ARCHIVE - Beyond the Border Action Plan: Statement of Privacy Principles by the United States and Canada

PDF Version (78 Kb)

Recognizing that greater information sharing between Canada and the United States is vital to protecting the security of our citizens and that our countries have a long history of sharing personal information responsibly and respecting our separate Constitutional and legal frameworks that protect privacy,

Recognizing that Canada and the United States are committed to protecting privacy in all Beyond the Border (BTB) arrangements and initiatives undertaken by our two countries and specifically to stating the privacy protection principles that are to inform and guide all BTB information sharing arrangements and initiatives,

Noting that the implementation of these Principles may be tailored to the specific context of particular BTB arrangements and initiatives, but always in a manner consistent with the Principles,

Recognizing that any exceptions from principles that may be required in the context of particular BTB arrangements for law enforcement and national security purposes will be as few as possible, made known to both the United States and Canada and the public, and consistent with domestic law, and

Recognizing that personal information is to be provided, received and used only in accordance with domestic and international law applicable to the United States and Canada,

The United States and Canada set forth the following Statement of Privacy Principles concerning the provision, receipt and use of personal information exchanged by the United States and Canada pursuant to any BTB information sharing arrangements and initiatives:

1. Purpose Specification
   

   The purposes for which personal information is provided, received and used are to be specified in any BTB arrangements or initiatives and such personal information is to be subsequently used in furtherance of the fulfillment of those purposes or such other lawful purposes as are not incompatible with those purposes and are specified either in the relevant BTB arrangement or initiative or in a notice to the public and to the other participant in the relevant BTB arrangement or initiative.

2. Relevant and Necessary/Proportionate
   

   Personal information is to be provided, received and used to the extent it is relevant, necessary and appropriate to accomplish a clear purpose set out in any BTB arrangements or initiatives.

3. Integrity/Data Quality
   

   Canada and the United States are to make reasonable and appropriate efforts to maintain personal information accurately and completely, including any caveats or conditions attached to the information. Any further related information, including updates or clarifying information, is to be included to ensure continuing accuracy and completeness.

4. Non-Discrimination
   

   Canada and the United States are to apply this Statement of Privacy Principles to all individuals on an equal basis without unlawful discrimination.

5. Information Security
   

   Personal information is to be protected by appropriate technical, security and organizational procedures and measures to guard against such risks as loss; corruption; misuse; unauthorized access, alteration, disclosure or destruction; or any other risks to the security, confidentiality or integrity of the information. Only authorized individuals with an identified purpose are to have access to personal information.

6. Accountability
   

   Canada and the United States affirm their accountability for compliance with their respective domestic law and rules on the protection of personal information.

7. Effective Oversight
   

   A system of effective data protection supervision is to exist in the form of a public supervisory authority or authorities with effective powers of intervention and enforcement. These powers may be carried out by a specialized public information protection authority or by more than one supervisory public authority to meet the particular circumstances of different legal systems.

8. Individual Access and Rectification
   

   The United States and Canada are to provide individuals with access to and the means to seek rectification and/or expungement of their personal information. Should access to personal information need to be limited, the specific grounds for any restrictions are to be specified consistent with domestic law. In appropriate cases, an individual may object to the provision, receipt and use of personal information related to him or her.

9. Transparency and Notice
   

   The United States and Canada are to provide individuals, as required by law, with general and, as appropriate, individual notice, at least as to the purpose of the provision, receipt and use of personal information that concerns the individual, the identity of the entity controlling that information, the applicable rules or laws, the types of third parties to whom information may be subsequently disclosed, as well as other information insofar as is necessary to seek effective sanctions and/or remedies.

   Should notice need to be limited for national security or law enforcement reasons, such as the protection of an ongoing investigation or the protection of victims or witnesses, the limitation on notice should be consistent with domestic law.

10. Redress
    

    The United States and Canada are to provide, consistent with their respective domestic law, effective remedies before a fair and objective authority where a person's privacy has been infringed or where there has been a violation of data protection rules with respect to that individual. Any such infringement or violation is to be subject to appropriate and effective sanctions and/or remedies. Redress may not be available for frivolous claims or where there has been no material infringement of a person's privacy.

11. Restrictions on Onward Transfers to Third Countries
    

    Where personal information is provided, in accordance with relevant domestic law, by a competent authority of the United States or Canada (the originating country) to a competent authority of the other nation (the receiving country) , the competent authority of the receiving country is to authorize or carry out an onward transfer of this information to a third country only if consistent with the domestic law of the receiving country, and in accordance with existing applicable international agreements and arrangements.

    In the absence of such international agreements and arrangements, the receiving country may transfer the personal information to a third country when consistent with the domestic law of the receiving country, in which case the originating country is to be notified:

    1. prior to the transfer; or
    2. as soon as reasonably possible after the transfer in the case of exigent circumstances.
12. Retention
    

    The United States and Canada are to retain personal information only so long as necessary for the specific purpose for which the information was provided or further used, and in accordance with their respective domestic laws.

Nothing in this Statement of Privacy Principles is intended to give rise to rights or obligations under domestic or international law. This Statement of Privacy Principles is not intended to constitute a treaty or other binding agreement under international law.

Canada and the United States intend to consult each other as necessary, including through the Executive Steering Committee, on the application of this Statement of Privacy Principles to particular Beyond the Border arrangements and initiatives, and to discuss more general developments in the protection of privacy rights.

Date modified:

2017-09-07