevented from traveling to Canada under any of these programs and since they will be administered by different departments and agencies, the redress process for each program differs.

With respect to Parliamentary oversight, one of our consistent concerns about the API/PNR program is the lack of transparency and the degree to which the details of the program are contained in regulations and are negotiated secretly with other countries.  While we understand that international negotiations require a degree of secrecy, transparency requires that secrecy be kept to a minimum so that law abiding citizens have a proper understanding of the system put in place and the level of intrusion that is proposed.

Fundamental questions about the API/PNR Program such as the data elements that are provided to CBSA, how this information can be used, with whom it may be shared and how long it is retained cannot be found in the Customs Act.  To a large degree, these matters have been shaped by negotiations with other jurisdictions, most notably with the European Union.

A new PNR Agreement is currently being negotiated with the European Union.  Based on the Agreement between the EU and US that was approved earlier this year, we are concerned that, under a new Canada-EU Agreement, the amount of information collected by CBSA will increase, it will be used for more purposes, and it will be retained longer.

Finally, with respect to Parliamentary oversight, we would emphasize the lack of detail in the amendments before this Committee.  Neither the specific data elements nor how API/PNR information will be used is codified in the legislation.  These substantive matters are instead deferred to either regulation or internal departmental policy, and will not be scrutinized by Parliament. 

Conclusion

The powers and tools entrusted to government officials at our airports and borders are considerable.  As such, it is only reasonable that the level of transparency and scrutiny associated with security programs like API/PNR be commensurate to this significant responsibility.

We believe that the Government should be much more transparent about the justification to collect and use passenger information for this and other related travel programs.

Once again, I would like to thank you for this opportunity to discuss these important issues and I would be happy to take your questions.