Protection of Passenger Information Regulations
SOR/2005-346
IMMIGRATION AND REFUGEE PROTECTION ACT
Registration 2005-11-21
Protection of Passenger Information Regulations
P.C. 2005-2038 2005-11-21
Whereas, pursuant to subsection 5(2)Footnote a of the Immigration and Refugee Protection ActFootnote b, the Minister of Public Safety and Emergency Preparedness caused a copy of the proposed Protection of Passenger Information Regulations, substantially in the form set out in the annexed Regulations, to be laid before each House of Parliament;
Return to footnote aS.C. 2004, c. 15, s. 70
Return to footnote bS.C. 2001, c. 27
Therefore, Her Excellency the Governor General in Council, on the recommendation of the Minister of Public Safety and Emergency Preparedness, pursuant to subsection 5(1) and section 150.1Footnote c of the Immigration and Refugee Protection Actb, hereby makes the annexed Protection of Passenger Information Regulations.
Return to footnote cS.C. 2004, c. 15, s. 72
Interpretation
1 The following definitions apply in these Regulations.
- Act
Act means the Immigration and Refugee Protection Act. (Loi)
- advance passenger information
advance passenger information means, in respect of a person, information referred to in paragraphs 269(1)(a) to (f) of the Immigration and Refugee Protection Regulations that is provided to an officer in respect of that person. (information préalable sur les voyageurs)
- Agency
Agency means the Canada Border Services Agency. (Agence)
- enforcement database
enforcement database means an Agency database that contains information in respect of persons who have been investigated under or have been the subject of an enforcement action under an Act of Parliament administered or enforced by the Agency. (base de données sur le contrôle d’application)
- intelligence official
intelligence official means an official who is employed by the Agency and is responsible for carrying out intelligence activities that relate to operations of the Agency conducted at an international airport in Canada or at the headquarters of the Agency for the purposes of the Act. (agent du renseignement)
- passenger name record information
passenger name record information means, in respect of a person, the passenger reservation information referred to in subsection 269(2) of the Immigration and Refugee Protection Regulations that is provided to an officer in respect of that person or in respect of which access is provided to an officer. (renseignements sur le dossier passager)
- PAXIS system
PAXIS system means the Passenger Information System of the Agency. (système SIPAX)
API and PNR Information
2 The Agency shall not, for the purposes of the Act, retain, provide access to or disclose advance passenger information (referred to in these Regulations as “API information”) or passenger name record information (referred to in these Regulations as “PNR information”) other than in accordance with these Regulations.
Retention and Access
3 API information and PNR information may be retained by the Agency for the purpose of identifying persons who are or may be involved with or connected to terrorism or terrorism-related crimes or other serious crimes, including organized crime, that are transnational in nature.
4 API information and PNR information retained for the purpose referred to in section 3 must be stored in the PAXIS system and must be stored there separately from each other.
5 (1) API information may be retained in the PAXIS system for a maximum period of three years and six months after it is received and access to the information may be provided during that period to
(a) intelligence officials, if they require the information
(i) for the purpose referred to in section 3, or
(ii) for the purposes of conducting trend analysis or developing future risk indicators in relation to the purpose referred to in section 3; and
(b) officials employed by the Agency who are responsible for selecting persons for enhanced questioning on their arrival with a view to identifying persons described in section 3.
(2) Access to API information may not be used by an intelligence official to gain access to PNR information about the same person
(a) during the first two years of the period of three years and six months referred to in subsection (1), unless the intelligence official confirms that such access is necessary in order to proceed with an investigation for the purpose referred to in section 3; and
(b) during the period of one year and six months after the two-year period referred to in paragraph (a), unless such access by the intelligence official for that purpose is approved by the President of the Agency.
6 PNR information may be retained in the PAXIS system for a maximum period of three years and six months after it is received, during which period access to the information must be restricted in accordance with section 7.
7 (1) Access to PNR information that is stored in the PAXIS system may be provided during the first 72 hours of the period of two years after it is received to
(a) intelligence officials, if they require that information for the purpose referred to in section 3; and
(b) officials employed by the Agency who are responsible for selecting persons for enhanced questioning on their arrival with a view to identifying persons described in section 3.
