Edward Hasbrouck of the Identity Project testified yesterday on behalf of the Liberty Coalition at a hearing before the Canadian House of Commons’ Standing Committee on Transport, Infrastructure and Communities on Bill C-42, which — as we’ve discussed previously — would override Canada’s “Personal Information Protection and Electronic Documents Act” (PIPEDA) to permit airlines to give personal information about passengers to the government of any country whose airspace a flight would pass through, even if it didn’t land in that country.

Bill C-42 was proposed by the government, but is being opposed by some within Parliament as well as civil liberties and human rights activists and (along with the US Secure Flight scheme) by the Office of the Privacy Commissioner of Canada.

The English-language audio archive of the hearing is here; the complete transcript is here. Mr. Hasbrouck’s introductory statement is from 24:45 to 35:15 of the audio stream; he was also questioned extensively by the members of the Committee.

Because of the Thanksgiving holiday in the US, the invitation to testify arrived too late for the requisite translation into French of any written notes or supporting documents. For more background on the information architecture and cross-border data flows of the airline industry, see the slides from Mr. Hasbrouck’s more detailed testimony on related issues earlier this year at the European Parliament in Brussels.

Here’s the transcript of our introductory statement:

Mr. Edward Hasbrouck:

[translation]

Good morning and thank you. Please excuse me, my French is very limited.

[English]

I’m sorry I can’t be with you in Ottawa, but I’m very grateful for the opportunity to contribute a U.S. perspective to the deliberation in this House.

I’m here on behalf of the Liberty Coalition, which coordinates public policy activities on civil liberties and basic rights in conjunction with more than 80 partner organizations from across the political spectrum. The Liberty Coalition does not, however, speak on behalf of those organizations, and my testimony today does not reflect the position of any single coalition partner.

My own particular expertise in airline reservation data is derived from more than 15 years of experience working with PNRs—passenger name records—in the travel industry and more recently working as an investigative journalist and an activist with the Identity Project, researching and documenting both what information is collected about travellers and how that information is used by both the government and private entities in the United States.

The U.S. government, which is to say the Department of Homeland Security, wants the information that would be made available by Bill C-42 for two purposes: for surveillance and for control of travellers. With respect to control, of course, this data would be part of the basis for the making of no-fly decisions and the issuance of secret no-fly orders to airlines.

Unlike the case in Canada, where someone denied travel is given formal notice of that decision and has rights to appeal it, those no-fly orders in the U.S. are entirely extrajudicial. No one in the U.S. has yet obtained court review by any U.S. court of a no-fly order. It is U.S. government policy not even to admit that they have issued such an order, and that includes those denying passage on flights overflying the U.S. that were not scheduled to land. Former Secretary of Homeland Security Michael Chertoff is on the public record as saying that he believed that no-fly decisions should not be subject to judicial review, and the current U.S. administration has done nothing to repudiate that perspective.

While the consequences for anyone are very serious, including for those U.S. citizens trapped abroad who are currently unable to return home because they are not allowed to fly and have no other way to get back to the U.S, they are perhaps most draconian for refugees and asylum seekers. You should be very clear that the enactment of Bill C-42 would grant to the U.S. government de facto veto power over the ability of virtually anyone to obtain sanctuary in Canada, since in most cases it’s impossible to get to Canada to make a claim for political asylum or refugee status without overflying the U.S., and that power of the U.S. would be exercised at the worst possible point: while a refugee is still on the soil of and subject to the persecution of the regime they are trying to flee.

While the U.S. is a party to the International Covenant on Civil and Political Rights, article 12 of which guarantees freedom of movement, it ratified the ICCPR with reservations that make it impossible to invoke or enforce it through any U.S. court. In the only instance in which the U.S. DHS has even acknowledged the formal complaints of the Identity Project that its policies, including no-fly and secure flight policies, violate the freedom of movement guaranteed by the ICCPR—the only time it’s been acknowledged at all—the TSA took the formal position that the ICCPR does not apply at all to any measure undertaken for reasons of national security.

You should be clear that you are dealing here–unfortunately, I have to say–with a rogue state whose declared position is that its actions in this sphere are exempt from the norms of international human rights law and even from the treaties that it has ratified.

These data are also used for purposes of surveillance of travellers. It is not the case that the information is simply used to make a one-time decision about whether to let you fly. All of your PNRs, even if you are not deemed suspicious and are allowed to fly, will be added to the lifetime travel history and compilation of data already being kept about you as part of the automated targeting system. This includes, as Professor Salter alluded to, a wide range of information. We’ve been coordinating efforts by individuals in the U.S.—at least, by U.S. citizens, who have some rights in this regard—to request these records. They include, for example, such things as your IP address, who paid for someone else’s ticket, what friend’s phone number you gave because you were staying at their house when you reconfirmed your reservations, or, in the case of two people travelling together who made their same hotel reservations in the same PNR with their flight reservations, codes indicating whether, behind the closed doors of their hotel room, they asked for one bed or two.

So we’re looking literally at data down to the level of intrusiveness of who is sleeping with whom, and of course there is also the opportunity to insert into these records free-text remarks — derogatory comments by a customer service representative who didn’t like your attitude, and these sorts of things — that become part of your permanent dossier with the U.S. government.

Because of their secrecy, we have only a partial idea of what data are actually included in these records and an even less complete view of how they are used. As you probably know, the Privacy Act in the U.S. grants no rights whatsoever to foreigners, so there is no legal entitlement for Canadians to find out where these data have gone. Even for U.S. citizens, the DHS has been, I regret to say again, stonewalling requests. I have been obliged, after three years of attempts to get my own dossier and an accounting of the third parties to whom it was given, to bring a federal lawsuit, which is now pending, to find out what those records are.

So far as I know, nobody has actually obtained an accounting of the third-party disclosures of their PNR data by DHS, not even U.S. citizens. While some privacy impact assessments and diplomatic assurances have been offered, it’s very important to understand that those are not embodied in any treaty or in any U.S. statute or regulation. They are not enforceable and they have no more weight than any other press release.

All that said about the uses of data by governments, Bill C-42 would authorize airlines to provide these data to the U.S. and other governments. However, this may not actually be necessary, because in most cases the data are already stored in the U.S. and are already accessible to the U.S. government, with or without the permission, or even the knowledge, of the airline.

The vast majority of travel agents and tour operators in Canada, as around the world, do not store their own data. Even if you make a reservation with a Canadian travel agency to travel on a flight that doesn’t overfly the U.S., or even within Canada, in the vast majority of cases that reservation is, from the moment of its creation, stored in a computerized reservation system or global distribution system based either in the U.S. or in Europe, but with offices in the U.S. from which all of that information is available.

So it’s already possible for the U.S. to go to that CRS or GDS with a national security letter, order them to disclose the entirety of the PNR, order them to conceal the fact that this has happened, and even order them to deny it if asked by the airline, the travel agency, the tour operator, or the individual to whom these data pertain.

You’re not being asked to provide this personal information directly to the U.S., Canadian, or any other government; you’re required to provide it to an airline, which is going to provide it to other commercial partners or outsourcing providers, so it’s also important to understand that these commercial entities that have the data in the U.S are subject to no privacy law whatsoever, absolutely none. They are utterly free to sell this data, use it for any purpose, or transfer it to any third party anywhere in the world. They are not obligated to obtain permission or even to disclose it to the data’s subject.

I think there are grave questions as to whether the outsourcing of PNR storage to CRSs and GDSs in the U.S. by Canadian travel agencies and tour operators complies in any respect with PIPEDA, and nothing in Bill C-42 addresses this problem.

While it is not for me as someone speaking to you from San Francisco to tell Canadians what laws you should enact in your country, I certainly hope you will not follow the bad example set by the United States in turning the commercial infrastructure of the airline industry and the travel industry into a permanent infrastructure of surveillance and control of our movements, but that you will use this opportunity to take a much closer look at whether the existing norms and data flows of the industry–particularly the routine and systematic outsourcing to utterly unregulated data aggregators in the form of the CRSs and GDSs in the US — comply with existing law or require further legislation or enforcement action.

I’d be happy to answer any questions from the members.