Halt to CSE sharing of metadata is welcome, but comes too late for Canadians whose privacy has already been compromised

Canadian intelligence agency stops sharing metadata with foreign intelligence agencies following revelations that shared information was not being sufficiently protected

January 28, 2016– This morning Canada’s Communications Security Establishment (CSE) announced it has stopped sharing deeply revealing metadata with the U.S. National Security Agency and other foreign intelligence agencies, after the annual report of the Office of the Communications Security Establishment Commissioner revealed that identifying information about Canadians was not being rendered unidentifiable prior to the material being shared.

Privacy experts and advocates, including OpenMedia, have been warning for years that metadata is hugely revealing, and the mass sharing of information about innocent civilians is a gross violation of Canadians’ Charter right to privacy. While today’s announcement of a cessation to information sharing is welcome, it comes too late for those whose privacy has already been compromised. Canadians deserve answers as to exactly what kind of information was inadvertently shared, and how many individuals have been impacted.

“The fundamental privacy rights of Canadians must come before the intelligence needs of foreign spy agencies,” said Laura Tribe, OpenMedia’s Digital Rights Specialist. “Today’s halt to metadata sharing should not be just a temporary pause, but the first step in a wider review of the needs and priorities of information sharing and collection among Canadian and foreign intelligence. No Canadian should need to fear that their private information is being handed to foreign agencies by their own government.”

Today’s news clearly underlines the need for much stronger day-to-day oversight of the CSE, although improved oversight is not in itself enough to safeguard Canadians’ privacy. The bulk collection of deeply revealing metadata by CSE and its partners directly undermines the privacy rights of Canadians, and must be put to an end, without the potential for CSE to resume the sharing of our personal information in future.

As the CSE Commissioner’s report reminds us, “As with any of its activities, CSE is prohibited from directing its metadata activities at a Canadian or at any person in Canada.” Yet the report found that “certain metadata was not being minimized properly. Minimization is the process by which Canadian identity information contained in metadata is rendered unidentifiable prior to being shared.”

As a result, the Commissioner’s report recommended that “CSE seek an updated ministerial directive that provides clear guidance related to the collection, use and disclosure of metadata in a foreign signals intelligence context.” This is an important step to providing clarity around the collection and use of metadata, but any updated ministerial directive must explicitly prioritize the privacy of Canadians above the intelligence needs of foreign agencies, and information sharing agreements.

Last year, OpenMedia crowdsourced detailed recommendations to improve the oversight of Canadian spy agencies. These recommendations include:

• Making CSE subject to judicial control, by empowering the CSE and Privacy Commissioners to issue legally binding orders onto CSE, as well as penalties for when CSE breaks the law.

• Ensuring the CSE oversight commissioner is appointed through a non-partisan process with input from civil society.

• Creating a Parliamentary oversight committee to give MPs much stronger powers of oversight and review over CSE’s activities. Public Safety Minister Goodale has promised to create such a committee, but has yet to provide details.

• Fully implementing the federal Privacy Commissioner’s 2014 Checks and Controlsrecommendations, which were largely ignored by the previous government.

• Going forward, ensuring that oversight mechanisms keep pace with any new spy agency capabilities and powers.

Tens of thousands of Canadians are calling for strong legal measures to safeguard their privacy via the Protect Our Privacy Coalition at OurPrivacy.ca.