Privacy Commissioner Says RCMP Didn’t Inform Him on Use of Spyware

Privacy Commissioner of Canada Philippe Dufresne waits to appear before the House of Commons Standing Committee on Access to Information, Privacy and Ethics, in Ottawa on Aug. 8, 2022. Adrian Wyld/The Canadian Press

Canada’s privacy commissioner said the RCMP did not inform his office of its use of spyware technology that could be remotely installed on devices and used to monitor unsuspecting individuals.

While appearing before the House of Commons Access to Information, Privacy and Ethics Committee on Aug. 8, Philippe Dufresne said he first learned about the RCMP’s use of the software from the media and that his office was not consulted about its potential privacy risks.

“After learning about this through the media in late June, we contacted the RCMP for more information and the RCMP has since scheduled a demonstration for my officials in late August,” Dufresne said.

“In its response to the Question on the Order Paper, the RCMP indicated that it began drafting a [privacy impact assessment] in relation to these tools in 2021, but we have not yet seen it.”

The committee is studying the use of “device investigation tools” by the RCMP to “obtain data covertly and remotely from targeted devices.”

The technology can be remotely installed on devices like cellphones and computers without owners’ knowledge or consent, and can be used to spy on messages, data, and even cameras and microphones.

The committee aims to determine any potential privacy risks that the use of such software poses to Canadians and to seek a list of judicial warrants that the RCMP obtained for using the software.

Dufresne said he expects to see the RCMP’s privacy impact assessment demonstration concerning the software in late August.

“If we find shortcomings in terms of privacy protections, we will provide the RCMP with our recommendations, and we would expect them to make the necessary changes,” he said.

In the meantime, Dufresne called on Parliament to introduce stronger privacy laws surrounding the use of the software and said that Canada’s Privacy Act needs to be brought up to date so that it can address top-of-mind privacy issues concerned with evolving technology.

“I would start by saying that the Privacy Act does not require the RCMP or any government institution to prepare privacy impact assessments (or “PIAs”) for my consideration, but the Treasury Board requires it in its policies. I hope to see this included as a binding legal obligation in a modernized version of the Privacy Act,” he said.

The privacy commissioner said he hopes Parliament’s revisions to the Privacy Act will make privacy impact assessments a legal requirement.

“Doing so would recognize privacy as a fundamental right, it would support the public interest, and it would generate necessary trust in our institutions, such as the RCMP.”

The Canadian Press contributed to this report.