Passenger Protect Program
Section 1 – Privacy Impact Assessment Overview
- Name of Program or Activity:
Passenger Protect Program - Institution responsible for delivering Program or Activity:
Public Safety Canada - Government Official Responsible for the Privacy Impact Assessment:
Director General, National Security Policy Directorate, National and Cyber Security Branch - Head of Institution/Delegate:
Senior Assistant Deputy Minister, National and Cyber Security Branch - Description of Program or Activity (from Program Activity Architecture):
The Passenger Protect Program (PPP) works with air carriers to screen commercial passenger flights to, from and within Canada, and uses specific, reasonable and necessary measures to address threats to transportation security, as well as to mitigate travel for the purpose of committing certain terrorism offences.
The PPP is administered by Public Safety Canada (PS) and Transport Canada (TC) in cooperation with a number of federal departments and agencies and in accordance with the Secure Air Travel Act (SATA), which provides the legislative framework for the PPP. As per subsection 8(1) of the SATA, the Minister of Public Safety may establish a list of individuals (SATA list) whom the Minister has reasonable grounds to suspect will:
- engage or attempt to engage in an act that would threaten transportation security; or
- travel by air to commit certain terrorism offences, as defined in the Criminal Code, such as participating in or contributing to terrorist activities or funding, training and/or recruitment of a terrorist group.
The SATA list includes the name (given name, surname), any known alias, date of birth and gender of these persons.
Pursuant to subsection 9(1) of the SATA, the Minister of Public Safety may direct an air carrier to take a specific, reasonable and necessary action to prevent a listed person from engaging in the acts described above. Actions could include directing an air carrier to deny transportation to a listed person, or requiring the listed person to undergo additional screening.
The SATA list is disclosed by PS to TC, pursuant to section 10 of the SATA and communicated by TC to air carriers, pursuant to subsection 13(a) of the SATA. As per the Secure Air Travel Regulations, air carriers are required to screen all passengers who appear to be 18 years of age or older prior to issuing them a boarding pass. When a passenger’s personal information matches that of a listed person, the air carrier must confirm the person’s identity and inform TC. TC, in turn, will contact PS for the purpose of issuing a direction, pursuant to subsection 9(1) of the SATA. The direction made by the Minister of Public Safety, such as denying the listed person boarding or requiring them to undergo additional screening, will be communicated to the air carrier by TC, pursuant to subsection 13(c) of the SATA.The Minister of Public Safety determines who will be placed on the SATA list based on information provided by an Advisory Group chaired by PS - the Passenger Protect Advisory Group (PPAG). Nominating members of the PPAG include TC, the Canadian Security Intelligence Service, the Royal Canadian Mounted Police, and the Canada Border Services Agency. Immigration, Refugees and Citizenship Canada and Justice Canada participate in meetings of the PPAG in an advisory capacity.
The PPAG considers names and supporting information provided by nominating members on individuals whom they suspect may pose a threat to transportation security or who may be seeking to travel by air for terrorism-related purposes. When making a recommendation for listing, the nominating member completes a case brief providing identifying information on an individual, as well as sufficient information necessary to support the addition of the individual’s name to the SATA list. The information is collected by the nominating member, pursuant to their organization’s statutory mandate and disclosed to PS and other PPAG members, pursuant to section 10 of the SATA.
Pursuant to subsection 8(2) of the SATA, the Minister of Public Safety must review the list every 90 days to determine whether the grounds for which each person’s name was added to the list still exist and whether the person’s name should remain on the list.
- Description of the class of records associated with the program or activity:
Includes records related to the PPP, which identifies individuals whom the Minister of Public Safety has reasonable grounds to suspect will engage or attempt to engage in an act that would threaten transportation security, or travel by air for the purpose of committing certain terrorism offences, as defined in the Criminal Code, as well as any directions issued by the Minister of Public Safety. Records include personal information related to persons considered for listing under the PPP, policy advice to senior decision makers and meeting documents.
Record Number: PS NCSB 05
- Personal Information Bank:
The PIB associated with the PIA identified in this Summary needs to be created to describe the following:
This bank describes information about individuals considered for listing under the PPP. This information is collected by persons or entities set out in section 10 of the Secure Air Travel Act, pursuant to their respective statutory mandates.
Personal information in this bank may include: name, contact information (including last known address), aliases, gender, date of birth, place of birth, biographical information, citizenship status, travel/identity documents, personal identification numbers, any known financial information, descriptions of individuals (including photographs), descriptions of known or suspected acts or activities performed by an individual, any known fraudulent documentation presented or used by an individual, known affiliations with terrorist or criminal organizations, known criminal record, travel history, and any other specific information that may be collected from carriers or operators of a reservation system, pursuant to subsection 6(2) of the SATA, for the purpose of identity verification and the issuance of a direction under subsection 9(1) of the SATA.
Additional information compiled by Public Safety includes documents such as intelligence reports, threat and risk assessments, briefing notes and other correspondence from persons or entities set out in section 10 of the Secure Air Travel Act.
- Legal Authority for Program or Activity:
The SATA came into force on August 1, 2015, to create the legislative framework for the PPP. The SATA expanded the mandate of the PPP beyond aviation security to include the prevention of terrorist travel. Among other things, the SATA clearly outlines the authorities of the Minister of Public Safety to list individuals; to share information related to the list with and among domestic partners under certain conditions; and to direct air carriers to deny boarding or take other measures with respect to listed individuals, such as requiring additional screening.
To support the administration of the PPP, the Secure Air Travel Regulations (SATR) came into force to align with the new statutory authorities set out in the SATA. The SATR sets out the obligations of air carriers to verify the identity of each traveller who appears to be 18 years of age or older, to inform the Minister of Transport of a match to the list, as well as to ensure compliance with other requirements.
- Summary of the project / initiative / change:
The PPP is an important part of Canada’s national security framework. TC launched the PPP in 2007 to protect aviation by denying boarding to any specified person whom the Minister of Transport determined to be an immediate threat to aviation security. Sections of the Aeronautics Act and the Identity Screening Regulations were used in order to allow for the specifying of individuals, to respond to threats through an emergency direction, collecting and sharing information with air carriers, and for monitoring air carrier compliance with information-protection requirements.
In February of 2011, the PPP underwent machinery of government changes. An Order in Council transferred the responsibility for determining the individuals who should be included on the list from the Minister of Transport to the Minister of Public Safety. Communicating the list of names of these individuals to air carriers remained the responsibility of the Minister of Transport, as did the issuance of emergency directions to deny boarding in cases where an air carrier identified a potential match to a listed person, pursuant to paragraph 4.81(1)(b) of the Aeronautics Act.
On August 1, 2015, the SATA came into force to provide a solid legislative framework for the PPP. Among its provisions, the SATA:
- sets out authorities of the Minister of Public Safety and the Minister of Transport;
- clarifies authorities relating to the collection and disclosure of information;
- broadens the mandate of the PPP to include the prevention of travel by air for the purpose of committing certain terrorism offences, as defined in the Criminal Code, such as recruiting, training, or conducting attacks;
- transfers the authority for making directions to air carriers to take a specific, reasonable and necessary action against a listed person from the Minister of Transport to the Minister of Public Safety. The Minister of Transport remains responsible for communicating the list and any direction made by the Minister of Public Safety to air carriers, for disclosing information collected from air carriers and operators of aviation reservation systems to the Minister and any other person or entity referred to in section 10, as well as for ensuring compliance with aviation-related laws and regulations.
For more information on the PPP, please visit the program’s website at:
https://www.publicsafety.gc.ca/cnt/ntnl-scrt/cntr-trrrsm/pssngr-prtct/index-en.aspx
Section 2 - PIA Risk Area Identification and Categorization
The following section contains risks identified in the PIA for the new or modified program. A risk scale has been included for each risk area lettered "a – f". The numbered risk scale is presented in ascending order: the first level represents the lowest level of potential risk for the risk area; the fourth level (4) represents the highest level of potential risk for the given risk area. Please refer to “Appendix C” of the TBS Directive on PIAs to learn more about the risk scale.
- Type of program or activity
- Administration of program or activity and services
Risk Scale - 2
- Administration of program or activity and services
- Type of Personal Information Involved and Context
- Sensitive personal information, including detailed profiles, allegations or suspicions and bodily samples, or the context surrounding the personal information is particularly sensitive
Risk Scale - 4
- Sensitive personal information, including detailed profiles, allegations or suspicions and bodily samples, or the context surrounding the personal information is particularly sensitive
- Program or Activity Partners and Private Sector Involvement
- With other government institutions
Risk Scale – 2
- With other government institutions
- Duration of the Program or Activity
- Long-term program
Risk Scale - 3
- Long-term program
- Program Population
- The program affects certain individuals for external administrative purposes.
Risk Scale - 3
- The program affects certain individuals for external administrative purposes.
- Technology and Privacy
Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information? No
The new or modified program or activity involve the implementation of one or more of the following technologies:
Does the new or modified program or activity require any modifications to IT legacy systems and / or services? No- Enhanced identification methods? No
- Use of Surveillance? No
- Use of automated personal information analysis, personal information matching and knowledge discovery techniques? No
- Personal Information Transmission
- The personal information is transmitted using wireless technologies.
Risk Scale – 4
- The personal information is transmitted using wireless technologies.
- Risk Impact to the Institution:
- Reputation harm, embarrassment, loss of credibility
Risk Scale – 4
- Reputation harm, embarrassment, loss of credibility
- Risk Impact to the Individual or Employee
- Physical harm
Risk Scale – 4
- Physical harm
- Date modified: