National Security Act, 2017 (S.C. 2019, c. 13)
Full Document:
- HTMLFull Document: National Security Act, 2017 (Accessibility Buttons available) |
- PDFFull Document: National Security Act, 2017 [1419 KB]
Assented to 2019-06-21
PART 3Communications Security Establishment (continued)
Coordinating Amendments (continued)
Marginal note:Bill C-44
91 If Bill C-44, introduced in the 1st session of the 42nd Parliament and entitled the Budget Implementation Act, 2017, No. 1 receives royal assent, then, on the first day on which both section 128 of that Act and section 76 of this Act are in force, paragraph (d) of the definition federal institution in section 2 of the Communications Security Establishment Act is replaced by the following:
(d) the office of the Senate Ethics Officer, the office of the Conflict of Interest and Ethics Commissioner, the Parliamentary Protective Service and the office of the Parliamentary Budget Officer;
PART 4R.S., c. C-23Canadian Security Intelligence Service Act
Amendments to the Act
92 The Canadian Security Intelligence Service Act is amended by adding the following after the long title:
Preamble
Whereas the protection of Canada’s national security and of the security of Canadians is a fundamental responsibility of the Government of Canada;
Whereas it is essential, to discharge that responsibility, for Canada to have a civilian intelligence service;
Whereas it is important that the civilian intelligence service perform its duties and functions in accordance with the rule of law and in a manner that respects the Canadian Charter of Rights and Freedoms;
And whereas the Government of Canada, by carrying out its national security and information activities in a manner that respects rights and freedoms, encourages the international community to do the same;
93 Section 2 of the Act is amended by adding the following in alphabetical order:
- bodily harm
bodily harm has the same meaning as in section 2 of the Criminal Code; (lésions corporelles)
- Convention Against Torture
Convention Against Torture means the Convention Against Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment, signed at New York on December 10, 1984; (Convention contre la torture)
94 Section 2 of the Act is amended by adding the following in alphabetical order:
- Canadian
Canadian in respect of a dataset, means a Canadian citizen, a permanent resident as defined in subsection 2(1) of the Immigration and Refugee Protection Act, or a corporation incorporated or continued under the laws of Canada or a province; (Canadien)
- dataset
dataset means a collection of information stored as an electronic record and characterized by a common subject matter; (ensemble de données)
- exploitation
exploitation means a computational analysis of one or more datasets for the purpose of obtaining intelligence that would not otherwise be apparent; (exploitation)
- query
query means a specific search, with respect to a person or entity, of one or more datasets, for the purpose of obtaining intelligence; (interrogation)
95 Section 6 of the Act is amended by adding the following after subsection (5):
Marginal note:Justification
(6) The reports shall also include
(a) a general description of the information and intelligence collection activities in the context of which employees designated under subsection 20.1(6) or (8) committed acts or omissions that would otherwise constitute offences;
(b) a general description of those acts or omissions;
(c) the information referred to in paragraphs 20.1(24)(a) to (e); and
(d) information on the training received by employees designated under subsection 20.1(6) or (8) and by senior employees designated under subsection 20.1(7).
96 Section 7 of the Act is amended by adding the following after subsection (2):
Marginal note:Consultation with Deputy Minister — authorization
(2.1) The Director or any employee who is designated under subsection 11.04(1) for the purpose of applying for a judicial authorization referred to in section 11.12 shall consult the Deputy Minister before applying for the judicial authorization.
97 The Act is amended by adding the following before section 12:
Marginal note:Definitions
11.01 The following definitions apply in sections 11.01 to 11.25.
- approved class
approved class means a class of Canadian datasets, the collection of which is determined to be authorized by the Minister under section 11.03 and that has been approved by the Commissioner under the Intelligence Commissioner Act. (catégorie approuvée)
- designated employee
designated employee means an employee who is designated under section 11.04 or 11.06. (employé désigné)
- publicly available dataset
publicly available dataset means a dataset referred to in paragraph 11.07(1)(a). (ensemble de données accessible au public)
- Canadian dataset
Canadian dataset means a dataset described in paragraph 11.07(1)(b). (ensemble de données canadien)
- foreign dataset
foreign dataset means a dataset described in paragraph 11.07(1)(c). (ensemble de données étranger)
Marginal note:Application
11.02 Sections 11.01 to 11.25 apply to every dataset that contains personal information, as defined in section 3 of the Privacy Act, that does not directly and immediately relate to activities that represent a threat to the security of Canada.
Marginal note:Classes — Canadian datasets
11.03 (1) At least once every year, the Minister shall, by order, determine classes of Canadian datasets for which collection is authorized.
Marginal note:Criteria
(2) The Minister may determine that a class of Canadian datasets is authorized to be collected if the Minister concludes that the querying or exploitation of any dataset in the class could lead to results that are relevant to the performance of the Service’s duties and functions set out under sections 12, 12.1 and 16.
Marginal note:Notification of Commissioner
(3) The Minister shall notify the Commissioner of the Minister’s determination under subsection (1) for the purposes of the Commissioner’s review and approval under the Intelligence Commissioner Act.
Marginal note:Statutory Instruments Act
(4) An order made under subsection (1) is not a statutory instrument within the meaning of the Statutory Instruments Act.
Marginal note:Designation of employees — Minister
11.04 (1) The Minister may designate employees to carry out the activity referred to in subsection 7(2.1) and section 11.12.
Marginal note:Statutory Instruments Act
(2) For greater certainty, the designation of an employee by the Minister under subsection (1) is not a statutory instrument within the meaning of the Statutory Instruments Act.
Marginal note:Collection of datasets
11.05 (1) Subject to subsection (2), the Service may collect a dataset if it is satisfied that the dataset is relevant to the performance of its duties and functions under sections 12 to 16.
Marginal note:Limit
(2) The Service may collect a dataset only if it reasonably believes that the dataset
Marginal note:Designation of employees — Director
11.06 (1) The Director may designate employees to carry out one or more activities referred to in sections 11.07, 11.2 and 11.22.
Marginal note:Statutory Instruments Act
(2) For greater certainty, the designation of an employee by the Director under subsection (1) is not a statutory instrument within the meaning of the Statutory Instruments Act.
Marginal note:Evaluation period — datasets
11.07 (1) If the Service collects a dataset under subsection 11.05(1), a designated employee shall, as soon as feasible but no later than the 90th day after the day on which the dataset was collected, evaluate the dataset and confirm if it
(a) was publicly available at the time of collection;
(b) predominantly relates to individuals within Canada or Canadians; or
(c) predominantly relates to individuals who are not Canadians and who are outside Canada or corporations that were not incorporated or continued under the laws of Canada and who are outside Canada.
Marginal note:Evaluation — class
(2) In the case of a dataset referred to in paragraph (1)(b), a designated employee shall evaluate the dataset and confirm whether it belongs to an approved class and, if it does not, he or she shall take the measures set out in section 11.08.
Marginal note:Limit
(3) During the evaluation period referred to in subsection (1) and any period of suspension under subsection 11.08(2), a dataset shall not be queried or exploited.
Marginal note:Consultation
(4) A designated employee may consult
Marginal note:Activities of designated employee
(5) A designated employee may, for the purpose of identifying and organizing the dataset, carry out any of the following activities:
Marginal note:Responsibilities of designated employee
(6) A designated employee shall, during the evaluation period,
(a) delete any information that relates to personal information, as defined in section 3 of the Privacy Act, that in the opinion of the Service is not relevant to the performance of its duties and functions and may be deleted without affecting the integrity of the dataset; and
(b) comply with the obligations under section 11.1.
Marginal note:Dataset not within class
11.08 (1) If a designated employee confirms that the dataset does not belong to any approved class, the Service shall, without delay,
Marginal note:Period — suspension
(2) When the Service makes a request to the Minister under paragraph (1)(b), the 90-day period referred to in subsection 11.07(1) is suspended for the period that begins on the day on which a designated employee confirms that the dataset does not belong to any approved class and ends on the day on which the Commissioner approves, under the Intelligence Commissioner Act, the determination of the Minister in respect of a new class to which the dataset belongs.
Marginal note:Limit — activity
(3) A designated employee shall not carry out any activity under subsections 11.07(4) and (5) in respect of the dataset, during the period of suspension described in subsection (2). Subsection 11.07(6) does not apply to the dataset during that period of suspension.
Marginal note:Destruction
(4) If the Minister, on a request made under paragraph (1)(b), does not make a determination to authorize a class that would apply to the dataset or the Commissioner, following a review of the Minister’s determination under the Intelligence Commissioner Act, does not approve the determination of the Minister, the Service shall, without delay, destroy the dataset.
