A Congressional committee is recommending that the federal government modernize its privacy laws in light of a study into the use by some federal departments of tools that can extract personal data from cell phones, computers, and tablets.
The Access to Information, Privacy and Ethics Commission’s investigation follows a Radio-Canada report last November that revealed personal data extraction tools were being used by at least a dozen federal departments. started.
Most of these institutions did not comply with a federal directive from the Treasury Board of Canada that requires them to conduct a privacy impact assessment before implementing this technology.
The tool in question can unlock your device and restore data located on your phone or computer, including information that is encrypted or password protected. Departments say they use them for internal investigations and law enforcement purposes.
Between February and March, the committee heard from 32 witnesses, including representatives from 12 ministries that use such tools and Finance Committee Chair Anita Anand.
among them, 14 recommendations in report released Thursdaythe commission says the federal government needs to update its directive on privacy impact assessments and change privacy laws that are now outdated.
“I think it’s too early to conduct an overhaul,” said Bloc Quebecois MP René Villemur, who serves as vice-chairman of the committee.
“Most of the legal dispositions were written before social media, before the internet, before artificial intelligence, so I think we need to recognize that these have made a difference.”
Commission says directive needs legal reinforcement
finance committee Directive in force since 2002 Required all federal agencies to conduct privacy impact assessments before new programs or activities that involve the collection or handling of personal information.
However, after hearing from sector representatives that it was unclear whether new technology tools should be evaluated when they are introduced, the Commission found the directive lacked clarity. did.
The committee found that while some federal departments had conducted broader privacy impact assessments, none had conducted an evaluation of the digital forensic tools they had begun using.
“The requirement to submit a privacy impact assessment is useful, and we want to see when there are significant amendments or changes to programs or activities, and by extension, this is partly due to new tools. We think it’s likely caused by the use of the device,” said committee member and Liberal MP Brenda Shanahan.
When Anand appeared before the committee in March, he said a stronger directive to measure the impact of potentially intrusive software would be ready by the summer.
The day before the committee released its report, the Finance Committee released a new report. Privacy Practices Directive. The law requires a privacy impact assessment to be completed for “any program or activity that uses personal information for administrative purposes.”
Villemur said the government should go further by making this requirement legally binding.
“The directive is not an amendment to the law,” he said. “We have to make it into law so we have the proper powers to do things.”
Federal Government Review Report
The report’s recommendation that the federal government amend its privacy laws mirrors recommendations made to the commission by Canada’s Privacy Commissioner Philippe Dufresne.
Dufresne said that while some personal data extraction tools are useful, privacy protection must be a priority.
“We need to design with privacy in mind, reflecting privacy on the front end,” he told the committee in February.
The commission asked the federal government to respond to the report. Under House rules, they have 120 days to do so.
CBC News has reached out to Finance Committee Chairman Anand for comment. Mr. Anand’s job has been given to Law Minister Arif Virani, who is responsible for enacting amendments to the privacy law.
Villani spokeswoman Chantal Aubertin said in a statement that she is considering the committee’s recommendations.
“Our government will respond to the committee’s report in due course,” she added.
