The ‘slippery slope’ of sharing personal data

With President Donald Trump back in office, legal experts say a new agreement that allows permanent residents’ personal data to be shared at the Canada-U.S. border raises serious questions.

The agreement was signed in July and came into force this month, but news of its existence was not publicized until a media briefing with Immigration, Refugees and Citizenship (IRCC) minister Marc Miller in mid-January.

The agreement updated a 2012 pact called the Beyond the Border Action Plan, which allowed for automatically sharing non-residents’ personal data when applying for visas. In October, the amendment was tabled in Parliament, adding permanent residents to the list.

This means their data will be shared when they move between the two countries — a development the IRCC says will reduce fraud and improve border security.

But lawyers say it should have been the subject of greater scrutiny, including external consultations.

“Nothing is more fundamental to our immigration program than its overall integrity and security,” says Mario Bellissimo, principal lawyer at Bellissimo Law Group and past chair of the Canadian Bar Association’s immigration law section.

“To [move forward] without feeling they need to consult, [or] they need to have this debated or have input, that to me was striking.”

He says in addition to no external consultation, the agreement was made without conducting privacy and algorithmic impact assessments, despite its potential to affect millions of people.

“I think we can and must do much better at rolling out these technologies and legal processes in 2025. This is nowhere near international standards.”

Without these assessments, it’s difficult to say exactly what biometric and biographic data will be collected. According to a federal government website about the agreement, it includes things like date of birth, immigration status, and facial image. However, Bellissimo says words like ‘biographic’ and ‘biometric’ are broad enough to allow different interpretations, especially as technology advances.

Molly Reynolds, the privacy practice lead at Torys LLP, says concerns about vagueness have also come up in past iterations of cross-border information-sharing agreements.

“It is challenging when we see language like ‘biographic’ or ‘biometric’ data to always know what that means because the sources of that data change over time and are not necessarily transparent to the public,” she says.

In the past, for instance, the sharing of police records has resulted in Canadians being surprised to find themselves denied entry to the U.S. because of mental illness.

In response to a question from CBA National about the types of data that will be accessible under this agreement, IRCC spokesperson Isabelle Dubois said in a statement that “the Government of Canada is now authorized to query the United States using the biographic or biometric information of United States permanent residents who make an immigration application to Canada,” and vice versa. She provided a list of information countries are permitted to provide.

Nonetheless, while this new agreement represents an increase in scope in terms of who is subject to personal data sharing, mandatory data sharing is not new, Reynolds says. As part of the Beyond the Border security agreement, Canada and the U.S. began sharing biographic data, travel documents, and other information from Canadian and U.S. citizens crossing the border in 2019.  

“I don’t think it’s a completely unusual increase or anything other than a gradual expansion, similar to what we’ve seen so far.”

Others are waving a red flag. In 2019, Len Saunders, an immigration lawyer based in Blaine, Washington, raised concerns about the expansion.

“Now they’re sharing even more stuff,” he says. “It’s just like I said six years ago — it’s a slippery slope.”  

In this new agreement, Bellissimo says there’s the potential for further risks, as technology advancements in AI and other areas mean more accessible information. The agreement’s broad terms allow for that data to be gathered and shared in ways that may breach fundamental rights.

“The sky is the limit as to what will eventually be shared or be collected,” he says.

“The fear always is that individuals will end up in digital prisons where…they’ve been check-boxed or pigeonholed. Trying to undo the technological definition of [that] individual can potentially become insurmountable.”

IRCC’s Dubois insists that “automated immigration information sharing is undertaken in accordance with each country’s immigration and privacy laws. For Canada and the United States specifically, the agreement contains strict provisions for privacy, as well as for the use and retention of applicants’ information.”

Reynolds says the concern about this agreement is less about the specific data it gathers and more about how it was introduced. There needs to be room for public dialogue and regulatory oversight.

“This is a space where there’s so much uncertainty about what exactly is being shared and how the U.S. is using it. People want to know that the Canadian agencies have been doing this by the book and have been thoughtful about balancing all the interests,” she says.   

In the absence of that transparency, when new border measures roll out amidst fraught conversations about border security, it can incite fears about whether human rights and privacy are being overlooked.

While Bellissimo says it would be speculating to say whether the agreement is pandering to a new U.S. administration that’s fixated on border security, the timing of this agreement gives him pause. It’s come into force at the same time as other enhanced security measures, such as drones and Black Hawk helicopters patrolling the border — and may be seen as helpful as Canadian officials prepare for challenging discussions with their American counterparts.

Saunders, who has dual Canada-U.S. citizenship and works primarily with Canadian clients, says he believes this has the potential to be a sovereignty issue, especially given the rhetoric from the U.S. president.

“You’re now blurring the distinction between Canada and the U.S. when you’re sharing so much information,” he says.

“Where does it stop — what’s next?”