Privacy Commissioner says RCMP did not notify him of spyware use

Canada’s Privacy Commissioner The RCMP said it did not notify his office of the use of spyware technology that could be remotely installed on devices and used to monitor unsuspecting individuals.

while appearing in front of it House of Commons At the Access to Information, Privacy and Ethics Committee meeting on August 8, Philippe Dufresne said he first learned from the media that the RCMP was using software, but that his office had been warned about potential privacy risks. He said he had not been consulted.

“After learning about this through the media in late June, we contacted the RCMP for more information.The RCMP has since scheduled a demonstration for my officials in late August.

“In response to questions regarding purchase orders, the RCMP [privacy impact assessment] I have yet to see anything related to these tools in 2021. “

The commission is investigating the RCMP’s use of “device survey tools” to “covertly and remotely obtain data from targeted devices.”

The technology can be installed remotely on devices such as mobile phones and computers without the owner’s knowledge or consent and can be used to spy on messages, data and even cameras and microphones.

The Commission’s purpose is to determine the potential privacy risks that the use of such software poses to Canadians and to request a list of judicial statutes that the RCMP has obtained against the use of the software.

Dufresne said he expects to see a demonstration of the RCMP’s privacy impact assessment for the software in late August.

“If shortcomings are found in terms of privacy protection, we expect the RCMP to provide recommendations and make necessary changes,” he said.

Dufresne, meanwhile, called on Congress to introduce stronger privacy laws surrounding software use, saying Canada’s privacy laws needed to be updated.

“While the Privacy Act does not require the RCMP or government agencies to prepare a Privacy Impact Assessment (or “PIA”) for my consideration, the Finance Commission does require it in its policy. . We expect this to be included as a binding legal obligation in the modernized version of the Privacy Act,” he said.

The Privacy Commissioner said he hopes Congress’ revisions to the Privacy Act will make privacy impact assessments a legal requirement.

“In doing so, privacy can be recognized as a fundamental right, support the public interest, and create the trust needed in institutions such as the RCMP.”

Canadian Press contributed to this report.

peter wilson


Peter Wilson is a reporter based in Ontario, Canada.