Thursday, February 19, 2009

Privacy Commissioner Quashes B.C.-Washington State Data Sharing

Canada recalls personal database in border project The Canadian government is repatriating a database of personal information about British Columbia citizens after warnings the U.S. government might misuse it.



OTTAWA - The Canadian government is repatriating a database of personal information about British Columbia citizens after warnings the U.S. government might misuse it.

The information on several hundred Canadians was provided to U.S. Customs and Border Protection last year as part of a project to issue "enhanced driver's licenses" instead of passports to streamline land border crossings.

The pilot project is the first step in a Canada-wide program in which personal information on hundreds of thousands of Canadians could have been handed over to the U.S. agency.

Instead, the Canada Border Services Agency has bowed to pressure from privacy advocates and is recalling the database, and Canadian officials say the U.S. border agency has promised to erase its records.

As the project expands, the personal databanks will be kept in Canada, but will be accessible electronically - within strict limits - by U.S. border officials.

"The data will remain in Canada, and it will be accessed remotely," said David Loukidelis, British Columbia's privacy commissioner and a critic of the original plan.

Washington has been toughening rules for people entering the United States from Canada, requiring passports for air passengers in 2007 and for those arriving by land and water since June 1.

U.S. officials also accept so-called "enhanced driver's licenses" at land and marine border points in lieu of a passport, through a joint program developed with Ottawa.

In the British Columbia pilot project, 521 citizens enrolled as volunteers and were each issued a special driver's license with an embedded chip known as a radio-frequency identification device or RFID.

The chip, which can be read by electronic scanners as far as about 15 feet away, contains a unique identifying number for each cardholder.

In the pilot phase, U.S. border officials scanned the RFID and used the unique number to locate the personal information of the bearer in the database supplied by Canada - full name, birth date, gender, citizenship and other information that is ordinarily contained in a passport, as well as a digital image of the bearer.

The Canada agency signed an agreement with its U.S. counterpart that the information would be accessed only by U.S. officers at the time of crossing and for only border purposes, but the USA Patriot Act could trump that clause, forcing the border officers to turn over information to U.S. security agencies.

"It is clear that there is potential for secondary use," says a Canada-British Columbia review of the project dated Aug. 14 and obtained by Canadian Press under the Access to Information Act.

"Further, it is possible that if there was disclosure pursuant to the USA Patriot Act that CBP (U.S. Customs and Border Protection) may not be legally able to advise CBSA."

Joanne Ferreira, a spokeswoman for U.S. Customs and Border Protection in Washington, D.C., confirmed that the agency plans to return the pilot database to Canada.

"Phase 1 data currently resides in a secure CBP database and will be transitioned to a CBSA database," Ferreira said. "CBP will delete Phase 1 records from the CBP database - coordinated with CBSA - so there will be no overlap."

No comments: