Federal Privacy Commissioner weighs in on draft regulations regarding search of electronic devices by Canadian Border Services Agency

Currently wending its way through Parliament is Bill S-7, which will inter alia amend the Customs Act to deal specifically with the search of electronic devices. The Canadian Border Services Agency (CBSA) in June 2022 proposed a set of regulations that would govern the examination of data stored on electronic devices. In July 2022 the Office of the Privacy Commissioner of Canada (OPC) published its submissions made as part of the public consultation on the draft regulations. It dealt with four topics:

Note-Taking Requirements

The OPC recommended:

  The requirement for noting the basis of the examination to also include noting if the rationale changes as the examination progresses, for instance, if new evidence or facts emerge;

  The proposed requirement for noting the type of document that was examined to also include the reasons why a particular document was examined;

  Adding a requirement to note any communication with the traveller that may be relevant to the circumstances of the examination; and

  Adding a requirement to note whether the search was resultant or not, and the steps taken following that determination.

Disabling Network Connectivity

The OPC reiterated earlier submissions that there be more specific procedures imposed regarding the disabling of network connectivity on devices so as to confine searches to data stored on the device; “we would emphasize that certain technical steps and procedures should be specified by the Regulations as necessary to ensure there is no connection to a network, including, but not necessarily limited to: activating “airplane mode”, deactivating connection to a WiFi network and, ensuring a device is not sharing a connection with another device via Bluetooth or otherwise.”

Password Collection and Retention

The OPC recommended that the Regulations “include specific provisions directing the methods and circumstances for password and passcode collection, including specifying that an officer must not retain a password or passcode in instances where the examination of a digital device is non-resultant.”

Solicitor-Client Privileged Information

In line with an amendment to the Bill that had been made by the Senate, the OPC recommended that CBSA “include its current policy requirements for dealing with solicitor-client privileged information, and other types of sensitive information of this nature, within the proposed Regulations.”