Airport authority's collection and retention practices questioned

PIPEDA Case Summary #2003-255

[Principles 4.4, 4.5, and section 5(3)]

Complaint

The complainant, an employee of the Canada Customs and Revenue Agency (CCRA) who works at a Canadian airport, complained that the airport authority, which is responsible for operating the airport:

1. collects personal information of airport workers who require a restricted area pass for a security clearance program that duplicates federal government clearances that the workers may already have; and
2. does not have appropriate procedures in place for retaining and destroying the personal information it collects.

Summary of Investigation

The CCRA currently requires various security clearances under the federal Government Security Policy (GSP) for its employees. Some of these employees have Levels II and III security clearances, while others, including the complainant, have undergone enhanced reliability checks. An individual with enhanced reliability status may access, on a need-to-know basis, certain government information and assets. Individuals with Levels II (Secret) and III (Top Secret) security clearances may access, again on a need-to-know basis, more sensitive information and assets. Levels II and III clearances involve a consideration of more factors than the enhanced reliability check.

The airport in question is divided into three zones for the purpose of security: groundside, airside and the sterile area. Any person may access the groundside area. Those without a restricted area pass entering the sterile area (passenger holding and enplaning areas) are subject to physical security screening. To enter airside or the sterile area without screening, an individual must have a valid restricted area pass. As part of their duties, the complainant and his colleagues may be required to enter the restricted area and would therefore have to hold a restricted area pass. In order to obtain this pass, the individual must have an airport security clearance from the federal Minister of Transport.

Transport Canada administers and enforces the Canadian Aviation Regulations that accompany the Aeronautics Act. In the mid-1980s, the Canadian government instituted a security clearance program, called the Airport Restricted Area Access Clearance (ARAAC) program, under which any person working in a restricted area at various Canadian airports is required to have an ARAAC certificate. To receive the certificate, the individual undergoes a background check involving fingerprint verification, a Canadian Security Intelligence Services check, a criminal record check, and since April 1, 2002, a check against the databank of lost or stolen passports, and a confirmation of the applicant's landed immigrant status, if applicable.

The ARAAC program originally waived the requirement for a security check if the restricted area pass applicant held a valid security clearance under the GSP (Level II or higher). However, following the events of September 2001, the section of the ARAAC program standard annotating this right was repealed. As a result, persons having undergone security screening under the GSP are now required to provide duplicate personal information to participate in the ARAAC program. In the case of the complainant, however, even if this section had not been repealed, he would still have had to undergo the ARAAC screening because he did not have the appropriate security clearance. He has since obtained the ARAAC certificate.

In the 1990s, the airport in question was transferred from Transport Canada to the airport authority. The lease agreement between the two parties directed the authority to ensure the security and protection of the property. Part of this protection included adhering to the ARAAC program. The authority is therefore required under both the lease and legislation to collect the personal information of individuals working at the airport who require a restricted area pass and thus need the security clearance.

To obtain the restricted area pass, the applicant is given two application forms: Transport Canada's ARAAC application form and the authority's pass application form. The Transport Canada ARAAC form asks for the following personal information:

• name (including previous names)
• date of birth
• gender
• physical characteristics (height, weight, hair and eye colour, complexion)
• birthplace and citizenship
• passport information
• level of education
• travel (over previous five years)
• residences and activities from previous five years
• criminal offences, if any
• spousal/partner information
• parental information
• spouse/partner's parental information

The applicant submits the Transport Canada form to the pass control office, where it is checked to see that it has been properly filled out. The pass control office personnel fingerprint the individual before sending all completed Transport Canada forms (including the fingerprints) to Transport Canada.

The applicant must also fill out the second form, the authority's restricted area pass form, and submit it to the pass control office. This form asks for the following personal information from the applicant:

• name
• address
• date of birth
• gender
• physical characteristics (height, weight, hair and eye colour, complexion)
• employment information
• type of pass requested

The office uses the completed form to confirm the applicant's identity, employment status, and to determine whether or not he or she will be issued a restricted area pass once the clearance has been received from Transport Canada. Some of the information collected on the form, for example, height and eye colour, as well as a photograph (taken by the pass control office) appear on the pass itself. This is done to assist in prompt and accurate identification of individuals who have access to the restricted area of the airport.

