According to a report by Radio-Canada, 13 federal departments and agencies in Ottawa are using spyware typically associated with the intelligence world. The use of this spyware, which can recover and analyze data on electronic devices, including encrypted and password-protected information, has raised concerns about privacy and surveillance. The report reveals that none of these departments conducted the required privacy impact assessments (PIAs) before using the spyware, despite a government directive. The PIAs are meant to identify privacy risks and ways to mitigate or eliminate them.
The use of spyware by federal departments such as the Canadian Radio-television and Telecommunications Commission (CRTC) and the Canada Revenue Agency has been described as "overkill" and "ridiculous" by privacy experts. They argue that such powerful surveillance tools should only be used when necessary and with proper oversight. The report also highlights that even with judicial authorizations, a PIA is still required to assess the impacts on privacy and consider less intrusive alternatives.
The lack of privacy assessments and the widespread use of spyware within the federal government have raised concerns about the normalization of surveillance and the potential infringement of privacy rights. Privacy Commissioner Philippe Dufresne has called for PIAs to be made a binding legal obligation under the Privacy Act.
The federal government has not provided a clear response to the report. Treasury Board President Anita Anand declined an interview request, and her office did not address the issue of accountability for institutions failing to fulfill privacy obligations. The privacy commissioner emphasized the importance of privacy protection and the need for it to be considered before adopting high-risk technological tools.
The use of spyware for internal investigations, such as cases of fraud or workplace harassment, has been defended by some departments. They claim to follow internal protocols to ensure the protection of personal information. However, the Treasury Board Secretariat confirmed that PIAs should also be conducted in these cases.
The report highlights the need for transparency, accountability, and a stronger commitment to privacy rights within the federal government. The lack of privacy assessments and the widespread use of spyware raise important questions about the balance between security and privacy in Canada.