Wanted by the CBSA Program

In a complaint to our Office, the Canadian Council for Refugees alleged that the personal information of an individual had been improperly disclosed on the Canada Border Service Agency’s (CBSA) website. This disclosure occurred under the “Wanted by the CBSA” program, aimed at enlisting help from the public in finding individuals who were the subjects of active, Canada-wide warrants for removal. The man was one of 30 people described as being “accused of, or complicit in, war crimes or crimes against humanity.”

The program website included names, dates of birth and photographs for all 30 individuals. Despite the personal information involved in the program, the CBSA failed to carry out a Privacy Impact Assessment before its launch. This failure posed serious privacy risks, since the potential consequences for individuals listed could be severe. 

The OPC investigation found that the disclosure of the man’s personal information was permissible under the Privacy Act because the purpose for the disclosure was in line with the administration and enforcement of immigration law and therefore a consistent use under the Act.

The Agency, however, failed to take all reasonable steps to ensure that the personal information was as accurate, up-to-date and complete as possible, as also required by the Privacy Act. For example, in this case, the individual was not convicted of war crimes under criminal law, but rather was determined inadmissible under Canada’s immigration law for being an official in an unidentified government suspected of being engaged in war crimes.

Consequently, this one aspect of the complaint was considered well founded.

  As a result of our investigation the CBSA accepted our five recommendations in full. 

It undertook to:

• revisit the amount of personal information disclosed under the Program, including removing all personal information, except for an individual’s picture, name and status, upon being located or removed from Canada. While our investigation concluded that disclosing personal information was necessary to achieve the program’s objective, we were not satisfied that the CBSA was adequately limiting the amount of such data needed for that purpose. For example, CBSA did not provide justification for conveying an individuals’ full date of birth;
• in future notification letters to our Office under subsection 8(5), demonstrate how the public interest in disclosure clearly outweighs any invasion of privacy that could result from disclosure in a particular case, as well as indicating what information will be disclosed, how it will be disclosed, and for how long it will be publicly available;
• make clear on the website the difference between a conviction under criminal law and a determination under immigration law;
• better enforce its practice of removing profiles from the website within 30 days of an individual’s apprehension or removal from Canada, unlike the individual’s profile in this case which was still posted for at least six months after his apprehension; and
• revise the relevant personal information bank to explicitly account for the Program’s consistent uses of personal information.

The CBSA has since advised our Office that it is in the planning phase and a target PIA-completion date is to be determined in the fall of 2014.