Canadian Press reports today that, “The U.S. will be allowed to share information about Canadians with other countries under a sweeping new border deal,” and that, “The U.S. won’t have to explicitly tell Canada about its plan to pass along the personal details in many cases.”
The article refers to a set of privacy principles released today as part of the Canada-U.S. Beyond the Border Action Plan. There are 12 principles in total, but today’s news focuses on Number 11, “Restrictions on Onward Transfers to Third Countries,” which says that personal information on people in Canada or the U.S. can be provided to a third country (ex. the European Union, or Syria), “only if consistent with the domestic law of the receiving country, and in accordance with existing applicable international agreements and arrangements.”
In the absence of an international agreement or arrangement, says the privacy statement, “the receiving country may transfer the personal information to a third country when consistent with the domestic law of the receiving country, in which case the originating country is to be notified: prior to the transfer; or as soon as reasonably possible after the transfer in the case of exigent circumstances.”
Canadian Press quotes Emily Gilbert, director of the Canadian studies program at the University of Toronto, as asking, “When somebody is a person of interest in the United States, but is a Canadian, what does that mean?… And then what does it mean if that information is then being sent to the European Union or somewhere else?”
Maher Arar, a Canadian citizen, was hastily deported from the United States to Syria, while in transit through a New York airport, based on the sharing of wrong information by Canadian security officials with their U.S. counterparts. That information was then sent to a third country, Syria, where it was used as a basis for torturing Arar, who was later cleared of all suspicion. The subsequent Arar Commission made several recommendations on how and when information should be shared, including that:
Information sharing is vital, but it must take place in a reliable and responsible fashion. The need for information sharing does not mean that information should be shared without controls. Nor does it mean exchanging information without regard to its relevance, reliability or accuracy or without regard to laws protecting personal information or human rights.
The Commission recommended: the centralization of information sharing (not every agency should be allowed to share whatever information to whomever) for oversight and investigative reasons; the use of screening for relevance; attaching caveats to all information with respect to how it should be used; that the RCMP’s information sharing practices should be subject to review by an independent, arms-length body, among other proposals.
The new privacy principles appear to leave room for this kind of oversight, but as the document explains at the end, “Nothing in this Statement… is intended to give rise to rights or obligations under domestic or international law. This Statement of Privacy Principles is not intended to constitute a treaty or other binding agreement under international law.”
In other words, these are promises to be accountable and careful with personal information, announced by two governments with a track record of being neither accountable nor careful. In fact, as a coalition of civil liberties groups declared in a December 2011 Statement of Principles on the Canada-U.S. border deal:
There are currently no oversight and complaint mechanisms with regards to cross-border information sharing between Canadian and U.S. police and intelligence agencies. Building on the Arar Commission recommendations with respect to oversight, before entering into any information sharing arrangement with the U.S., the government of Canada should make a public commitment to create a single authority to oversee all federal police and security organizations involved with the transfer of information between Canada and other countries. This authority should be designated not only to receive, investigate and report publicly on any complaints arising from the provision of information to U.S. authorities, but also to review operations and initiate investigations on its own.
There’s going to be more to say about these privacy principles from people who are following it much more closely. So I’ll leave it for now and come back when there’s more information…