New federal requirements in the works for potentially intrusive software

A more robust federal directive requiring departments to measure the privacy impact of new technologies will be ready this summer, says Treasury Board President Anita Anand.

However, for now the federal government is not committing to making it a binding legal obligation, as many are calling for.

Anand was appearing Thursday before a parliamentary committee looking into the federal government's use of tools capable of extracting data from mobile phones and computers.

«Yes, there is a problem,» acknowledged Anand before the standing committee on access to information, privacy and ethics.

«That is why the directive is being updated.»

The directive in question requires all federal institutions carry out a privacy impact assessment prior to any new program or activity that involves the collection or handling of personal information.

Anand's testimony comes in the wake of a Radio-Canada story last November that revealed that several departments and agencies had not carried out such assessments before using data extraction tools.

These instruments can unlock mobile phones and computers, even when protected by passwords or fingerprints, and access all data, including information that has been encrypted. This can include emails, texts, contacts, photos and travel history.

Many departments say they use these tools as part of investigations after obtaining a warrant. Others also use them without a warrant for internal investigations when employees are suspected of wrongdoing.

Some departments explained earlier before the same parliamentary committee that they didn't feel it was necessary to conduct a privacy impact assessment on the data extraction tools because they had already done such an assessment for their entire investigative