New federal requirements in the works for potentially intrusive software

A more robust federal di‐ rective requiring depart‐ ments to measure the pri‐ vacy impact of new tech‐ nologies will be ready this summer, says Treasury Board President Anita Anand.

However, for now the fed‐ eral government is not com‐ mitting to making it a binding legal obligation, as many are calling for.

Anand was appearing Thursday before a parlia‐ mentary committee looking into the federal government's use of tools capable of ex‐ tracting data from mobile phones and computers.

"Yes, there is a problem," acknowledged Anand before the standing committee on access to information, pri‐ vacy and ethics.

"That is why the directive is being updated."

The directive in question requires all federal institu‐ tions carry out a privacy im‐ pact assessment prior to any new program or activity that involves the collection or handling of personal infor‐ mation.

Anand's testimony comes in the wake of a Radio-Cana‐ da story last November that revealed that several depart‐ ments and agencies had not carried out such assessments before using data extraction tools.

These instruments can unlock mobile phones and computers, even when pro‐ tected by passwords or fin‐ gerprints, and access all data, including information that has been encrypted. This can include emails, texts, contac‐ ts, photos and travel history.

Many departments say they use these tools as part of investigations after obtain‐ ing a warrant. Others also use them without a warrant for internal investigations when employees are sus‐ pected of wrongdoing.

Some departments ex‐ plained earlier before the same parliamentary commit‐ tee that they didn't feel it was necessary to conduct a pri‐ vacy impact assessment on the data extraction tools be‐ cause they had already done such an assessment for their entire investigative program years ago.

Anand said the revised di‐ rective to be rolled out this summer will clearly specify that any new potentially in‐ trusive software will have to undergo that privacy assess‐ ment before a department uses it.

However, for many com‐ mittee members, a directive even reinforced - is not suffi‐ cient.

"Are you going to include the privacy impact assess‐ ments in the law, yes or no?" Bloc Québécois MP René Villemure asked Anand.

He said a binding legal obligation enshrined in the Privacy Act is necessary to guarantee compliance from federal departments.

Villemure is not the only one calling for such a change.

During their testimony be‐ fore the parliamentary com‐ mittee, the privacy commis‐ sioner, union leaders and an expert in communications and privacy also made simi‐ lar comments.

Anand said "discussions are ongoing" on this topic with Justice Minister Arif Vi‐ rani and that it's too early to comment.