Marginal note:End of evaluation period — Canadian datasets
11.09 (1) If a designated employee confirms that a dataset is a Canadian dataset, the Service shall make an application for judicial authorization under section 11.13, as soon as feasible but no later than the 90th day referred to in subsection 11.07(1).
Marginal note:End of evaluation period — foreign datasets
(2) If the designated employee confirms that the dataset is a foreign dataset, the Service shall ensure that the dataset is brought to the attention of the Minister or the designated person, as soon as feasible but no later than the 90th day referred to in subsection 11.07(1), so as to enable the Minister or designated person to make a determination to authorize its retention under section 11.17.
Marginal note:Destruction
(3) If the Service has not taken steps within the period referred to in subsection (1) or (2), as the case may be, the dataset shall be destroyed by the day on which the period ends.
Marginal note:Continuing obligations of Service
11.1 (1) The Service shall,
(a) in respect of a Canadian dataset or a foreign dataset, delete any information in respect of which there is a reasonable expectation of privacy that relates to the physical or mental health of an individual;
(b) in respect of a Canadian dataset, delete any information that is subject to solicitor-client privilege or the professional secrecy of advocates and notaries; and
(c) in respect of a foreign dataset, remove any information from the dataset that by its nature or attributes relates to a Canadian or a person in Canada.
Marginal note:Removal
(2) If the Service removes the information from the dataset under paragraph (1)(c), the information that was removed shall
Marginal note:Deeming
(3) The dataset collected under paragraph (2)(b) shall be deemed to have been collected on the day on which it was removed and its evaluation period under subsection 11.07(1) begins on the same day on which it was removed.
Marginal note:Dataset publicly available
11.11 (1) For the purposes of sections 12 to 16, the Service may retain, query and exploit a publicly available dataset.
Marginal note:Retention of results of query or exploitation
(2) The Service may retain the results of a query or exploitation of a publicly available dataset in accordance with sections 12 to 16.
Marginal note:Approval by Minister
11.12 (1) Before making an application for a judicial authorization under subsection 11.13(1), the Director or a designated employee shall obtain the Minister’s approval.
Marginal note:Approved classes
(2) When the Director or a designated employee requests the Minister’s approval, the Director or designated employee shall, indicate to the Minister
(a) the approved class to which the Canadian dataset belongs; and
(b) the date on which the Commissioner approved the determination of the Minister authorizing the class under the Intelligence Commissioner Act.
Marginal note:Judicial authorization
11.13 (1) A judge may authorize the retention of a Canadian dataset if he or she is satisfied that
(a) the retention of the dataset that is the subject of the application is likely to assist the Service in the performance of its duties or functions under sections 12, 12.1 and 16; and
(b) the Service has complied with its obligations under section 11.1 with respect to the dataset that is the subject of the application.
Marginal note:Contents of application
(2) An application for a judicial authorization shall be made in writing and shall set out the following:
(a) the grounds on which the requirements referred to in paragraphs (1)(a) and (b) are satisfied;
(b) a description of the information that is contained in the dataset;
(c) if any updates are to be made to the dataset by the Service, the manner in which the Service intends to make those updates;
(d) any privacy concern which, in the opinion of the Director or the designated employee who makes the application, is exceptional or novel;
(e) the details of any previous application made in respect of that dataset, including the date on which it was made, the name of the judge to whom it was made and the judge’s decision;
(f) if the Commissioner has approved, under the Intelligence Commissioner Act, the Director’s authorization on the basis of exigent circumstances under section 11.22, the content of that authorization, the results of the authorized query and any actions taken after obtaining those results.
Marginal note:Contents of judicial authorization
11.14 (1) A judicial authorization issued under section 11.13 shall specify
(a) a description of the dataset;
(b) the manner in which the Service may update the dataset;
(c) the period during which the judicial authorization is valid;
(d) any terms and conditions that the judge considers necessary respecting
(e) any terms and conditions that the judge considers advisable in the public interest.
Marginal note:Maximum period
(2) A judicial authorization shall be valid for a period of not more than two years.
Marginal note:Destruction — no judicial authorization
11.15 (1) Subject to subsection (2), if a judge refuses to issue a judicial authorization for a Canadian dataset, the Service shall, without delay, destroy the dataset.
Marginal note:Taking effect of subsection (1)
(2) The requirement to destroy the dataset under subsection (1) takes effect after the end of the period for making an appeal or in the case of an appeal, after the confirmation of the decision and if all rights of appeal have been exhausted.
Marginal note:Destruction — absence of new application
(3) If the Service has not made a new application for a judicial authorization to retain a Canadian dataset under section 11.12 before the period of the judicial authorization given in respect of that dataset expires, the Service shall destroy the dataset within 30 days after the expiry of that period.
Marginal note:New application
(4) If the Service makes a new application under section 11.12 for a judicial authorization for a Canadian dataset in respect of which the period of the judicial authorization has not expired, the Service may, subject to subsection (5), retain it until a decision is made in respect of the new application.
Marginal note:Limit
(5) If the period of a judicial authorization expires, in the circumstances under subsection (4), the Service shall neither query nor exploit the dataset until and unless a new authorization has been issued for the dataset.
Marginal note:Designation
11.16 (1) The Minister may designate a person, including the Director or an employee, for the purpose of section 11.17.
Marginal note:Limit
(2) At any given time, only one designated person may give an authorization under subsection 11.17(1).
Marginal note:Statutory Instruments Act
(3) For greater certainty, the designation of a person by the Minister under subsection (1) is not a statutory instrument within the meaning of the Statutory Instruments Act.
Marginal note:Authorization
11.17 (1) The Minister or the designated person may, on the request of the Service, authorize the Service to retain a foreign dataset if the Minister or the designated person concludes
Marginal note:Contents of authorization
(2) The authorization given under subsection (1) shall specify
(a) a description of the dataset;
(b) the manner in which the Service may update the dataset;
(c) the period during which the authorization is valid;
(d) any terms and conditions that the Minister or designated person considers necessary respecting
(e) any terms and conditions that the Minister or designated person considers advisable in the public interest.
Marginal note:Maximum period of authorization
(3) An authorization under subsection (1) shall be valid for a period of not more than five years from the date on which the Commissioner approves it under the Intelligence Commissioner Act.
Marginal note:Statutory Instruments Act
(4) For greater certainty, the authorization by the Minister or designated person under subsection (1) is not a statutory instrument within the meaning of the Statutory Instruments Act.
Marginal note:Notification of Commissioner
11.18 The Minister or the designated person shall notify the Commissioner of the Minister’s determination of an authorization under section 11.17 for the purposes of the Commissioner’s review and approval under the Intelligence Commissioner Act.
Marginal note:Destruction — no authorization
11.19 (1) Subject to subsection (2), if the Minister or the designated person under section 11.17, or the Commissioner under the Intelligence Commissioner Act, does not approve an authorization, the Service shall, without delay, destroy the dataset that is the subject of the request.
Marginal note:Taking effect of subsection (1)
(2) The requirement to destroy the dataset under subsection (1) takes effect after the expiry of the period for making an application for judicial review under section 18.1 of the Federal Courts Act or, in the case of such an application, after the confirmation of the decision and if all rights of appeal have been exhausted.
Marginal note:Destruction — absence of new request
(3) If the Service has not made a new request for an authorization to retain a foreign dataset under section 11.17 before the period of the authorization given in respect of that dataset expires, the Service shall destroy the dataset within 30 days after the expiry of that period.
Marginal note:New request
(4) If the Service makes a new request for an authorization under section 11.17 for a foreign dataset in respect of which the period of authorization has not expired, the Service may, subject to subsection (5), retain it until a decision is made in respect of the new request.
Marginal note:Limit
(5) If the period of an authorization expires, in the circumstances set out in subsection (4), the Service shall neither query nor exploit the dataset until and unless a new authorization has been issued for the dataset.
Marginal note:Query or exploitation of datasets
11.2 (1) A designated employee may, in accordance with subsections (2) to (4), query or exploit Canadian datasets and foreign datasets.
Marginal note:Dataset subject to judicial authorization — sections 12 and 12.1
(2) A designated employee may, to the extent that it is strictly necessary, query or exploit a Canadian dataset that is subject to a judicial authorization issued under section 11.13 to assist the Service in the performance of its duties and functions under sections 12 and 12.1.
