Language selection

Government of Canada / Gouvernement du Canada

Search


Review of Canadian Security Intelligence Service and the Royal Canadian Mounted Police’s Threat Management of Ideologically Motivated Violent Extremism: Cancellation Letter

Review of Canadian Security Intelligence Service and the Royal Canadian Mounted Police’s Threat Management of Ideologically Motivated Violent Extremism


Cancellation Letter

Date of submission: March 07, 2023

Date of Online Publication: July 22, 2025

Subject: Notification of Cancellation of NSIRA’s Review of CSIS and the RCMP’s Threat Management of Ideologically Motivated Violent Extremism

Dear Commissioner,

I am writing on behalf of the Members of the National Security and Intelligence Review Agency (NSIRA) to inform you of the cancellation of NSIRA’s Review of CSIS and the RCMP’s Threat Management of Ideologically Motivated Violent Extremism (IMVE).

Following the preliminary research phase, NSIRA has decided to close this review. Should NSIRA decide to review this matter in the future, a new process – including formal notification – will be initiated.

Yours sincerely,

John Davies
Executive Director
National Security and Intelligence Review Agency

Share this page
Date Modified:

Review of Select Government of Canada Research Security Measures: Notification Letter

Review of Select Government of Canada Research Security Measures


Notification Letter

July 10, 2025

Subject: Notification of NSIRA’s Review of Select Government of Canada Research Security Measures

Dear Ministers,

I am writing on behalf of the Members of the National Security and Intelligence Review Agency (NSIRA) to inform you that NSIRA has initiated a review of Select Government of Canada Research Security Measures.

This review is being conducted pursuant to paragraph 8(1)(a) and (b) of the National Security and Intelligence Review Agency Act (NSIRA Act). The NSIRA Act grants NSIRA full and timely access to all information held by reviewed departments and agencies, including classified and privileged information, with the exception of Cabinet confidences.  

NSIRA’s review will focus on the National Security Guidelines for Research Partnerships (NSGRP) and the Policy on Sensitive Technology Research and Affiliations of Concern (STRAC). It will examine whether government activities carried out in relation to these measures comply with applicable legal and policy requirements. It will also consider whether associated decisions are reasonable and fair.

NSIRA will engage with your officials regarding this review. As the review progresses, NSIRA’s review team will be in regular contact with them with requests for information. Such requests may involve documents, system access, written explanations, briefings, interviews, surveys, and any other information that NSIRA determines to be of relevance to this review. This review may also include independent inspections of some technical systems. NSIRA’s expectations for responsiveness are available online at https://nsira-ossnr.gc.ca.

I thank you in advance for your cooperation and support to the independent review process, which is key to transparency and democratic accountability.

Sincerely,

The Honourable Marie Deschamps, C.C. 
Chair, National Security and Intelligence Review Agency

Dist.

  • The Honourable Anita Anand, Minister, Foreign Affairs
  • The Honourable Gary Anandasangaree, Minister, Public Safety
  • The Honourable Mélanie Joly, Minister, Industry
  • The Honourable David J. McGuinty, Minister, National Defence
  • The Honourable Marjorie Michel, Minister, Health

cc

  • The Honourable Maninder Sidhu, Minister, International Trade
  • Prof. Alejandro Adem, President, Natural Sciences and Engineering Research Council of Canada
  • Tricia Geddes, Deputy Minister, Public Safety Canada
  • Dr. Paul Hébert, President, Canadian Institutes of Health Research
  • Dr. Ted Hewitt, President, Social Sciences and Humanities Research Council of Canada
  • Philip Jennings, Deputy Minister, Innovation, Science and Economic Development
  • David Morrison, Deputy Minister, Foreign Affairs
  • Daniel Rogers, Director, Canadian Security Intelligence Service
  • Rob Stewart, Deputy Minister, International Trade, Global Affairs Canada
  • Caroline Xavier, Chief, Communications Security Establishment

Share this page
Date Modified:

Review of the Communications Security Establishment’s Disclosures of Canadian Identifying Information: Report

Review of the Communications Security Establishment’s Disclosures of Canadian Identifying Information


Report

Table of Contents

Date of Publishing:

HTML Version Coming Soon

Our team is working on an HTML version of this content to enhance usability and compatibility across devices. We aim to make it available in the near future. Thank you for your patience!

Share this page
Date Modified:

Review of the Communications Security Establishment’s Disclosures of Canadian Identifying Information: Backgrounder

Review of the Communications Security Establishment’s Disclosures of Canadian Identifying Information


Backgrounder

Backgrounder

Early after its inception, the National Security and Intelligence Review Agency (NSIRA) conducted a review of how the Communications Security Establishment (CSE) shares Canadian Identifying Information (CII), such as names, email addresses, and IP addresses. This review focused on disclosures made to other Government of Canada departments. After many efforts to produce a declassified version of the report, NSIRA is now able to publish this review’s final report in redacted form.

When CSE gathers foreign signals intelligence, it removes any identifying information about Canadians and persons in Canada from its reports to protect privacy. However, government departments or foreign partners can request this information if they have legal authority and a valid operational reason.

NSIRA examined a sample of these disclosures made between July 1, 2015, and July 31, 2019. This included cases where CSE was assisting the Canadian Security Intelligence Service’s (CSIS) foreign intelligence collection under section 16 of the CSIS Act.