(2) During the portion of the two-year period referred to in subsection (1) that is after the first 72 hours,
(a) access to the name of the person to whom the PNR information relates may be provided to an intelligence official if the official confirms that they require the name in order to proceed with an investigation for the purpose referred to in section 3; and
(b) access to the PNR information in respect of that person, other than their name, may be provided to an intelligence official for the purposes of conducting trend analysis or developing future risk indicators in relation to the purpose referred to in section 3.
(3) If access to the name of the person to whom the PNR information relates is provided to an intelligence official in the circumstances referred to in paragraph (2)(a), any of the PNR information in respect of that person, including their name, that may be required for the investigation referred to in that paragraph may then be copied from the PAXIS system, in which case the copy must be retained in an enforcement database in accordance with section 8.
(4) During the period of one year and six months following the two-year period referred to in subsection (1),
(a) access to the data elements contained in the PNR information that could serve to identify the person to whom the information relates may be provided to an intelligence official for the purpose referred to in section 3 if such access is approved by the President of the Agency; and
(b) access to the PNR information, other than the data elements referred to in paragraph (a), may be provided to an intelligence official for the purposes of conducting trend analysis or developing future risk indicators in relation to the purpose referred to in section 3.
(5) If access to the data elements contained in the PNR information is provided to an intelligence official in the circumstances referred to in paragraph (4)(a), any of those data elements that may be required for the purpose referred to in that paragraph may then be copied from the PAXIS system, in which case the copy must be retained in an enforcement database in accordance with section 8.
8 (1) Subject to subsection (2), where PNR information is copied from the PAXIS system and the copy retained in an enforcement database in the circumstances described in subsection 7(3) or (5), as applicable,
(a) the information may be retained in the enforcement database for not longer than the time that it continues to be required for the purpose for which it was copied, up to a maximum period of six years after the time it was first received; and
(b) during that period, access to the information may be provided only to intelligence officials whose duties require such access for the purpose referred to in section 3.
(2) Where API information or PNR information is required, by the Access to Information Act or the Privacy Act, to be retained in an enforcement database for a period longer than the six-year period referred to in paragraph (1)(a), access to that information may be provided during that longer period only for the purpose for which it is retained under the Access to Information Act or the Privacy Act, as applicable.
Disclosure to Canadian Government Departments
9 API information and PNR information retained by the Agency in the PAXIS system may be disclosed by the Agency to any Canadian government department for the purposes of the Act if
(a) an official of the Agency has determined that the information
(i) relates to terrorism or crimes referred to in section 3, or
(ii) relates to an objective set out in section 3 of the Act and is required
(A) in order to comply with a subpoena or warrant issued by, or an order made by, a court, person or body with jurisdiction in Canada to compel the production of the information, or
(B) for the purposes of any judicial proceedings in Canada;
(b) that department has undertaken to provide the information with the same type of protection as that provided by the Agency and not to further disclose the information without the permission of the Agency, unless required by law to do so; and
(c) only the data elements contained in the information that are necessary for the purpose for which it is being disclosed are provided.
Disclosure to Governments of Foreign States
10 (1) In this section, adequacy finding means a decision adopted by the European Commission pursuant to Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and the free movement of such data.
(2) API information and PNR information retained by the Agency in the PAXIS system may be disclosed to the government of a foreign state for the purpose referred to in section 3 if
(a) the foreign state is a member of the European Union or that government has received an adequacy finding or is covered by one; and
(b) the Agency discloses to that government only the minimum data elements contained in the information that are necessary for that purpose.
11 API information and PNR information retained by the Agency in an enforcement database may be disclosed on request to the government of a foreign state under an international agreement or arrangement if
(a) the Agency is in possession of evidence that directly links the request to the investigation or prevention of terrorism or crimes referred to in section 3;
(b) that government undertakes to provide the information with the same type of protection as that provided by the Agency; and
(c) only those data elements contained in the information that are necessary for the purpose for which the information is requested are disclosed.
Coming into Force
12 These Regulations come into force on the day on which they are registered.
- Date modified: