Opinion by retired Supreme Court Justice Hon. Gérard V. La Forest, C.C., Q.C.

November 19, 2002

George Radwanski
Privacy Commissioner
Office of the Privacy Commissioner of Canada
Place de Ville, 112 Kent Street, Suite 300
Ottawa, Ontario K1A 1H3

Dear Mr. Radwanski:

re: Opinion - CCRA Passenger Name Record

You have asked for my opinion as to whether the plan of the Canada Customs and Revenue Agency (CCRA) to establish a database on the foreign travel activities of Canadians infringes the Canadian Charter of Rights and Freedoms.¹

According to the information you have provided me, the CCRA intends to collect and retain for six years the Advance Passenger Information and Passenger Name Record (API / PNR) data relating to every air traveller entering Canada. Advance Passenger Information consists of an individual's name; date of birth; sex; the type, number, and country of issue of his or her travel document; citizenship and/or nationality; and Passenger Name Record Number. The Passenger Name Record consists of the information contained in airline travel reservation systems. It includes, among other things, the date the booking was made; the name of the travel agent or agency that made the booking; an itinerary listing all destinations to which the traveller flew; the manner of payment for the ticket; seat selection; and the number of pieces of baggage checked. API / PNR information is initially collected and compiled by airlines. Parliament gave CCRA the power to obtain it from airlines by enacting section 107.1 of the Customs Act,² which came into force on November 29, 2001.³

Initially, the CCRA intended to use this information solely to identify incoming passengers whose API / PNR records contained information typical of persons likely to commit customs-related transgressions. Customs officials would conduct automated searches of API / PNR records for suspicious activity patterns, such as booking at the last minute, paying for the ticket in cash, and checking no baggage. Passengers fitting such profiles would then be targeted for secondary screening upon arrival. The API / PNR information for passengers not targeted for secondary screening would neither be viewed by officials nor retained for more than twenty four hours after the passenger's arrival in Canada.

In addition to this original purpose, the CCRA now intends to retain for six years the API / PNR information for all passengers entering Canada, whether or not the information is used for secondary screening or to make some other administrative decision. The CCRA intends to compile this information into a database and use it for a variety of purposes, including the detection of criminals, terrorists, and contraband. It also intends to make information in the database available to other government departments and institutions pursuant to recently amended provisions of the Customs Act. Section 107 of that Act permits customs information to be shared with other government officials for a variety of purposes, including the enforcement and administration of the Canada Pension Plan, Employment Insurance Act, Immigration Act, Income Tax Act, and other specified statutes; a purpose "relating to the life, health or safety of an individual or to the environment in Canada or any other country"; a purpose "relating to the national security or defence of Canada"; and, where the Minister directs, for any unspecified purpose where "in the Minister's opinion, the public interest in providing the information clearly outweighs any invasion of privacy . . .."

The CCRA's plan implicates section 8 of the Charter, which protects the right of every person to be "secure against unreasonable search or seizure." According to the Supreme Court of Canada's decision in R. v. Collins, "a search or seizure will be reasonable only if it is authorized by law, the law itself is reasonable, and the manner in which the search or seizure is carried out is reasonable."⁴

As I have noted, the CCRA's proposal appears to be authorized by law. It could be argued that sections 107 and 107.1 of the Customs Act are unreasonable in allowing the government to use personal travel information in a manner that exceeds its legitimate objectives. But in my view courts would be reluctant to undertake such an analysis. The Customs Act governs a variety of information practices that are not implicated by the current proposal. Section 107, for instance, regulates the sharing of all types of customs information, not only API / PNR data. Some of this information may not be personal in nature and may for this or other reasons not warrant section 8 scrutiny. Similarly, section 107.1 authorizes the collection of passenger information for all customs purposes. Some of these purposes, such as use for secondary screening as outlined above, may well be constitutionally justified. So to avoid either striking down the legislation or imposing some other invasive remedy, courts are likely to invoke the presumption of constitutionality and read the legislation in a manner that avoids any constitutional infirmity.⁵

As a result, the courts are likely to determine the constitutionality of the CCRA's plan by asking whether it entails a search or seizure that would necessarily be carried out in an unreasonable manner.⁶ In the present case a government agency plans to collect and retain for a lengthy period of time detailed information on the travel activities of persons entering Canada by air. To determine whether this violates section 8 we must consider two questions: (1) whether the collection and retention of API / PNR information constitutes a "search or seizure" and (2) whether the search or seizure of the information without prior authorization or probable cause is "reasonable" given the magnitude of the expectation of privacy and the importance of the government's objectives in performing the search or seizure.

While it might in some respects also be considered a "search," there is little question that the CCRA's collection and retention of API / PNR information constitutes a prima facie seizure. In R. v. Dyment, the Supreme Court of Canada defined a seizure as "the taking of a thing from a person by a public authority without that person's consent." ⁷ In the present case the information is initially collected by private entities - travel agencies and airlines - with the apparent consent of travellers. But the Court has on several occasions held that a section 8 seizure may occur when authorities obtain personal information from a third party and use it for reasons, such as criminal investigation, unrelated to the purpose of the initial disclosure.⁸ As I stressed for the Court in R. v. Colarusso, the lawful possession of personal information by a third party "cannot be allowed to detract from the review of the police actions which must remain a primary focus for the Court."⁹

In the present case the Customs Act obliges airlines to turn over to customs officials the API / PNR information of all travellers entering Canada. The involvement of the state in obtaining this information is direct, mandatory, and routine. The fact that the state does not physically "seize" a tangible thing from air travellers is immaterial. As I will discuss in more detail, section 8 guarantees a "broad and general right" to privacy¹⁰ that encompasses the protection of personal information.¹¹ Air travellers do not consent, either explicitly or implicitly, to the long-term retention of this information by the state.¹² As a consequence, this action is a prima facie "seizure" within the meaning of section 8 of the Charter.

Even where government action appears to be a seizure, section 8 of the Charter is not violated unless there is a reasonable expectation of privacy in relation to the information seized.¹³ In Hunter v. Southam, Justice Dickson (as he then was) stated that in each case "an assessment must be made as to whether in a particular situation the public's interest in being left alone by government must give way to the government's interest in intruding on the individual's privacy in order to advance its goals, notably those of law enforcement."¹⁴ This assessment is made in the light of all the circumstances, considering both the strength of an individual's privacy interest and the strength of the state's interest in circumscribing privacy for the sake of collective social goals.¹⁵

Though privacy has myriad dimensions, jurists have found it useful to classify privacy claims into three categories: "those involving territorial or spatial aspects, those related to the person, and those that arise in the information context."¹⁶ It seems to me that at least two of these claims are raised in the present case. The most obvious is the claim of informational privacy. As I put it in Dyment:

In modern society, especially, retention of information about oneself is extremely important. We may, for one reason or another, wish or be compelled to reveal such information, but situations abound where the reasonable expectations of the individual that the information shall remain confidential to the persons to whom, and restricted to the purposes for which it is divulged, must be protected.¹⁷

In Dyment the police took a hospital patient's blood sample from a doctor who had obtained it for emergency medical purposes. In concluding that this implicated a reasonable expectation of privacy, the Court stressed that the doctor was entitled to use the sample "for medical purposes only, subject to a well-founded expectation that it was to be kept private."¹⁸ By taking the sample for a non-medical purpose, the police destroyed the confidentiality that the patient reasonably expected would be maintained with respect to the personal information contained in it.¹⁹ This concern was reiterated in Colarusso, where the Court emphasized that the right to be secure against unreasonable search or seizure incorporates a broad conception of informational privacy that continues long after the initial seizure:

[I]t must be understood that the protection against unreasonable seizure is not addressed to the mere fact of taking. Indeed, in many cases, this is the lesser evil. Protection aimed solely at the physical act of taking would undoubtedly protect things, but would play a limited role in protecting the privacy of the individual which is what s. 8 is aimed at, and that provision, Hunter tells us, must be liberally and purposively interpreted to accomplish that end. The matter seized thus remains under the protective mantle of s. 8 so long as the seizure continues.²⁰

In that case, the Court concluded that a coroner's lawful seizure of the defendant's blood sample did not entitle the police to use information derived from the sample against the defendant.²¹

As in Dyment and Colarusso, in the present case the CCRA plans to appropriate lawfully obtained personal information that may later be used in criminal or quasi-criminal proceedings. Even if it is assumed that information sharing between airlines and customs officials is justified for the purpose of immediate border screening, the CCRA's proposed use of API / PNR data goes far beyond this purpose. Information that was initially collected to facilitate private commercial air travel will be used to compile a searchable, longitudinal database of the travel patterns of every person entering Canada by air.

Of course, blood samples are not directly analogous to API / PNR information. The taking of blood samples implicates concerns for bodily integrity as well as informational privacy. Bodily integrity is not a concern in the present case. Moreover, in both Dyment and Colarusso the Court emphasized the vulnerability of medical patients and the possibility that individuals requiring medical attention might be dissuaded from seeking assistance by the fear that their medical information would be shared with law enforcement officials.²² These particular concerns may not be relevant here, but I note that some travellers may be reluctant to disclose accurate travel information knowing that this information will be compiled in a government database for unspecified future investigative purposes. This may frustrate the capacity of the customs system to perform its traditional functions.

In any case, it would in my opinion be a mistake to view the information contained in API / PNR records as either wholly unlike the blood samples at issue in Dyment and Colarusso or categorically undeserving of privacy protection. To understand how I reach this conclusion, it is necessary to take a closer look at the nature of the privacy interests implicated by the long-term retention of API / PNR data. As discussed, this practice raises general concerns for informational privacy. But it also raises concerns for territorial or spatial privacy. In particular, the creation and maintenance of a six year database of detailed travel information on every person entering Canada enables the government to track the movement of individuals and other travel-related behaviour over a considerable period of time.

The Supreme Court of Canada has recognized in several decisions that individuals have a reasonable expectation that the state will not subject their movements to unjustified surveillance and recording. In R. v. Wong, the Court warned of the threat to privacy and autonomy posed by technologies enabling the recording of citizens' movements and activities.²³ In R. v. Wise, the Court recognized that the installation of an electronic tracking device on a suspect's vehicle invaded a reasonable expectation of privacy and violated section 8 of the Charter.²⁴ In my reasons, in which I dissented on a different issue, I noted that the "ability to move about freely without constant supervision by the government is an important source of individual liberty that must be addressed."²⁵ Similarly, in Dagg v. Canada (Minister of Finance), I concluded that government employees have a reasonable expectation that workplace sign-in logs that reveal information about their movements and location should not generally be made available to the public.²⁶

What these cases teach us is that the information about one's movements and travel activities should not as a general rule be made available to the state without cause. While people may for practical reasons choose or be forced to reveal movement-related information to others, they have a reasonable expectation that the state will not as a matter of course record, compile, or maintain this information for general law enforcement purposes. Of course, the extent of one's expectation of privacy will vary according to the circumstances of each case. In Wise, for example, a majority of the Court determined that the technology employed to track the suspect was only "a very rudimentary extension of physical surveillance" and therefore constituted a "minimal" invasion of privacy.²⁷

In the present case, however, the invasion of privacy is not minimal. The information contained in the proposed API / PNR database will reveal considerable detail about the travel behaviour of an immense number of Canadians. In recent decades the growth of commercial international air travel has been dramatic. Today great numbers of people fly in and out of Canada for a variety of important purposes. In 1999 Canadian airports processed just under 19 million transborder and other international air travellers.²⁸ It is a cliché to say that we live in a globalized and interconnected world. But it is true. Canadians are increasingly dependent on international air transportation to facilitate participation in a wide variety of economic and social endeavours.

As I have indicated, API / PNR data contains detailed information about travel-related activities of passengers, including their citizenship and nationality, the destinations to which they flew, the manner in which they paid for their tickets, and the number of pieces of baggage they checked. Supplying this information for the purposes of any particular entry into Canada may not seem like a great threat to personal privacy. We make much of this information known to others in the course of our daily lives. It is not the sort of deeply personal information that we typically keep hidden from all but our most intimate associates. I suspect, moreover, that most air travellers would not object to the advance sharing of this information with customs officials for the purpose of expediting customs screening and interdicting persons and goods not eligible for entry into Canada.

But that is not the crux of the CCRA's proposal. It plans to establish a database that will be used to facilitate criminal and regulatory investigations long after travellers have entered Canada. While we might reasonably expect information contained in our API / PNR record to be used for short-term travel and border control purposes, we would not reasonably expect the state to systematically compile and maintain it for possible future law enforcement purposes. In R. v. Duarte, the Court noted that there is a constitutionally significant difference between running the risk that a confidante will betray a secret and the "much more insidious danger inherent in allowing the state, in its unfettered discretion, to record and transmit our words."²⁹ Similarly, I stated the following in my reasons in Wise:

. . .[T]here exists a crucial distinction between exposing ourselves to the risk that others will see us or overhear our words, and the much more pernicious risk that they will be electronically monitored at the sole discretion of the state. Transposing to the technology in question here, it must follow that there is an important difference between courting the risk that our activities may be observed by other persons and the risk that agents of the state, in the absence of prior authorization, will track our every move. In both instances, it is constitutionally unacceptable that the state should be allowed to rest a justification for the unauthorized electronic surveillance of a given person on the mere fact that that person had been in a situation where he could be the object of scrutiny on the part of private individuals. To sanction state intrusions on this basis is to blind oneself to the fact that the threat to privacy inherent in courting the ordinary observations of other members of society pales by comparison with the threat to privacy posed by allowing the state to electronically monitor our every movement. Section 8 of the Charter exists to protect privacy and not solitude.³⁰

The CCRA's plan is akin to not only tracking all the vehicular movements of all citizens in a certain geographic space, but also maintaining a searchable database of those movements for a six year period. Such a database would enable the state to learn a great deal about the habits of its citizens. It might also prove to be a great asset to the police in detecting crime. But it would be wholly incompatible with the values of a free society.

The threat to privacy generated by the CCRA's proposed database is exacerbated by its constitution in digital form. Officials may be able to use API / PNR data, on its own or in conjunction with information from other government databanks, to infer the race, ethnicity, religion, or national affiliation of travellers. The ability to conduct automated algorithmic searches may also permit authorities to generate "hits" based on suspicious information profiles. Some of these profiles may by design or effect disproportionately identify individuals with disfavoured racial, ethnic, religious, national, or political affiliations. These people may subsequently be targeted for heightened customs scrutiny or other forms of surveillance. As I noted in R. v. Landry, broad, discretionary search powers are more likely to be used against disadvantaged groups than the "economically favoured or powerful."³¹ And as demonstrated by the recent controversy over the handling of Canadians born in certain Arab or Islamic countries by United States customs officials, profiling based on such criteria and in the absence of individualized suspicion is antithetical to Canadian values of tolerance and non-discrimination. In short, the long-term compilation of API / PNR data has the potential to reveal detailed personal information about Canadians that may be used by authorities for abusive or discriminatory purposes.

In no case has the Supreme Court of Canada held that the long-term retention of personal information for general investigative purposes is compatible with section 8 of the Charter. In this sense at least the CCRA's proposal is even more intrusive than taking bodily samples from suspects or electronically tracking their movements and activities. In those circumstances the government has neither invaded the privacy of everyone engaged in a particular activity nor compiled evidence in a database for future investigative purposes. In situations where the state has established databases of personal information for law enforcement purposes it has recognized a reasonable expectation of privacy and provided protection against unjustified invasions of that privacy. Consider, for example, the scheme for fingerprinting and photographing persons under the Identification of Criminals Act.³² That legislation specifies that only persons charged or convicted with an indictable offence are required to submit to identification procedures. This requires, at a minimum, that the state establish probable cause that the person has committed a serious offence. It was essentially for this reason that the Court found that this procedure complied with the Charter.³³ As I stated for the Court, "a person who is arrested on reasonable and probable grounds that he has committed a serious crime, or a person against whom a case for issuing a summons or warrant, or confirming an appearance notice has been made out, must expect a significant loss of personal privacy."³⁴ The CCRA's proposal, in contrast, would collect and retain the API / PNR information of persons for whom there is absolutely no basis for suspicion. As the Court warned in R. v. Thompson, section 8 analysis must be attentive to a "potentially massive invasion of the privacy" of persons not suspected of criminal activity.³⁵ The CCRA's plan can also be contrasted to the government's recently enacted forensic DNA database regime.³⁶ This scheme permits authorities to retain DNA information only from persons convicted of certain serious offences, and only when authorized to do so by a judge.

The CCRA's proposed database also differs markedly from the database at issue in R. v. Plant.³⁷ There the police obtained a suspect's electrical consumption records from the computerized database of his electrical utility. These records indicated an abnormally high consumption rate that was consistent with a hydroponic marijuana growing operation. The police used this information to obtain a search warrant. The execution of that warrant resulted in the seizure of a number of marijuana plants. The defendant sought to exclude this evidence on the ground that the police violated section 8 of the Charter in obtaining the electrical consumption records without prior authorization or probable cause.

The Supreme Court of Canada found, however, that the defendant did not have a reasonable expectation of privacy in the records. In the Court's view, the records were not the type of "personal and confidential" information that people generally expect to remain private.³⁸ Patterns of electricity consumption reveal "very little about the personal lifestyle or private decisions of the occupant of the residence."³⁹ Moreover, the Court reasoned, the relationship between electrical consumers and utilities "cannot be characterized as a relationship of confidence."⁴⁰ The records were maintained as part of an "ongoing commercial relationship" and were generally available for inspection by any member of the public.⁴¹

As I have discussed, the longitudinal records compiled from API / PNR information are much more personal, revealing, and conducive to abuse than electrical consumption records. Passengers disclose API / PNR information, moreover, for specific, time-limited purposes: to facilitate air travel and immediate customs processing. Apart from limited, voluntary schemes such as frequent flyer programs and the recording of seat selection and dietary preferences, airlines do not typically have comprehensive "ongoing" relationships with their passengers. Each transaction between airline and passenger is discrete. The mandatory, long-term retention of API / PNR information is not necessary to facilitate air travel.⁴² Long-term electrical consumption records, in contrast, are maintained for a variety of legitimate commercial purposes, many of which directly benefit consumers.⁴³ And unlike electrical consumption records, API / PNR information is not made available to the general public.⁴⁴ Individuals may obtain utility information, for example, to estimate future heating costs for a property that they are thinking of purchasing or leasing. Most people would likely recoil, however, at the thought that anyone could be granted access to a long-term record of their international travel activities.

For the forgoing reasons, it is my view that the CCRA's plan to establish a six year database of API / PNR information engages a reasonable expectation of privacy.

Government action that at first sight appears to invade a reasonable expectation of privacy does not always violate section 8 of the Charter. Collective interests such as law enforcement sometimes outweigh individual privacy claims. In Hunter, the Supreme Court of Canada held that in order to prevent unjustified searches or seizures before they occur, prior, independent authorization is required where feasible.⁴⁵ Warrantless searches or seizures are prima facie unreasonable and must be justified by the government.⁴⁶ Hunter also set out the standard for justifying invasions of privacy. As Justice Dickson wrote, the "state's interest in detecting and preventing crime begins to prevail over the individual's interest in being left alone at the point where credibly-based probability replaces suspicion."⁴⁷

It is clear that the CCRA's proposal does not comply with the Hunter standards. API / PNR information is collected from every air traveller entering Canada without prior authorization or grounds for suspicion. The Court has recognized, however, that adherence to these standards will not always be warranted. An individual's expectation of privacy may be diminished by competing social interests. In Wise, for example, the Court concluded that the need for extensive regulation of driving-related activity diminished the level of privacy that individuals could reasonably expect in relation to their vehicular movements.

Particularly relevant to the present case is Supreme Court of Canada's treatment of customs-related searches and seizures. The Court has indicated that the "interests of sovereign states in preventing the entry of undesirable persons and prohibited goods, and in protecting tariff revenue" justify a reduced expectation of privacy at border crossings.⁴⁸ The Court has therefore held that routine questioning, searches of luggage, frisk or pat searches, and the removal of outer clothing to permit investigation of suspicious bodily bulges do not require either prior authorization or particularized suspicion.⁴⁹ More intrusive searches, such as strip searches⁵⁰ or detention at a "drug loo" facility to await the excretion of ingested contraband,⁵¹ require only a reduced standard of justification, such as "reasonable suspicion." The most invasive searches, such as bodily cavity searches, requires a higher standard of justification.⁵²

Superficially it may appear that the seizure of API / PNR information for inclusion in the CCRA's proposed database does not warrant particularized suspicion. But this elides the true nature of the database. Certainly the provision of API / PNR information for advance screening purposes would fall into the category of searches not requiring justification. Much of the information contained in API / PNR records would typically be obtained by customs officials after arrival through customs disclosure forms and "routine questioning." As noted in Simmons, customs officials use this information to prevent the entry of undesirable persons and prohibited goods and protect tariff revenue. But the use of this information to compile a long-term database of the international travel activities of millions of innocent Canadians raises decidedly different issues. As discussed, the CCRA intends to use this database, and make it available for use by other agencies, for a variety of general law enforcement objectives.

The question then becomes whether any of these objectives justifies the privacy invasions created by the API / PNR database. To begin with, it should be noted that a chief justification for the diminished expectation of privacy at border crossings is the need to bar entry to prohibited persons; that is, non-citizens who are for one reason or another not entitled to enter Canada. The CCRA database, however, would contain information on citizens and non-citizens alike.

The CCRA has suggested that the API / PNR database will allow customs officials to analyze travel patterns in a manner that will help them target "people and goods that may be inadmissible or pose a threat to Canadians."⁵³ It is not self-evident, however, that the maintenance of a long-term database will provide significantly greater protection against these threats than alternative investigative techniques, including the disclosure of air travellers' API / PNR information to customs officials for advance screening purposes. As mentioned, the existence of such a database might increase the efficiency and effectiveness of this screening process. But this benefit is speculative, and there has been no demonstration that the proposed database is likely to increase the rate of interdiction to a degree sufficient to warrant such a significant invasion of privacy. It must be remembered that the government bears the onus of proving that warrantless searches are reasonable. In my view the mere possibility that the proposed database might assist customs officials in fulfilling their mandate is not sufficient to discharge this burden.

The CCRA also contends that travel pattern analysis may be used to identify persons involved in conspiracies to import weapons of mass destruction or commit other criminal and terrorist acts.⁵⁴ It would be naïve to think that Canada is immune to the dangers of international terrorism. Customs officials and other authorities have with good reason become more vigilant in maintaining the security of our borders. But the usefulness of the proposed API / PNR database in either preventing terrorists from entering Canada or bringing them to justice after they have committed terrorist acts is questionable. It has not been established that travel pattern analysis is a particularly accurate indicator of criminal or terrorist propensities. At a minimum it seems likely that the potential for "false positives" (i.e. occasions when innocent persons are targeted for scrutiny) is immense.

More important, as you indicate in your letter to the Minister of National Revenue, there are numerous ways in which the state could systematically compile personal information about its citizens that law enforcement officials might find useful in identifying wrongdoers. Yet free and democratic societies do not generally tolerate the creation of databases of personal information on vast numbers of innocent citizens for general law enforcement purposes. The fact that the CCRA's proposed database relates to international air travel does not justify departing from this principle. Despite recent terrorist events, there is little evidence that international air passengers have become such a threat to the nation's security that it is necessary to keep detailed longitudinal records of their movements and other travel-related activities. This conclusion is buttressed by the fact that when the government introduced legislation that would entitle the RCMP and CSIS to obtain API / PNR information, it specified that the information must be destroyed within seven days unless it is "reasonably required for the purposes of transportation security or the investigation of threats to the security of Canada."⁵⁵ Moreover, the proposed legislation requires the RCMP and CSIS to review the information at least once a year and destroy it if there is no justification for its retention. If the agencies charged with primary responsibility for maintaining national security should be subject to such limitations, then a fortiori so should the CCRA, which has a more limited security mandate.

Even if the long-term retention of API / PNR information could be justified on anti-terrorism or public safety grounds, the CCRA's proposal would still be constitutionally suspect. There is nothing in the Customs Act preventing the CCRA or other agencies from using this information for purposes unrelated to national security; section 107 of the Customs Act permits the CCRA to share customs information with other government officials for a wide variety of purposes.

The CCRA argues that this type of information sharing was upheld by the Supreme Court of Canada in Smith v. Canada (Attorney General).⁵⁶ In that case, the Court considered the constitutionality of Customs' practice of sharing information contained in the E-311 Declaration form with the Canada Employment and Immigration Commission ("Commission"). This form must be filled out by all persons entering Canada by air. The information disclosed to the Commission consists of the traveller's name, date of birth, postal code, dates departed from and returned to Canada, and purpose of travel. This information was then matched with Commission records to identify employment insurance (EI) beneficiaries who unlawfully claimed benefits for periods in which they were not present in Canada.

The Court concluded that individuals do not have "a reasonable expectation of privacy in relation to the disclosed portion of the E-311 Customs Information which outweighed the Canada Unemployment Insurance Commission's interest in ensuring compliance with self-reporting obligations of the Unemployment Insurance benefit program."⁵⁷ Unfortunately, the Court did not elaborate on this holding. It was content to declare that the case was analogous to Plant and that it agreed with the conclusions in the judgments below.⁵⁸

It is apparent, however, that CCRA's disclosure of this portion of the E-311 form for the specific purpose of detecting employment insurance fraud is much less invasive of privacy than the generalized sharing of information from the API / PNR database. The latter database contains a far greater quantity of personal information than the information disclosed to the Commission. In addition to the basic information disclosed to the Commission, the API / PNR record lists the date the booking was made, the name of the travel agent or agency that made the booking, an itinerary listing all destinations to which the traveller flew, the form of payment for the ticket, seat selection, and the number of pieces of baggage checked. As I have discussed, when compiled over a six year period, this information has the potential to reveal a great deal of personal information regarding an individual's movements and activities.

The customs information disclosed to the Commission, moreover, is used for a highly specialized, time-limited purpose: determining whether individuals entering Canada have claimed EI benefits for the period in which they were abroad. Unlike the CCRA's database, this information is not used to compile searchable profiles of long-term travel patterns for general law enforcement purposes.⁵⁹ The information sharing scheme reviewed in Smith also affects the privacy interests of far fewer people than the CCRA's database. Though the relevant E-311 information of all entering Canadians is passed on to the Commission, only persons who are receiving EI benefits are subject to any degree of scrutiny. The information of non-recipients is neither viewed by anyone nor used in any way. The more detailed information contained in the API / PNR database, by contrast, remains on file for six years and is available for use by a variety of agencies for any number of purposes.

Lastly, the limited intrusion into the privacy of EI beneficiaries created by the information sharing agreement between the CCRA and the Commission is justified by the nature of the employment insurance scheme. As with any self-reporting regime, the viability of the EI program requires that there be adequate deterrence of fraud and other abuse.⁶⁰ Matching relevant customs information with a listing of EI recipients is a reasonable, narrowly tailored means of ensuring that benefits are limited to those who legitimately qualify for them. The freedom of Canadian citizens to leave and re-enter the country, by contrast, is not a "benefit" conferred by government. Rather, it is a fundamental individual right that is recognized by all free and democratic societies, including Canada where it has been specifically recognized in the Charter.⁶¹ This right does not entitle Canadians to re-enter Canada without scrutiny. But its existence both highlights the importance of international travel to Canadians and implicitly warns against treating it as an inherently suspect activity. Most Canadians view themselves as belonging to an outward looking, globally engaged society. We should not allow our understandable fears of crime and terrorism to turn us into isolationists.

So while individuals may have a diminished expectation of privacy at border crossings, and customs-related searches may not generally require full compliance with the standards required in other circumstances, the seizure and long-term retention of API / PNR information is in my view deserving of some degree of protection for individual privacy. The CCRA's plan makes no provision for such protection. It would trench upon a reasonable expectation of privacy without either prior authorization or any measure of individualized suspicion. Government agencies would have access to detailed, travel-related information of millions of innocent Canadians. In my view this would violate section 8 of the Charter.

There remains two points to which I should briefly advert. The first is that it is not clear whether section 8 violations can be saved by section 1 of the Charter.⁶² However, in the present case it is not necessary to answer this question. Assuming the remote possibility that a court determined that the CCRA's plan violated section 8 and then turned to the issue of whether it should nonetheless be upheld under section 1, any such analysis would inevitably canvass the same arguments and balance the same interests at play in determining reasonableness under section 8. The second point, which involves the application of s. 7 of the Charter, gives rise to similar considerations. It is arguable that the CCRA's plan infringes the right to liberty or the right to security of the person under s. 7 of the Charter, but any s. 7 analysis would involve a balancing under the principles of fundamental justice of the same individual privacy and state security interests relevant to section 8.

I obviously share your concerns regarding the CCRA's plan to collect and retain API / PNR information. It is not possible, of course, to predict with certainty how the courts would deal with this proposal. The Supreme Court of Canada has not yet considered the constitutionality of this particular type of database. But the Court has in recent years been sensitive to privacy concerns associated with both personal information and government surveillance of people's movements and activities. In my opinion, the foregoing legal analysis establishes a strong case that the CCRA's plan violates section 8 of the Charter.

I trust the foregoing will be of assistance to you.

Yours very truly,

(Original signed by)

Gérard V. La Forest

¹ Part I of the Constitution Act, 1982, being Schedule B to the Canada Act 1982 (U.K.), 1982, c. 11 [Charter].

² R.S.C. 1985, c. 1 (2nd Supp.), as am. by S.C. 2001, c. 25, s. 61. See also the Proposed Regulations in Support of the Advance Passenger Information (API)/Passenger Name Record (PNR) Initiative, Customs Notice N-742 <http://www.ccra-adrc.gc.ca/E/pub/cm/cn472/cn472-e.html>.

³ S.I./2001-115.

⁴ [1987] 1 S.C.R. 265 at 278.

⁵ Slaight Communications Inc. v. Davidson, [1989] 1 S.C.R. 1038 at 1078; Eldridge v. British Columbia (Attorney General), [1997] 3 S.C.R. 624 at paras. 22-24.

⁶ Even if I am wrong on this point the result is not likely to be any different. If a court were to find that aspects of the Customs Act violated section 8 of the Charter, then it would likely impose a remedy that would preserve the basic structure of the legislation but prohibit the specific practices that infringe the Charter. See generally Schachter v. Canada, [1992] 2 S.C.R. 679 at 715; R. v. Sharpe, [2001] 1 S.C.R. 45 at paras. 111-127.

⁷ [1988] 2 S.C.R. 417 at 431. See also R. v. Colarusso, [1994] 1 S.C.R. 20 at 58.

⁸ Ibid.

⁹ Colarusso, supra at 55.

¹⁰Hunter v. Southam Inc., [1984] 2 S.C.R. 145 at 158.

¹¹ Dyment, supra at 429-30; Colarusso, supra at 60-61.

¹² Indeed it is doubtful that meaningful, voluntary consent is possible in these circumstances. If boarding were contingent on consenting to the government's retention of travel information, then given the ubiquity and importance of air travel in modern society few would feel free to refuse. But even if travellers were permitted to fly without authorizing the CCRA to retain this information, many would reasonably fear that customs officials would view their refusal as suspicious and target them for heightened surveillance and screening.

¹³ Hunter supra, at 159.

¹⁴ Hunter, supra at 159-60.

¹⁵ See R. v. M.(M.R.), [1998] 3 S.C.R. 393 at para. 31; R. v. Edwards, [1996] 1 S.C.R. 128 at para. 30; R. v. Colarusso, [1994] 1 S.C.R. 20 at 54; R. v. Wong, [1990] 3 S.C.R. 36 at 62.

¹⁶ Dyment, supra at 428.

¹⁷ Ibid. at 429-30.

¹⁸Ibid. at 434.

¹⁹ See also Colarusso, supra.

²⁰ Colarusso, supra at 63.

²¹ Ibid.

²² Dyment, supra at 432-34; Colarusso, supra at 57.

²³ Supra at 47.

²⁴ [1992] 1 S.C.R. 527.

²⁵ Ibid. at 558, quoting Melvin Gutterman, "A Formulation of the Value and Means Models of the Fourth Amendment in the Age of Technologically Enhanced Surveillance" (1988), 39 Syracuse L. Rev. 647 at 706.

²⁶ [1997] 2 S.C.R. 403 at paras. 71-72. Though these were dissenting reasons, the majority did not disagree with this point and explicitly adopted my general approach to the case. Ibid. at para. 1.

²⁷ Wise, supra at 535.

²⁸ Statistics Canada, Canadian Civil Aviation, No. 51-206-XIB (Ottawa: Minister of Industry, 2002) at v.

²⁹ [1990] 1 S.C.R. 30 at 44.

³⁰ Wise, supra at 563-64.

³¹ [1986] 1 S.C.R. 145 at 186. See also my dissenting reasons in R. v. Belnavis, [1997] 3 S.C.R. 341 at para. 116.

³² R.S.C. 1985, c. I-1.

³³ R. v. Beare; R. v. Higgins, [1988] 2 S.C.R. 387 at 408-09. It is also important to note here that the Court specifically chose not to address the constitutionality of retaining identification information of persons who are not later convicted. Ibid. at 413-14.

³⁴ Ibid. at 413.

³⁵ [1990] 2 S.C.R. 1111 at 1143.

³⁶ Criminal Code of Canada, R.S.C. 1985, c. C-46, ss. 487.04-487.092.

³⁷ [1993] 3 S.C.R. 281.

³⁸ Ibid. at 293.

³⁹ Ibid.

⁴⁰ Ibid. at 294.

⁴¹ Ibid.

⁴² It could be argued that the CCRA's proposed long-term database would enable customs officials to identify suspicious passengers with more accuracy, thereby enabling other passengers to pass through customs more readily. But it is not clear whether this would result in a significant enhancement in customs efficiency. Even after the events of September 11, 2001, most air travellers still pass through customs without secondary screening. The increased delays that passengers have experienced over the past year have generally been associated with boarding security procedures, not customs screening.

⁴³ Some utilities, for example, include in their monthly statements graphs and figures comparing present consumption patterns to previous years' patterns. This service helps consumers to track their energy usage over time and take measures to increase energy efficiency.

⁴⁴ Air Canada's privacy policy, for example, specifies that the personal information it collects "is secure and will not be used for purposes other than what is necessary to offer the service our clients deserve." http://www.aircanada.ca/about-us/footer/privacy/policy.html

⁴⁵ Hunter, supra at 160-61.

⁴⁶ Ibid. at 161.

⁴⁷ Ibid. at 167.

⁴⁸ R. v. Simmons, [1988] 2 S.C.R. 495 at 528.

⁴⁹ Ibid. at 529.

⁵⁰ Ibid.

⁵¹ R. v. Monney, [1999] 1 S.C.R. 652.

⁵² Simmons, supra at 517; Monney, supra at para. 46.

⁵³ Letter from the Minister of National Revenue to the Privacy Commissioner of Canada (17 July 2002).

⁵⁴ Ibid.

⁵⁵ Bill C-17, An Act to amend certain acts of Canada, and to enact measures for implementing the Biological and Toxin Weapons Convention, in order to enhance public safety, 2d Sess., 37th Parl., 2002, cl. 4.82(14). I express no view on the constitutionality of these provisions.

⁵⁶ 2001 SCC 88.

⁵⁷ Ibid. at para. 2.

⁵⁸ Ibid. at para. 1 [citations omitted].

⁵⁹ As Rothstein J. noted in his reasons in Smith, the agreement between Customs and the Commission specified that the latter will use customs information "solely for the purposes of the Employment Insurance Act and ... will not ... subsequently disclose the information to any third parties." Smith v. Canada (Attorney General), CUB 44824 (7 October 1997) at para. 57 <http://www.ei-ae.gc.ca/policy/appeals/cubs/40000-50000/44000-44999/44824e.html>

⁶⁰ Ibid. at paras. 97-102. See also R. v. McKinlay Transport Ltd. [1990] 1 S.C.R. 627 at 648.

⁶¹ Section 6(1) of the Charter states that "[e]very citizen of Canada has the right to enter, remain in and leave Canada." I do not in this opinion express any view as to whether the CCRA's plan violates section 6 of the Charter.

⁶² Hunter, supra at 169-70.