NSIRA found, based on the sample of disclosures it examined, that while CSE approved 99% of requests for CII disclosure from its domestic partners, 28% of all requests were not sufficiently justified to warrant the release of CII. NSIRA concluded that CSE’s implementation of the CII disclosure regime lacked rigour, and may not have complied with its responsibilities under the Privacy Act. As a result, NSIRA issued a compliance report under section 35 of the NSIRA Act.

NSIRA also found that CSE’s releases of CII collected under section 16 of the CSIS Act were conducted in a manner that was unlikely to have been communicated to the Federal Court by CSIS. CSIS had provided the Federal Court with testimony about its treatment of information about Canadians collected through section 16 of the CSIS Act. Yet, when NSIRA compared this testimony with how CSE handled information about Canadians collected when assisting CSIS in relation to section 16, NSIRA found notable discrepancies in the standards communicated to the Federal Court. CSIS was not involved in assessing or releasing the disclosures about which NSIRA had concerns; these disclosures were handled solely by CSE.

The report contains 11 recommendations, primarily focused on enhancing the rigour of CSE’s CII disclosure regime, including with respect to CII collected under section 16 of the CSIS Act.

Share this page
Date Modified:

Sources of Federal Government and Employee Information

Sources of Federal Government and Employee Information

General information

Background

The National Security and Intelligence Review Agency Secretariat (Secretariat), established in 2019, supports the National Security and Intelligence Review Agency (NSIRA), an independent agency responsible for reviewing and investigating national security and intelligence activities in Canada. NSIRA ensures that operations by agencies like the Canadian Security Intelligence Service (CSIS) and the Communications Security Establishment (CSE) are lawful, reasonable, and necessary, issuing non-binding recommendations and investigating national security-related complaints. The Secretariat plays a vital role in facilitating NSIRA’s operations by providing administrative and logistical support, ensuring the efficiency and effectiveness of the review and investigation processes.

The Secretariat’s responsibilities and powers are outlined in the National Security and Intelligence Review Agency Act (NSIRA Act), as are NSIRA’s mandate and authorities.

The NSIRA Secretariat is the “government institution” for the purposes of the Access to Information and Privacy Acts.

Responsibilities

The NSIRA Secretariat is led by an Executive Director, appointed by the Governor in Council, and plays a vital role in supporting NSIRA in its mandate to review and investigate the Government of Canada’s national security and intelligence activities. The Secretariat facilitates independent reviews to ensure these activities are lawful, reasonable, and necessary, while also supporting NSIRA in investigating national security-related complaints with consistency, fairness, and timeliness. This includes addressing complaints concerning CSIS, CSE, denial or revocation of security clearances, and referrals from the Civilian Review and Complaints Commission, the Canadian Human Rights Commission, or under the Citizenship Act.

The NSIRA Secretariat is a separate agency listed in Schedule V to the Financial Administration Act, and its Executive Director is the employer for Secretariat personnel.

Institutional Functions, Programs and Activities

The Secretariat is organized into five operational and administrative divisions: Review, Investigations, Technology, Central Administration and Access to Information and Privacy (ATIP), and Corporate Services. The Review Division supports NSIRA in conducting independent reviews of national security activities, assessing compliance, reasonableness, necessity, and efficacy, and issuing non-binding recommendations. The Investigations Division ensures complaints related to national security are investigated in a fair and timely manner. The Technology Division leads the review of information technology systems, thereby assisting NSIRA in ensuring compliance with applicable laws and policies, and recommending safeguards to minimize risks of legal non-compliance. The Central Administration and ATIP Division provides strategic communication and administrative support to NSIRA and the Secretariat, and ensures the Secretariat’s compliance with the Access to Information Act and the Privacy Act. Lastly, Corporate Services provides leadership in a broad range of internal services such as human resources, finance, procurement, security, information management and information technology, ensuring the Secretariat operates smoothly and effectively.

Reviews

Class of Record

Description: Includes records related to reviews performed by NSIRA on activities carried out by the Canadian Security Intelligence Service (CSIS), Communications Security Establishment (CSE), and any activities carried out by a federal institution related to national security or intelligence activities. These records may include information about the involvement of individuals in the national security and/or intelligence activities of the federal institutions under review, as well as employees and contractors of the federal institutions. 

Document Types: Correspondence, memoranda, notes, transcripts, exhibits, submissions, reports, briefing notes, legal opinions, security clearance records, intelligence analysis and threat assessments and recommendations, intelligence reports, security threats, Threats and Risk Assessments, security incidents and investigation reports.

Record Number: NSIR RVW 001

Personal Information Bank

Description: This bank contains personal information on individuals who come to the attention of the national security or intelligence program of a federal institution and that program (or institution) is being reviewed by NSIRA. The personal information collected may include: 

  • Biographical Information
  • Contact Information
  • Citizenship Status
  • Credit History
  • Criminal Checks/History
  • Date of Birth
  • Employee Identification Number
  • Employee Equity Information
  • Employee Personnel Information
  • Financial Information
  • Gender/Sex
  • Language
  • Medical Information
  • Name
  • Opinion or views of, or about, individuals
  • Photos
  • Signature

Class of Individuals: Current and former employees of government institutions and the general public whose information was collected by a national security or intelligence program/activity of the Government of Canada.

Purpose: Personal information is collected to support NSIRA’s mandate to review any activity carried out by the Canadian Security Intelligence Service or the Communications Security Establishment, or any federal institution that relates to national security or intelligence. Personal information is collected under the authority of section 8 of the National Security Intelligence Review Agency Act.

Consistent Uses: Personal information may be disclosed to the National Security and Intelligence Committee on Parliamentarians and to the Civilian Review and Complaints Commission with whom NSIRA cooperates in performing its review activities. Personal information may be disclosed to the Office of the Privacy Commissioner with whom NSIRA may coordinate its activities.

Retention and Disposal Standards: Records will be retained in an electronic format for 50 years after the closure of the file, at which time the electronic records will be transferred to Library and Archives Canada.

RDA Number: 94/016 (assigned to SIRC; RDA is under review by LAC)

Related Record Number: NSIR RVW 001

TBS Registration: 20240115

Bank Number: NSIR PPU 010

Investigations

Class of Record

Description: Includes records related to complaints submitted to NSIRA by individuals or reports/referrals submitted to NSIRA by other federal institutions for investigation. The complaint and investigation records are related to the activities of the Canadian Security Intelligence Service, Communications Security Establishment (CSE), and any federal institution who denied or revoked an individual’s security clearance which resulted in the denial of employment (or dismissal, demotion or transfer of an individual, or denial of a promotion or transfer to an individual) or the denial of a contract. The records also are related to referrals for investigation from the Civilian Review and Complaints Commission and the Canadian Human Rights Commission, as well as reports made to NSIRA from the Minister of Immigration, Refugees, and Citizenship. 

Document Types: Correspondence, memoranda, notes, audio/video recordings, transcripts, exhibits, submissions, reports, briefing notes, legal opinions, security clearance records, intelligence analysis and threat assessments and recommendations, intelligence reports, security threats, Threats and Risk Assessments, security incidents and investigation reports, final reports, and records of decision.

Record Number: NSIR INV 001

Note: This Class of Record (COR), which was formerly identified as SIR COM 001(Complaints), is pending transfer approval from Treasury Board Secretariat officials. The COR was formerly under the Security Intelligence Review Committee, which was succeeded by NSIRA in 2019.

Personal Information Bank

Description: This bank contains information related to individuals who have filed a complaint with NSIRA, as well as individuals whose information is reported or referred to NSIRA by other federal institutions for investigation.  The personal information collected varies on the investigation type and information submitted to NSIRA by individuals or referring federal institutions, as well as the records submitted by the federal institution whose activities are the focus of the investigation and who are required by the National Security and Intelligence Review Agency Act to provide NSIRA with access to all information related to the complaint with few exceptions. The personal information collected may include: 

  • Biographical Information
  • Biometric Information
  • Contact Information
  • Citizenship Status
  • Credit History
  • Criminal Checks/History
  • Date of Birth
  • Employee Identification Number
  • Employee Equity Information
  • Employee Personnel Information
  • Financial Information
  • Gender/Sex
  • Language
  • Medical Information
  • Name
  • Opinion or views of, or about, individuals
  • Other identification numbers
  • Photos
  • Physical attributes
  • Signature
  • NSIRA’s own investigative interviews, hearings, and other proceedings, including audio recordings
  • Security interviews
  • Surveillance information
  • Security Screening Records, including but not limited to criminal records (domestic and foreign), open-source checks, internal checks by a federal institution, credit report, CSIS security assessment, security interviews, and polygraph examination Information (including audio/video recording)

Note: This Personal Information Bank (PIB), which was formerly identified as SIR PPU 005 (Complaints). The PIB was formerly under the Security Intelligence Review Committee, which was succeeded by NSIRA in 2019.

Class of Individuals: Members of the general public or federal employees who submit a complaint to NSIRA for investigation of the activities carried out by the Canadian Security Intelligence Service (CSIS) or the Communications Security Establishment (CSE) or a decision by a federal institution to deny or revoke an individual’s security clearance.  Also, members of the general public or federal employees whose complaint related to the Royal Canadian Mounted Police (RCMP) is referred to NSIRA by the Civilian Review and Complaints Commission, as well as matters referred to NSIRA for investigations from the Canadian Human Rights Commission and reports made to NSIRA from the Minister of Immigration, Refugees, and Citizenship.  Furthermore, from the records of the federal institution under investigation, NSIRA may collect the personal information of federal employees or members of the general public.  Information is also collected through investigative interviews, case conferences, and hearings before NSIRA member(s) which may include counsel for the complainant, counsel for the Government of Canada, and witnesses.

Purpose: Personal information is collected under the authority of ss. 8(d) of the National Security and Intelligence Review Agency Act, which mandates NSIRA to investigate complaints under ss. 16(1) (related to CSIS), ss. 17(1) (related to CSE), or ss. 18(3) (related to denial/revocation of a security clearance), as well as complaints referred to NSIRA under subsection 45.53(4.1) or 45.67(2.1) of the Royal Canadian Mounted Police Act, reports made to the Agency under section 19 of the Citizenship Act, and matters referred to the Agency under section 45 of the Canadian Human Rights Act.  The purpose of all NSIRA investigations is to produce a report of findings and recommendations to the appropriate federal institution for consideration, as well as the individual in question (complainant, focus of referred matter or report).

Consistent Uses: Information submitted by complainants is disclosed to the federal institution under investigation.  Furthermore, additional information is gathered from the federal institution under investigation to come to an opinion on findings and recommendations.  To resolve a matter, NSIRA may conduct investigative interviews, case management conferences, hearings, and other proceedings.  NSIRA proceedings may be held with both parties or ex parte and include witnesses who are not considered a party to the investigation. 

The NSIRA final report is disclosed to the federal institution(s) that is the focus of the investigation. A declassified version of the final report is disclosed to the complainant or person who is the topic of a referred matter. Final reports which have had personal information redacted may be made public at the discretion of NSIRA. At the discretion of NSIRA and with the consent of the individual, a final report containing identifiable information may be made public.

Information may be used by NSIRA for its Review mandate under paragraphs 8(1)(a), (b), and (c) (see NSIR PPU 005; Reviews).

Information may be disclosed to the National Security and Intelligence Committee of Parliamentarians and to the Civilian Review and Complaints Commission with whom NSIRA cooperates in performing its review activities. Information may be disclosed to the Office of the Privacy Commissioner with whom NSIRA may coordinate its activities.

Retention and Disposal Standards: Retention of investigation files are retained in accordance with three categories of information holdings. Evidentiary Records are retained for two years after case closure of the file and transferred to Library and Archives Canada. The paper format of Administrative Files is retained for five years and destroyed after confirmation that all records have been digitized. The electronic format of Administrative Files is retained for seven years and transferred to Library and Archives Canada. Final Files are kept in an electronic format for 50 years after the case closure of the file and then transferred to Library and Archives Canada.

Records of the former Security Intelligence Review Committee are retained as follows: All SIRC Evidentiary Records and Administrative Files are being transferred to LAC.  Regarding Final Files, one copy of the final report will be retained for 50 years and then transferred to LAC.

Note:  Evidentiary Records are records submitted to NSIRA by the federal institution whose activities are being investigated, as well as records reported or referred to NSIRA and considered to evidentiary information. These records also include the transcripts of investigative interviews and NSIRA proceedings. Administrative Files include, but are not limited to, correspondences to parties, letters, all submissions by the complainant, and detailed notes taken by investigative staff, as well as all audio recordings of investigative interviews and NSIRA proceedings. Final Files are legal advice and all versions of the NSIRA investigation Final Report (Classified, Redacted, and Redacted and De-Identified). 

Note: A new Records Disposition Authority (RDA) is pending a decision by Library and Archives Canada which will reflect what information is of archival value within Evidentiary Records, Administrative Files, and Final Files. Once the NSIRA Secretariat-specific RDA is provided by Library and Archives Canada, any records not considered of archival value by Library and Archives Canada will be destroyed based on the above retention and disposal schedule.

RDA Number: 94/016 (Pending Review by LAC)

Related Record Number: NSIR INV 001

TBS Registration: 004449

Bank Number: NSIR PPU 005

Internal Services

Internal Services consist of various interconnected activities and resources that are managed to support the needs of an organization’s programs and other corporate responsibilities. These services are: Management and Oversight; Communications; Legal; Human Resources Management; Financial Management; Information Management; Information Technology; Real Property; Materiel; Acquisition; and Travel and Other Administrative Services. Internal Services are focused on activities and resources that serve the entire organization, rather than those dedicated to specific programs.

Acquisition Management Services

Acquisition management services involve activities undertaken to support the acquisition of goods, services or construction services identified as necessary for a department to fulfill its ongoing mandate and purpose. These activities include processing, monitoring and reporting, developing and implementing departmental policies and procedures, and activities that support the sound management of procurement contracts.

Communications Services

Communications services involve activities undertaken to ensure that Government of Canada communications are effectively managed, well-coordinated and responsive to the diverse information needs of the public. These activities ensure that the public receives government information, and that the views and concerns of the public are taken into account in the planning, management and evaluation of policies, programs, services and initiatives.

This Internal Services category refers to communications that are corporate in nature, affecting the entire department whether through internal communications to all employees or external communications on behalf of the department.

Financial Management Services

Financial management services involve activities undertaken in the department to ensure the prudent use and stewardship of financial resources in an effective, efficient and economic manner. Activities include planning, budgeting, accounting, costing, reporting, control and oversight, analysis, decision support and advice, and financial systems.

Human Resources Management Services

Human resources management services include activities related to supporting human resources (HR) planning and reporting; reviewing, assessing and developing organizational design; reviewing and assessing job descriptions and classifications; supporting staffing processes; collecting and processing employee information related to compensation, leave and transfers; identifying and coordinating organization-wide training and learning requirements; promoting values, ethics and employment equity; managing employee recognition and awards programs; addressing workplace management and labour relations; and developing and maintaining HR information systems within the organization.

Information Management Services

Information management services involve activities undertaken to achieve efficient and effective information management to support program and service delivery; foster informed decision making; facilitate accountability, transparency, and collaboration; and preserve and ensure access to information and records for the benefit of present and future generations. Information management (IM) is the discipline that directs and supports effective and efficient management of information in an organization, from planning and systems development to disposal or long-term preservation.

Legal services

Legal services involve activities undertaken to enable government departments and agencies to pursue policy, program and service delivery priorities and objectives within a legally sound framework. Activities include the provision of the following services: legal advisory, litigation and legislative services.

Management and Oversight Services

Management and oversight services involve activities undertaken to ensure that federal government service operations and programs comply with applicable laws, regulations, policies and plans. Activities include providing strategic direction, governance and corporate planning; allocating resources and taking investment decisions; and analyzing exposure to risk and determining appropriate countermeasures.

Materiel Management Services

Materiel management services involve activities undertaken to ensure that materiel can be managed by departments in a sustainable and financially responsible manner that supports the cost-effective and efficient delivery of government programs. Treasury Board’s Policy on Management of Materiel defines materiel as “all movable assets, excluding money or records, acquired by Her Majesty in right of Canada.” Movable assets are tangible and include a broad range of goods such as equipment (e.g., office, information technology, telecommunications, scientific), furniture and furnishings, and larger goods (e.g., vehicles and ships). Most materiel expenditures are specific program expenditures. However, as an Internal Services category, materiel management services include the expenditures from policy and administrative support for those who manage and dispose of materiel throughout the department.

Travel and Other Administrative Services

Travel and other administrative services include Government of Canada travel services, as well as those other internal services that do not smoothly fit with any of the internal services categories.

Manuals

  • NSIRA Rules of Procedure
  • Investigations Service Standards

Additional Information

The Government of Canada encourages the release of information through requests outside of the ATIP process. You may wish to consult the Secretariat’s completed Access to Information (ATI) summaries. To make an informal request, contact:

The Secretariat conducts Privacy Impact Assessments (PIAs) to ensure that privacy implications will be appropriately identified, assessed and resolved before a new or substantially modified program or activity involving personal information is implemented.

Please see the Introduction to this publication for information on formal access procedures under the provisions of the Access to Information Act and the Privacy Act. The following outlines how to make a formal ATIP request.

Mail your letter or Access to Information Request Form (Access to Information Act) or Personal Information Request Form (Privacy Act), along with any necessary documents (such as consent or the $5 application fee for a request under the Access to Information Act), to the following address:

Access to Information and Privacy Office
National Security and Intelligence Review Agency
P.O. Box 2430, Station “D”
Ottawa, Ontario, K1P 5W5

Please note: Each request made to NSIRA Secretariat under the Access to Information Act must be accompanied by an application fee of $5.00, cheque or money order made payable to the Receiver General for Canada.

Reading Room

In accordance with the Access to Information Act and the Privacy Act, the applicant may wish to review the material in person. Should you wish to review the materials in Ottawa, Ontario, you must make an advance appointment by emailing the Access to Information and Privacy Office at ATIP@nsira-ossnr.gc.ca.

Share this page
Date Modified:

Privacy Statement

Privacy Statement

The National Security and Intelligence Review Agency (NSIRA) is committed to respecting the privacy of those who visit its website. This notice summarizes the privacy practices related to the NSIRA’s website.

All personal information collected by the NSIRA is governed by the Privacy Act. This means that if the NSIRA asks you to provide personal information, you will be informed of the purpose for which your personal information is being collected and how to exercise your rights of access to, correction and protection of that information.

Protecting the privacy of users on this website

The nature of the Internet is such that web servers automatically collect certain kinds of information about visitors when they access websites, including each visitor’s Internet Protocol (IP) address. IP addresses are unique numbers assigned by Internet Service Providers (ISP) to all devices used to access the Internet. Web servers automatically log the IP addresses of visitors to their sites. An IP address, on its own, may not identify an individual. However, in certain circumstances, such as with the co-operation of an ISP for example, it could be used to identify an individual using the site. For this reason, federal institutions, including the NSIRA, consider a person’s IP address to be personal information, particularly when combined with other data that is automatically collected when a visitor requests a web page, such as the page or pages visited and the date and time of the visit.

Unless otherwise stated, the NSIRA does not automatically gather any specific information from visitors, such as name, telephone number, or email address. The NSIRA would obtain this type of information only if an individual were to supply it—for example, by email or by filling in a contact form. In such cases, details about how the personal information is handled will be provided in a Personal Information Collection Statement.

In cases where services are provided by organizations outside of the Government of Canada, such as social media platforms or mobile applications, IP addresses may be recorded by the Web server of the third-party service provider.

Communicating with the NSIRA

If you choose to send an email to the NSIRA, or complete a feedback form online, your personal information may be used by the NSIRA in order to respond to your inquiry. Such information may also be used for statistical, evaluation, and reporting purposes.

The NSIRA does not use the information to create individual profiles, nor does it disclose the information except in accordance with the Privacy Act.

Email and other electronic means used to communicate with the NSIRA are not secure unless it is specifically stated on a web page. Therefore, it is recommended that you do not send sensitive personal information, such as your social insurance number or date of birth, through non-secure electronic means.

Personal information from emails or completed feedback forms is collected pursuant to the National Security and Intelligence Review Agency Act, and is included in Personal Information Bank Public Communications (PSU 914)

Third-Party Social Media

The National Security and Intelligence Review Agency (NSIRA)’s use of social media serves as an extension of its presence on the Web. NSIRA social media account(s) are public and are not hosted on Government of Canada servers. Users who choose to interact with us via social media should read the terms of service and privacy policies of these third-party service providers and those of any applications used to access them. The NSIRA uses X and LinkedIn.

Personal information that you provide to the NSIRA via social media account(s) is collected under the authority of the National Security and Intelligence Review Agency Act. This information is collected to capture conversations (e.g. questions and answers, comments, rexeets) between you and the NSIRA. It may be used to respond to inquiries, or for statistical, evaluation and reporting purposes. Comments posted that violate Canadian law will be deleted and disclosed to law enforcement authorities. Comments that violate our terms and policies will also be deleted. The personal information is included in Personal Information Bank PSU 938 Outreach Activities.

Google Analytics 

NSIRA carries out web analytics using services from the third-party service providers Google Inc. (Google Analytics). Google Analytics operates data centers globally, including in the United States, to maximize service speed and reliability. Before data for analytics is transferred to any servers in the United States, it is collected in local servers, where users’ IP addresses are anonymized. Data collected for web analytics purposes going to the United States may be subject to the governing legislation of that country.

For more information about the privacy policies of these service providers, please visit their individual websites or use the following link: Google Analytics Privacy & Terms.

Inquiring About NSIRA Privacy Practices

You may direct any questions, comments, concerns, or complaints you have concerning the administration of the Privacy Act and privacy policies regarding the NSIRA’s web presence to the NSIRA Secretariat’s Access to Information and Privacy (ATIP) Coordinator. You can contact the ATIP Coordinator by email at ATIP@nsira-ossnr.gc.ca, or by regular mail at the following address:

National Security and Intelligence Review Agency
Attention: NSIRA ATIP
P.O. Box 2430, Station “D”
Ottawa, Ontario
K1P 5W5 Canada

If you are not satisfied with the NSIRA Secretariat’s response to your privacy concerns, you may wish to contact the Privacy Commissioner of Canada at the following address:

Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3

Share this page
Date Modified:

Info Source

Info Source

Info Source: Sources of Federal Government and Employee Information provides information about the functions, programs, activities and related information holdings of government institutions subject to the Access to Information Act and the Privacy ActIt provides individuals and employees of the government (current and former) with relevant information to access personal information about them held by government institutions subject to the Privacy Act and to exercise their rights under the Privacy Act.

The Introduction and an index of institutions subject to the Access to Information Act and the Privacy Act are available centrally.

The Access to Information Act and the Privacy Act assign overall responsibility to the President of Treasury Board (as the designated Minister) for the government-wide administration of the legislation.

Share this page
Date Modified:

Investigations

SUMMARY OF THE PRIVACY IMPACT ASSESSMENT

Investigations

Government Institution

National Security and Intelligence Review Agency (NSIRA) Secretariat

Government official responsible for the PIA

Charles Fugère

Executive Director, NSIRA Secretariat

Head of the government institution or Delegate for section 10 of the Privacy Act

Charles Fugère

Executive Director, NSIRA Secretariat

Standard or institution specific personal information bank:

NSIR PPU 005 (Investigations).  The former Security Intelligence Review Committee’s PIB called Complaints (SIR PPU 005) was pending transfer approval from Treasury Board Secretariat at the writing of this PIA.  In parallel to that transfer approval, this PIA has determined that updates and modifications to the PIB (now called NSIR PPU 005 – Investigations) is warranted. 

Legislated authority for activity:

NSIRA was established pursuant to Part 1 (NSIRA Act) of the National Security Act, 2017, which received Royal Assent on June 21, 2019 (the NSIRA Act came into force on July 12, 2019). NSIRA is comprised of the Review Agency established under s. 3 of the NSIRA Act (Chair, Vice-Chair and Members) and the Secretariat established pursuant to ss. 41(1) of that Act whose role it is to assist the Review Agency in fulfilling its mandate.  For the purposes of the Privacy Act, it is the Secretariat – headed by the Executive Director – that is the government institution.

NSIRA is largely comprised of the former Security Intelligence Review Committee (SIRC) while assuming responsibilities over the review and complaints mandate of the former Office of the Communications Security Establishment Commissioner (OCSEC); the remaining responsibilities under OCSEC were assumed by the newly created Office of the Intelligence Commissioner.

The legal authority for NSIRA’s personal information collection, use and disclosure in accordance with its mandate is derived from its enabling legislation, the NSIRA Act; most notably, section 8.  Specific to the scope of this PIA, paragraph 8(1)(d) of the NSIRA Act mandates the Review Agency to investigate: 

  1. Any complaint related to the activities of the Canadian Security Intelligence Service (CSIS) per ss. 16(1) of the NSIRA Act.
  2. Any complaint related to the activities of the Communications Security Establishment (CSE) – per ss. 17(1) of the NSIRA Act.
  3. Any complaint related to a government employee or contractor having their security clearance being denied or revoked and for that reason only they were dismissed, demoted, transferred, denied a promotion or transfer, denied a contract, or denied from providing goods or services to the Government of Canada – per ss. 18(3) of the NSIRA Act.
  4. Any complaint referred to the Agency under ss. 45.53(4.1) or 45.67(2.1) of the Royal Canadian Mounted Police Act (RCMP Act) – per s. 19 of the NSIRA Act.
  5. Reports made to the Agency under section 19 of the Citizenship Act; and
  6. Matters referred to the Agency under s. 45 of the Canadian Human Rights Act.

These mandates, and the legal authority to collect information, is supported by other sections of the NSIRA Act and other Acts (as mentioned above).

Summary of the project / initiative/ change:

This PIA was authored to assess the business practices and privacy safeguards of NSIRA related to its investigations mandate. 

Investigations by NSIRA are triggered by complaints submitted by any individual related to the activities of CSIS, CSE, or related to the denial or revocation of a security clearance.  Furthermore, NSIRA is required to investigate reports and referrals from the CRCC, CHRC and the Minister of Immigration, Refugees and Citizenship Canada when issues are presented to those institutions that involve national security. 

Investigations are handled by Review Agency Members who are appointed by the Governor in Council (GIC) after various consultations by, and on the recommendation of, the Prime Minister.  Each Member may serve a term not to exceed five years and can be reappointed for one additional term (s. 4 of the NSIRA Act). 

With support from the NSIRA Secretariat’s Investigation Team, documents are collected and reviewed from the respondent federal institution(s) – the institution whose activities are the subject of the complaint, referral, or report.  Investigative interviews are conducted with the complainant, respondent and witnesses, and, in some instances, a hearing is held to  arrive at its conclusions.  Ultimately, the assigned Member issues a quasi-judicial report which includes findings and in some instances recommendations to the respondent federal institution(s) – a final report.  A declassified final report is shared with the Complainant and, under the discretion of the assigned Member, a declassified and depersonalized final report may be posted publicly.  NSIRA uses caution in its decision to make public a final report as the details, even with the removal of names and other identifiable information, may identify a person(s). 

The investigation processes and procedures of NSIRA (Members and the Investigations Team) involve the collection of personal information which in most cases, if not all, results in a report which directly impacts the complainant or the individual impacted by the referred/reported matter.  Therefore, for the purposes of the Privacy Act and Treasury Board (TB) privacy policy instruments, the use of personal information for NSIRA’s investigation activities is for an administrative purpose.

Each risk identified in this PIA has been assessed by the NSIRA and a risk mitigation plan has been created for each of the risk’s corresponding recommendations.  None of the risks were considered High and all mitigation measures will be completed before the end of FY 2023-24. 

Risk Area Identification and Categorization

In its Directive on Privacy Impact Assessment, TB has expressed that the PIA must include a completed risk area identification and categorization section, which must be made public.  A risk rating must be assigned to each risk area named and described in Appendix C of the TB Directive on Privacy Impact Assessment.  The numbered risk scale is presented in an ascending order: the first level (1) represents the lowest level of potential risk for the risk area; the fourth level (4) represents the highest level of potential risk for the given risk area.

Risk Area Risk Level
Type of Program or Activity: Compliance / Regulatory investigations and enforcement
Personal information is used for purposes of detecting fraud or investigating possible abuses within programs where the consequences are administrative rather than criminal in nature (e.g., a discontinuation of benefits or an audit of personal income tax file).
3
Type of Personal Information Involved and Context: Sensitive personal information, including detailed profiles, allegations or suspicions, bodily samples and/or the context surrounding the personal information is particularly sensitive.
For example: personal information that reveals intimate details on the health, financial situation, religious or lifestyle choices of the individual and which, by association, reveals similar details about other individuals such as relatives.
4
Program or Activity Partners and Private Sector Involvement: With other federal institutions. 2
Duration of the Program or Activity: Long-term program
Existing program that has been modified or is established with no clear “sunset”.
3
Program Population: The program affects certain individuals for external administrative purposes. 3
Technology and Privacy: NSIRA investigations do not involve the development of a new system or modifications to existing systems. NSIRA collects and stores up to CLASSIFIED documents using appropriate safeguards. Investigative interviews and hearings are audio recorded.

NSIRA investigations require federal institutions and NSIRA personnel to match complainant information to the records of that federal institution. Most data matching activities require the person’s name and date of birth (DOB) to be the main data elements in determining a match. One of NSIRA’s initial tasks in reviewing records is to ensure the records are of the intended individual, with no doubt about identity.
Personal Information Transmission: The personal information is transferred to a portable device or is printed.
USB key, diskette, laptop computer, or any transfer of the personal information to a different medium.
3
In the Event of a Privacy Breach, Impact on the Individual: A privacy breach of complainant information could have significant reputational harm to NSIRA. The types of information referred to NSIRA are highly sensitive — both from a government security classification perspective and a personal information perspective.

Embarrassment, relationship impacts, media attention, and negative employment consequences are all potential risks if NSIRA investigative records were to be breached.
Share this page
Date Modified:

Creation of the National Security and Intelligence Review Agency

Creation of the National Security and Intelligence Review Agency

SUMMARY OF THE PRIVACY IMPACT ASSESSMENT

CREATION OF THE NATIONAL SECURITY AND INTELLIGENCE REVIEW AGENCY (NSIRA)

Government Institution

National Security and Intelligence Review Agency Secretariat

Government official responsible for the PIA

Charles Fugère

Executive Director

Head of the government institution or Delegate for section 10 of the Privacy Act

Charles Fugère

Executive Director, NSIRA Secretariat

Standard or institution specific personal information bank:

Most standard PIBs apply to NSIRA’s internal services.  Also, this PIA implicates the two former SIRC PIBs (Complaints, SIR PPU 005 and Contracts, SIR PPU 010).

