Canadians watch for Patriot Act abuse

The controversial Patriot Act in the U.S. continues to loom over its northern neighbour as the potential risks of cross-border data transfer threaten to undermine Canadian privacy.

Enacted shortly after the Sept. 11 terrorist attacks in 2001, the Patriot Act sought to expand the surveillance powers and local and foreign intelligence gathering of U.S. law enforcement agencies, in a bid to step up counter-terrorism initiatives.

Recent news reports from the U.S., however, have revealed incidents of misuse or abuse by the Federal Bureau of Investigation (FBI) in gathering intelligence information under the Patriot Act. Privacy watchdogs south of the border, such as the Electronic Frontier Foundation, have been lobbying for better oversight on the enforcement of the Patriot Act.

While the reported violations seemed to be confined in the U.S. and its residents, Canadian privacy advocates are beginning to raise a red flag on the possible implications of the anti-terrorism legislation to Canadian companies and residents.

Among the many controversial provisions of the Patriot Act, one in particular presents a potential threat to Canadian privacy.

Section 215 of the Patriot Act allows the U.S. FBI to issue national security letters to compel third-party organizations, such as ISPs, financial institutions or telecom firms, to secretly disclose customer information, said Jason Young, an associate at Toronto-based technology law firm Deeth Williams Wall LLP.

“If a Canadian company is a subsidiary of a U.S. parent, there was speculation that the FBI could serve the U.S. parent company with a national security letter that says, ‘Give us records in your custody or your control.’”

The phrase “records in your custody or control” could mean, not only data that the U.S. headquarters directly handles, but also information held at its subsidiary locations in other countries, such as Canada, said Young.

In addition, the same section of the Patriot Act also includes a gag order, prohibiting companies from revealing to any party that they have been served with a national security letter.

“There would be no way for any of the Canadian consumers or even the Canadian subsidiary to know that the reason the parent company was requesting that information was because they have been served with a national security letter from the FBI,” said Young.

Canadian governing bodies have already taken steps to mitigate the risks of cross-border data transfers to the U.S. as a result of the provision.