Breakthrough for Privacy Rights
Ottawa, April 9, 2003 - The Privacy Commissioner of Canada, George Radwanski, today issued the following statement, and made public the following letter from the Honourable Elinor Caplan, Minister of National Revenue, regarding changes to what he has previously described as the Canada Customs and Revenue Agency's "Big Brother" database:
Revenue Minister Elinor Caplan's letter to me today announcing major policy changes regarding the Canada Customs and Revenue Agency's new six-year passenger information database is an important moment in the history of privacy protection in Canada.
Since last summer, I have been expressing grave privacy concerns about the creation of this database containing extensive information, obtained from airlines, on the foreign travel activities of all law-abiding Canadians - more than 30 data elements including where and with whom we travel, method of payment for tickets, contact addresses and telephone numbers, even dietary and health-related requirements communicated to the airlines.
I was particularly concerned that, under the information-sharing provisions of the Customs Act, all this information would have been available for a virtually unlimited range of governmental and law enforcement purposes. Such purposes, by the Government's own account, could for instance have included routine income tax investigations and flagging individuals as possible pedophiles on the basis of repeated travel to countries that have a flourishing child sex trade.
Now there will be no such dossiers of personal information obtained from third parties about the lawful activities of all Canadians, for unrestricted potential future use against any individual. A precedent-setting and extraordinarily grave intrusion on privacy rights has been averted.
The changes announced today by Minister Caplan very substantially address the concerns expressed by myself and many others.
They effectively eliminate the use of this information for fishing expeditions such as identifying everyone who has travelled to a particular country a certain number of times, or routinely accessing travel profiles of individuals for tax review purposes. They eliminate meal and health information outright. And they very significantly limit the use and sharing of personal information about travel activities.
This is a great victory for the privacy rights of all Canadians.
It would, of course, be preferable from a privacy perspective not to have this database at all, or to have it absolutely restricted to anti-terrorism purposes. But the changes announced by Minister Caplan strike a fair and reasonable balance between the responsibilities of CCRA, particularly with regard to maintaining border security against terrorism, and the privacy rights of Canadians. The information is now to be kept only for purposes that are consistent with the CCRA's mandate, and it is to be used and shared only subject to appropriate limitations and safeguards.
Minister Caplan has demonstrated that she is sensitive to the importance of privacy rights in Canadian society, and for this I am deeply appreciative.
Today's announcement also demonstrates that the Canadian approach to privacy protection, based on an ombudsman model that combines behind-the-scenes persuasion and dialogue with recourse to public debate and other initiatives when necessary, is a very good and effective one.
In summary, I have been informed by Minister Caplan and the CCRA that the database will henceforth function as follows:
Advance Passenger Information (API) - which consists only of passport information such as name and date of birth and does not include any specific travel information - will continue to be stored for six years and can be widely shared under Section 107 of the Customs Act.
The much more detailed Passenger Name Record (PNR) - which contains all the information held by an airline - will immediately be purged by the CCRA of all meal and health information.
PNR data will still be held for six years, but use and access will vary by length of retention, which is divided into three time periods.
For the first 72 hours, it will be used by customs and immigration officers to assess risk, as at present.
From 72 hours to two years, the information will be depersonalized and used, without names attached, only by intelligence officers and analysts. The information can be re-identified with the traveller's name only when necessary for customs purposes.
During this two-year period, information will only be shared with other agencies or departments for non-customs purposes if a warrant has been obtained. This includes the tax side of the CCRA.
Where the information relates to a customs offence, the CCRA will disclose it to law enforcement authorities on its own initiative. And it will share information with other countries, to assist with a customs investigation, in accordance with written agreements.
From two years to six years, the information can only be used to fulfill the CCRA's mandate regarding the security of Canada, rather than all customs purposes. It will be used on a depersonalized basis unless the Commissioner of the CCRA personally approves re-personalizing it based on reason to suspect that the name or other identifying elements are necessary to deal with a high-risk person.
During this final period, information can only be shared with agencies that have a national security or defence mandate, where there are reasonable grounds to believe that the information relates to a real or apprehended threat.
The combined effect of all these changes is to transform the CCRA database from an open-ended, unrestricted intrusion on privacy into a much more nuanced, restrained and appropriate instrument. I have communicated my appreciation to Minister Caplan, CCRA Commissioner Rob Wright and other senior Government officials for having achieved this favourable outcome that will benefit all Canadians.
Letter from Revenue Minister Elinor Caplan
April 8, 2003
Dear Mr. Radwanski:
I refer to our earlier correspondence of several months back when I informed you we were launching the Advance Passenger Information/Passenger Name Record (API/PNR) program in accordance with our legislative authorities. At that time you expressed concerns that we should be mindful of privacy rights of Canadians. Subsequently, you sent me legal opinions from eminent jurists supporting your arguments that privacy rights have to be respected.
As we have proceeded with our detailed implementation plans for the PNR initiative, we have given due consideration to the privacy rights of individuals and have attempted to interfere to the least extent possible with those rights while at the same time being conscious of our responsibilities for protecting our borders. The Canada Customs and Revenue Agency (CCRA) identified three strategies to address privacy concerns: reducing the number of PNR data elements collected from the carriers; reviewing the use and access to PNR data elements, and reviewing the requirements for sharing PNR data under Section 107 of Customs Act.
The principal features of how we will manage the PNR information will be the following:
We have no choice but to receive all the information from the carriers since they are unable to filter the information. However, we will purge all information that is not required for customs purposes, including meals and health.
PNR information will be retained for six years, however access to identifying data elements, such as the name of the passenger to whom the information relates, will be restricted and will continue to become more restricted throughout the six year period.
Only a limited number of designated targeters and intelligence officers will have access to PNR information for risk assessment purposes and ongoing customs investigations. A limited number of designated analysts will have access to depersonalized information in order to carry out trend and pattern analysis to support identification of future high-risk travellers.
After 72 hours and until the end of the first two years, information will be used for customs purposes on a depersonalized basis and will only be repersonalized if the name is reasonably regarded as necessary for an investigation for customs purposes. During the first two years the information will be shared on the same basis with regulatory agencies for purposes related to the administration by Customs of their acts or regulations at the border. It will also be shared with law enforcement authorities in the pursuit of offences at the border, but otherwise law enforcement authorities and tax administrators will need a warrant to access this information. Another situation when the information will be shared will be when it is necessary to prevent harm to the life, health and safety of an individual or environment of Canada or another country or where the information relates to a real or apprehended threat to the security or defence of Canada. This information can also be shared with representatives of a foreign state in accordance with a written arrangement to assist with a customs investigation.
From three to six years, PNR information will only be kept on a depersonalized basis, and access only provided by authorization of the Commissioner of the CCRA based on evidence that there are reasons to suspect that the name or other identifying data elements are necessary to identify high-risk persons who may import goods which could seriously endanger the security of Canada. As well, during this period information may only be shared with agencies that have a mandate for national security/defence where there are reasonable grounds to believe that the information relates to a real or apprehended threat to the security or defence of Canada. Of course all access to PNR information or disclosure thereof will be subject to audit by you and your office.
I am satisfied that the very controlled access that the CCRA will have over PNR information is sufficient for the agency to discharge its very important responsibilities at the border. I am also satisfied that this program is fully justified and reasonable given the circumstances in which we live.
I understand that you have met Mr. Rob Wright, Commissioner of Canada Customs and Revenue Agency on April 3, 2003, and that he has explained in detail the steps we have taken, and that you are supportive of the approach outlined in this letter.
(Original signed by)
- 30 -
For more information, please contact:
Office of the Privacy Commissioner of Canada
Tel: (613) 995-0103