As an agency of the Department of Foreign Affairs and International Trade (DFAIT), Passport Canada (PPTC) administers the issuance, refusal of issuance, revocation, withholding, recovery and use of Canadian passports, including the refusal and withholding of passport services. PPTC plays an important role in the safety and security community and in Canada’s national security, through the administration and enforcement of Canadian Passport Order (CPO) which can be found at Canadian Passport Order (SI/81-86). It is PPTC’s mission to issue secure Canadian travel documents through authentication of identity and entitlement, facilitating travel and contributing to international and domestic security.
PPTC’s statutory authority for accessing information from law enforcement sources is the CPO. The Privacy Act grants PPTC’s Security Bureau the status of an investigative body for the purpose of that Act. This legislated designation gives PPTC the authority to collect personal information from most federal and provincial departments and agencies to enforce the CPO.
The CPO provides several grounds related to criminality for refusing, revoking and withholding a passport. These grounds are found in sections 9, 10, 10.2 and 10.3 of the CPO and include:
Additionally, section 10.1 of the CPO provides for ministerial refusal or revocation of a passport on national security grounds, if the minister is of the opinion that such action is necessary for the national security of Canada or another country.
Of note, PPTC plays a key role in supporting the public order by ensuring that individuals under these circumstances are not able to evade the State.
PPTC participates in supporting the public order by acting to ensure that individuals receive and retain passports issued in their genuine identity, and those individuals that are not eligible to hold passports are refused passport issuance, or where the ineligibility occurred after the passport was issued, that the passport is revoked.
In order to support and improve upon PPTC’s ability to administer the provisions of the CPO, PPTC seeks to increase collaboration with partner organizations through which it may obtain key and pertinent information in authenticating identity and entitlement. In terms of the administration of sections 9 through 10.3 of the CPO, the Integrated Query Tool (IQT) initiative fits in with PPTC’s mandate and Business Plan as it enables PPTC’s Security Bureau to obtain information that can be used in assessing whether an individual may be subject to passport refusal, revocation or withheld service. By increasing the capacity for PPTC to evaluate entitlement, particularly in relation to individuals that may be restricted from obtaining or holding a passport by a lawful authority, PPTC is better able to realize its objective of being a key player in document and border security, and of issuing a document whose integrity is recognized by other nations, including those with whom Canada has visa waiver agreements.
In its 2005 audit of passport services, the Office of the Auditor General (OAG) examined four areas of the passport program, one of which was the security and identification verification. The OAG observed that PPTC is challenged in systematically accessing information on persons who stand charged with serious offences; in particular, those subject to Canada–wide arrest warrants. Preventing access to passports for criminal reasons supports government policy and international obligations.
Access to IQT by PPTC will improve on inefficiencies identified in the 2005 audit of passport services by the Office of the Auditor General. IQT will provide PPTC with access to reliable and verifiable information pertaining to individuals that may be restricted by a legal authority from holding or obtaining a passport, including information regarding individuals subject to Canada–wide warrants. Information regarding charges against or warrants to arrest to individuals is public information. The challenge for PPTC is to have reliable, verifiable, efficient, secure access to this information. Likewise, IQT will provide information that may be used in administrative investigations into passport fraud or misuse, thereby supporting a more robust entitlement review process. Preventing access to passports for criminal reasons supports government policy and international obligations. By having access to IQT, Passport will respond positively to the Auditor General’s comments above.
Public Safety Canada has taken the lead in developing an overarching PIA regarding the National Integrated Interagency Information (N-III) – Cross–Jurisdictional Information Sharing. PPTC was only required to provide an addendum to Public Safety’s overarching PIA. The addendum was regarding the use of the N-III Integrated Query Tool (IQT) capability by Passport Canada.
The following risks were identified by PPTC and will be addressed as indicated below.
Meaning of Risk Levels:
Low: There is a possibility that the risk will materialize but there are mitigating factors.
Medium: There is a strong possibility that the risk will materialize if no corrective measures are taken.
High: There is a near certainty that the risk will materialize if no corrective measures are taken.
Risk: This risk is low. Additional information access increases the risk that personal information may be used inappropriately.
Mitigation Measures: The amount of information that can be obtained directly from IQT is purposely limited, reducing the potential for inappropriate use. The IQT is to be used strictly as a pointer directing PPTC to the information originator.
To be noted is that there is no capability in IQT to save or print search results. IQT is a read–only system.
Terms for use are set out in a Memorandum of Understanding (MOU) between the RCMP and PPTC.
Audits will be conducted to ensure that inadvertent or inappropriate use is identified and corrected.
PPTC will report the results of its audit to the RCMP.
Risk: This risk is low. There is a risk that IQT users will access personal information they may not be authorized to access and use.
Mitigation Measures: The addendum developed by PPTC to the Public Safety N-III Overarching Cross–Jurisdictional Information Sharing Privacy Impact Assessment is detailing the lawful mandate of PPTC and the authority to access IQT data.
PPTC will complete an Application for Access that clearly describes the particular data that can be accessed according to its lawful mandate. Once the application for access is signed by the Police Information Portal Governance Committee, it becomes part of the MOU between PPTC and the RCMP setting out the conditions for IQT access
The RCMP and PPTC have established an MOU that clearly describes the particular data that PPTC can access according PPTC’s lawful mandate.
Access will be controlled by Governance Based Access Control, which restricts PPTC to only the information to which it is allowed.
Risk: This risk is low. There is a risk that aged law enforcement information may be used to make decisions about an individual that potentially could deny an individual to a privilege.
Mitigation Measures: PPTC will:
The RCMP will include a notice that will be displayed on the system to request the user to confirm information before using it.
Risk: This risk is low. There is a risk that the information is inadvertently shared by a user about an individual that potentially could deny an individual to a privilege.
Mitigation Measures: PPTC will:
The IQT policy and administration manual developed by the RCMP addresses third party disclosure.
Risk: This risk is low. There is a risk that GBAC does not enforce information–sharing rules and provides access to PPTC users that they are not legally mandated to access.
Mitigation Measures: The RCMP and PPTC will conduct testing to ensure that the GBAC programming complies with PPTC’s lawful mandate to collect information.
Risk: This risk is low. There is no privacy awareness package regarding cross–jurisdictional information sharing.
Mitigation Measures: A TBS approved privacy awareness package will be provided to all Public Safety and Security participants. In addition, the MOU between PPTC and the RCMP specifies that PPTC will train the selected employees prior giving them access to IQT.
Risk: This risk is low. There are various information management policies and legislation amongst jurisdictions.
Mitigation Measures: The validation procedure informs the record holders of PPTC how to use their information and allows them to reset their record retention period at the time of sharing. Also, PPTC will abide by Treasury Board Secretariat policies and Library and Archives Act.