Federal use of personal data extraction tools raises 'grave concerns' for public servants, experts

Public servants and some cyber security experts say the use of personal data extraction tools by some federal departments is shocking, and they're questioning why any government office would need such access to people's private information.

A Radio-Canada story published Wednesday details how 13 federal departments and agencies use tools capable of recovering and analyzing data found in electronic devices — including text messages, contacts, photos, travel history, a person's internet search history, deleted content and social media activity.

Fisheries and Oceans Canada, Environment Canada, Canada Revenue Agency, Global Affairs Canada, the Canada Border Service Agency, the Department of National Defence, the Royal Canadian Mounted Police and several other institutions are using the technology.

Some departments say they use this technology after obtaining judicial authorization such as a search warrant.

Some departments said they're using the tools to conduct internal investigations — if an employee is suspected of fraud or workplace harassment, for example, in accordance with strict internal protocols regarding collection of personal data.

Other departments say they're using it for security reasons.

Radio-Canada has also learned those departments' use of the tools did not undergo a privacy impact assessment as required by federal government directive.

"We have grave concerns," said Jennifer Carr, president of the Professional Institute of the Public Service of Canada.

"We need to make sure that if our personal information is gathered, that we know about what information is gathered, how it's being used and how it could be affected if there are others who were able to access that."

In a statement to CBC News, Public Service Alliance of Canada national president Chris Aylward called the use of such technology without a privacy assessment "alarming" and "shows a deliberate lack of transparency and accountability by federal departments and agencies."

Government held to a higher standard, says expert

Treasury Board president Anita Anand declined Radio-Canada's request for an interview, but according to her office, each federal institution is responsible for enforcing privacy laws and policies.

But Vancouver-based privacy and data management expert Ale Brown said government agencies need to be held to a higher standard when it comes to protecting people's private information.

While she's not surprised departments and agencies are using this technology, Brown said what is surprising are that all of them forwent the federally mandated privacy impact assessment.

"You need to inform people what you're collecting, for what purpose, how you're going to use it, who you're going to share that information with," Brown said. "It just doesn't seem that this is happening here in a very explicit way."

Without that assessment, it's difficult to trust the government's use of personal data extraction tools at all, she said.