Work Plan – Reviews Under Way and Planned

The Commissioner uses a risk-based and preventive approach to reviews, setting priorities of what to review where risk is assessed as greatest for potential non-compliance with the law and risk to the privacy of Canadians. A three-year work plan is updated twice a year. Developing the work plan draws on many sources, including: regular briefings from CSE on new activities and changes to existing activities; the classified annual report to the Minister from the Chief of CSE on priorities and legal, policy, operational and management issues of significance; and issues raised in past or on-going reviews. To learn more about the Commissioner's risk-based and preventive approach to reviews, follow this link.

Four reviews carrying over from 2016–2017 will be completed in 2017–2018: a review of a particular method of collecting foreign signals intelligence conducted under a ministerial authorization and a ministerial directive; a review focused on CSE targeting activities; a separate review started in 2016–2017 that derived from the concluded review of CSE sharing of information with foreign entities; the annual review of disclosures of Canadian identity information to Government of Canada clients, Second Party partners and non-Five Eyes recipients.

A follow-up review will be conducted on CSE assistance to the Canadian Security Intelligence Service (CSIS) under part (c) of CSE's mandate and sections 12 and 21 of the CSIS Act (formerly called Domestic Intercept of Foreign Telecommunications and Search warrants); this was planned to start last year but was displaced in priority due to the unplanned review referred to above. Another follow-up review of CSE support to CSIS under part (c) of CSE's mandate regarding a certain type of reporting involving Canadians will also be conducted. A study on CSE's use of social media for intelligence sharing will also be undertaken in the new year.

The Commissioner will continue to conduct annual reviews of:

• foreign signals intelligence and cyber defence ministerial authorizations, including spot check reviews of one-end Canadian communications acquired and recognized by CSE;
• CSE disclosures of Canadian identity information; and
• privacy incidents and procedural errors identified by CSE and the measures subsequently taken by CSE to address them.