Canada’s electronic spy agency breached privacy rules by sharing certain types of information with its Five Eyes partners, a federal watchdog says.
In his annual report released Thursday, Jean-Pierre Plouffe said the Communications Security Establishment passed on “certain types of metadata containing Canadian identity information” to counterparts in the United States, Britain, Australia and New Zealand, which make up the Five Eyes network.
The report says that information contained in the metadata was “not being minimized properly” before it was shared.
As a result, “CSE proactively suspended the sharing of this metadata with its partners.”
The data sharing practice will remain on hiatus “until systems are in place to properly minimize all Canadian identity information,” the office of the CSE Commissioner said in a news release.
In a statement, Defence Minister Harjit Sajjan said the metadata “did not contain names or enough information on its own to identify individuals.”
“Taken together with CSE’s suite of privacy protection measures, the privacy impact was low,” he said.
Sajjan told reporters in Ottawa that the metadata in question was inadvertently shared due to “software deficiencies,” and CSE is working to correct that. He said data-sharing with the Five Eyes network will not resume until he is “satisfied” that proper safeguards are in place to protect Canadians’ information.
Sajjan said he’s confident that no information was passed on beyond the Five Eyes network, because there is a “solid agreement” among the partner countries to safeguard the shared data.
He couldn’t say how many Canadians were potentially affected. He said he has been advised that if the government starts digging further into the data, it would be in violation of federal privacy laws itself.
Sajjan said the data collection is done in accordance with the National Defence Act, and is an important part of Canada’s counter-terrorism and anti-cybercrime efforts.
Public Safety Minister Ralph Goodale said Thursday that the new government is undertaking a “complete review” of Canada’s security intelligence framework, which will include the creation of a “parliamentary mechanism” to keep spy agencies in check.
He said the objective is to “keep Canadians safe” while protecting their privacy.
OpenMedia, a group that advocates for a “surveillance-free” Internet, said Thursday’s news “clearly underlines” the need for stronger oversight of the CSE.
“The fundamental privacy rights of Canadians must come before the intelligence needs of foreign spy agencies,” Laura Tribe, the group’s digital rights specialist, said in a statement.
“Today’s halt to metadata sharing should not be just a temporary pause, but the first step in a wider review of the needs and priorities of information sharing and collection among Canadian and foreign intelligence. No Canadian should need to fear that their private information is being handed to foreign agencies by their own government.”