Legislated authority for activity:

NSIRA was established pursuant to section 3 of the National Security and Intelligence Review Agency Act (NSIRA Act), which came into force on July 12, 2019.  NSIRA is largely comprised of the main components of the former Security Intelligence Review Committee (SIRC), which had been established pursuant to the Canadian Security Intelligence Service Act, and it also assumed the responsibilities of the former Office of the Communications Security Establishment Commissioner (OCSEC), as established by the National Defence Act.

The transition from the above two organizations to the new NSIRA (with an expanded mandate) is governed by the National Security Act, 2017.

The legal authority for NSIRA’s personal information collection, use and disclosure in accordance with its mandate is derived from its enabling legislation, the NSIRA Act; most notably, section 8.

Summary of the project / initiative/ change:

Due to the creation of NSIRA through the transfer of the former SIRC and OCSEC, as well as an expanded mandate, this Privacy Impact Assessment (PIA) was intended as a high-level assessment of the NSIRA as it was developing its procedures and policies, including but not limited to, an overarching privacy policy suite. 

The intent of the PIA was to assess any risks or gaps present at the time of the assessment and to ensure proper privacy standards and safeguards are in place or improved upon in a timely manner. 

NSIRA’s collection of personal information is integrated into its review process wherein it collects such information from the federal institutions for which it is conducting a review.  However, the collection of personal information for reviews is for a non-administrative purpose – NSIRA’s use is to complete a review of the institution only; no decision is made in regard to the individuals whose personal information personnel access. 

NSIRA also has a complaints and investigations mandate which involves the collection of personal information directly from complainants and decisions that directly impact the individual (administrative purpose).  At the writing of the PIA, that activity was under review and change, therefore, that program was not assessed as part of this PIA.  Instead, a subsequent and fulsome PIA on that specific program activity will be performed later in FY 2021-22.  

NSIRA’s Secretariat also collects information on its employees in order to perform various employer services such as pay, benefits, and leave, as well as security screening.

This high level PIA identified ten risks and 18 corresponding recommendations to mitigate those risks.  None of the risks were considered High and all mitigation measures will be completed before the end of FY 2021-22. 

Risk Area Identification and Categorization

In its Directive on Privacy Impact Assessment, TB has expressed that the PIA must include a completed risk area identification and categorization section, which must be made public.  A risk rating must be assigned to each risk area named and described in Appendix C of the TB Directive on Privacy Impact Assessment.  The numbered risk scale is presented in an ascending order: the first level (1) represents the lowest level of potential risk for the risk area; the fourth level (4) represents the highest level of potential risk for the given risk area.  For this PIA the risk areas and associated risk levels vary due to the broad scope of the PIA to include HR and security screening, and other internal services, as well as the review function of the NSIRA mandate.

Table: Risk Assessment of NSIRA Activities Involving Personal Information
Risk Area Risk Level
Type of Program or Activity: Criminal investigation and enforcement / National Security
Personal information is used for investigations and enforcement in a criminal context (i.e. decisions may lead to criminal charges/sanctions or deportation for reasons of national security or criminal enforcement).
4
Type of Personal Information Involved and Context: Sensitive personal information, including detailed profiles, allegations or suspicions, bodily samples and/or the context surrounding the personal information is particularly sensitive.
For example: personal information that reveals intimate details on the health, financial situation, religious or lifestyle choices of the individual and which, by association, reveals similar details about other individuals such as relatives.
4
Program or Activity Partners and Private Sector Involvement: With other federal institutions and, in limited instances, private sector organizations or international organizations or foreign governments. 4
Duration of the Program or Activity: Long-term program
Existing program that has been modified or is established with no clear “sunset”.
3
Program Population: The program affects certain individuals for non-administrative purposes, as well as NSIRA employees for internal administrative purposes. 3
Technology and Privacy: The creation of NSIRA requires the management of new networks to manage the sensitive personal information collected by the Agency under its review mandate, as well as the personal information of Secretariat employees.
Personal Information Transmission: The personal information is transferred to a portable device or is printed.
USB key, diskette, laptop computer, any transfer of the personal information to a different medium.
3
In the Event of a Privacy Breach, Impact on the Individual: A privacy breach of employee information may have moderate to significant reputational or financial harm. The amount of sensitive personal details (criminal records, audio files of security interviews) and documents (credit reports) is significant and could, at times, support identity theft. However, the more likely impact is embarrassment and reputational harm. Also, the breach of any vaccination attestation, accommodation, or rapid testing information could have minor to significant reputational harm on an NSIRA Secretariat employee or GIC Appointee (Executive Director and NSIRA Members).
Share this page
Date Modified:

Privacy Impact Assessment Summaries

Privacy Impact Assessments

A Privacy Impact Assessment (PIA) is a comprehensive evaluation process that assists government departments and agencies in assessing the potential impact of their programs and services on individual privacy, ensuring the safeguarding of personal information.

In accordance with the Directive on Privacy Practices, it is mandatory to document, publish, and maintain a PIA for all federal programs and services that may have implications for privacy rights.

The following are summaries of the PIAs completed by the National Security and Intelligence Review Agency Secretariat:

Share this page
Date Modified: