Thread by @caparsons

Justice Mosley on a request from CSIS to retain a pair of Canadian datasets decisions.fct-cf.gc.ca/fc-cf/decision…

#cndnatsec #cndpoli

There are many noteworthy details:
* a helpful outlining of how dataset retention processes actually occur
* a warning “it is difficult to see how any collection of personal information [in an approved class of dataset] might be excluded given the breadth of their scope” [11]

* an appreciation the Federal Court will get direct notification of NSIRA’s audits of CSIS dataset activity rather than having to rely on public reports which “are necessarily vague, for national security reasons” [16]

* a question about what parts of the CSIS’ legislation the Court is specifically worried/thinking about when it comes to not knowing how the Service may execute judicial orders in excess of the dataset regime [16]
* a detailed discussion of how CSIS fulfils its duty of candour

* pushback against “the proposals by the Service on how the datasets might be updated and edited by additions, deletions and corrections on an ongoing basis. It appeared that the Service sought carte blanche to revise the database without further authorization from the Court ...”

* also “…information could be queried or exploited” w/o “reference to the particular context in which it had been collected. This could have implications for the privacy interests of the individuals concerned, particularly if” info “was to be shared with foreign agencies.” [40]

* the amici process worked by serving a challenge function + worked to draft conditions attached to how the Service could exploit/communicate about the datasets [39-46]
* NSIRA, not the courts, was found as the better party to review/report on dataset exploitation [43-44]

* 2 conditions added: 1) CSIS must notify the Court of any determination that an update, other than an update pertaining to contact information, is to be made and places a hold on the update should the Court require further information or submissions regarding …”

the proposed change” [45]

2) “a text be applied to any report querying or exploiting the dataset which describes the context in which the dataset was obtained including the circumstances of the individuals to whom the information pertains.” [46]

Takeaways:

1) CSIS is, as expected, acquiring datasets. In this case two Canadian datasets from government institutions.

2) The authorization regime leads to approved classes of datasets being “exceptionally broad in scope” and make it hard to “see how any collection of personal information might be excluded given the breadth of their scope. [11]

3) The Court’s regular, and well publicized, findings of the Service not meetings its duty of candour (and, perhaps, NSIRA’s review into this topic as well) is leading to changes in how the Service appears/works when before the Court

(Also: HT to @tamir_i for letting me know of the Court's decision!)