Once Transport Canada receives the individual's ARAAC application form, it sends the information to either the RCMP or CSIS. Once all checks have been completed, these organizations notify Transport Canada of the results, and Transport Canada decides whether to grant a clearance or not. If a clearance is given, Transport Canada notifies the authority, which then issues a restricted area pass.

With respect to the retention of personal information collected by the authority, the investigation established that the authority does not keep the Transport Canada ARAAC form, or any of the information contained therein. The authority does, however, retain personal information that pertains to the pass application and issuance. Specifically, the authority keeps an electronic image of the photograph, along with the information contained on its pass application form. While the authority has policies regarding the destruction of information, there are none dictating the length of time that information can be kept. The authority keeps the information and electronic images in case the individual returns to work at the airport (such as often happens with individuals who have temporary or seasonal employment at the airport). In those cases, the authority updates the image if necessary, and the employee fills out a new pass application, which is added to his or her file. The investigation determined that the authority can have information on file relating to individuals who have not worked at the airport for two to three years.

The authority indicated that it was in the process of developing a policy to address the issue of retention.

Findings

Issued December 24, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Assistant Privacy Commissioner had jurisdiction in this case because an airport authority is a federal work, undertaking or business.

Application: Principle 4.4 states that the collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means. Principle 4.5 states that personal information shall be retained only as long as necessary for the fulfilment of (the purposes for which it was collected). Section 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

With respect to the first complaint, the Assistant Commissioner deliberated as follows:

• The authority collects the personal information of employees who access the airport's restricted area for two reasons: to comply with Transport Canada's security clearance program (instituted under the authority of the Aeronautics Act), which the authority is obliged to adhere to under the lease agreement it entered into with Transport Canada, and to issue the pass once the clearance has been granted. Both of these purposes are entirely legitimate and appropriate.
• She was satisfied that the authority limits the amount of information it collects for the security clearance to these meeting these purposes.
• She therefore found the authority's purposes in keeping with section 5(3) and its collection practices in compliance with Principle 4.4.

She concluded that the first complaint was not well-founded.

Regarding the second complaint, the Assistant Commissioner deliberated as follows:

• She was satisfied that the authority did not retain the information it collects for Transport Canada's ARAAC program.
• However, she noted that the authority does not have any policies or procedures in place dealing with the retention of the information it collects for the restricted area pass.
• While the authority keeps this information for all employees in the event that some who leave may return to the airport to work, the Assistant Commissioner did not think that such a practice fulfilled any purpose.
• Although the authority thought it was saving steps by keeping this information, the authority also acknowledged that a new application form would have to be filled out and a new photograph possibly taken should a former employee return to the airport to work.
• She thus found the authority in contravention of Principle 4.5.

The Assistant Commissioner concluded that the second complaint was well-founded.

Further Considerations

During the course of the investigation, the Office compared security clearance processes for Levels II and III with those of the ARAAC program. Not only did it notice a duplication of the information collected and how it was used, it found that the Level II (or higher) security check exceeds that done under the ARAAC program (save for the examination of fingerprints that is done in some cases). For individuals with Level II or higher, this second screening increases the number of persons with access to their personal information. Such a loss of privacy does not, however, produce a demonstrable increase in security.

While the Assistant Commissioner agreed that individuals who access the restricted area of an airport need appropriate security clearance, she wondered how many clearances are needed to achieve such a purpose.

She noted, however, that the authority is not responsible for addressing this matter. As the complaint was filed against it, she issued findings in relation to the authority's policies and practices as they pertained to the complaint. Nevertheless, the complaint raised important issues, and the Office signalled its concern about the privacy implications of Transport Canada's actions. It therefore intends to address this matter with the parties responsible.