Marginal note:Dataset subject to approved authorization — sections 12, 12.1 and 15
(3) A designated employee may, to the extent that it is strictly necessary, query or exploit a foreign dataset that is the subject of an authorization under section 11.17 that has been approved by the Commissioner under the Intelligence Commissioner Act, to assist the Service in the performance of its duties and functions under sections 12, 12.1 and 15.
Marginal note:Assistance in accordance with section 16
(4) A designated employee may query or exploit a Canadian dataset that is subject to a judicial authorization issued under section 11.13 or a foreign dataset that is the subject of an authorization under section 11.17 that has been approved by the Commissioner under the Intelligence Commissioner Act, if the query or exploitation is required to assist the Minister of National Defence or the Minister of Foreign Affairs in accordance with section 16.
Marginal note:Retention
11.21 (1) The Service may retain the results of a query or exploitation of a dataset performed under section 11.2 if
(a) the collection, analysis and retention of the results are carried out under section 12;
(b) the retention is strictly necessary to assist the Service in the performance of its duties and functions under sections 12.1 and 15; or
(c) the retention is required to assist the Minister of National Defence or the Minister of Foreign Affairs in accordance with section 16.
Marginal note:Destruction
(2) The Service shall, without delay, destroy the results that it cannot retain under subsection (1).
Marginal note:Query of datasets — exigent circumstances
11.22 (1) The Director may authorize a designated employee to query a Canadian dataset that is not the subject of a valid judicial authorization issued under section 11.13 or a foreign dataset that is not the subject of a valid authorization under section 11.17 that has been approved by the Commissioner under the Intelligence Commissioner Act, if the Director concludes
Marginal note:Contents of authorization
(2) The Director’s authorization shall contain the following:
Marginal note:Retention
(2.1) The Service may retain the results of a query of a dataset performed under subsection (1) if
(a) the collection, analysis and retention of the results are carried out under section 12;
(b) the retention is strictly necessary to assist the Service in the performance of its duties and functions under section 12.1; or
(c) the retention is required to assist the Minister of National Defence or the Minister of Foreign Affairs in accordance with section 16.
Marginal note:Destruction
(2.2) The Service shall, without delay, destroy the results that it cannot retain under subsection (2.1).
Marginal note:Statutory Instruments Act
(3) For greater certainty, an authorization by the Director under subsection (1) is not a statutory instrument within the meaning of the Statutory Instruments Act.
Marginal note:Decision by Commissioner
11.23 An authorization issued under section 11.22 is valid when — if it is approved by the Commissioner under the Intelligence Commissioner Act — the Commissioner provides the Director with the written decision approving the authorization.
Marginal note:Record keeping — publicly available datasets
11.24 (1) The Service shall, with respect to publicly available datasets,
(a) establish record keeping requirements for those datasets with respect to the rationale for their collection, the details of each exploitation, the statutory provision under which the result of a query or exploitation is retained and the results that were retained; and
(b) verify, periodically and on a random basis, if the results obtained from the querying and exploitation of those datasets were retained in accordance with subsection 11.11(2).
Marginal note:Record keeping — approved class
(2) The Service shall establish record keeping requirements in respect of the approved class of a Canadian dataset.
Marginal note:Requirements
(3) The Service shall, with respect to Canadian and foreign datasets,
(a) store and manage those datasets separately from all other information collected and retained by the Service under this Act;
(b) limit access to those datasets to designated employees and take reasonable measures to ensure that any information that they obtained, or to which they had access, is only communicated for the purpose of performing their duties or functions under this Act;
(c) establish record keeping requirements for those datasets with respect to the rationale for their collection and retention, the details of each query and exploitation, the results of those queries and exploitations, and if the results were retained for the purpose of performing their duties or functions under section 12, 12.1, 15 or 16; and
(d) verify, periodically and on a random basis, if
Marginal note:Reports
11.25 The Service shall
(a) give the Review Agency any report prepared following a verification under paragraphs 11.24(1)(b) and (3)(d);
(b) in the case of a foreign dataset that is the subject of an authorization under section 11.17 that has been approved by the Commissioner under the Intelligence Commissioner Act, notify the Review Agency when the Service removes information under paragraph 11.1(1)(c) and of the measures that have been taken in respect of that information; and
(c) in the case of a query of a dataset performed on the basis of exigent circumstances under section 11.22, give the Review Agency a copy of the Director’s authorization under that section and indicate the results of the query and any actions taken after obtaining those results.
- Date modified: