The privacy commissioner is also taking the Canada Border Services Agency to task for leaving profiles of listed people on the Internet too long and failing to assess the privacy implications of the program in advance.
The commissioner found the overall thrust of the "Wanted by the CBSA" program — since expanded by the border agency — is consistent with the agency's responsibility to enforce immigration and refugee law by removing people who shouldn't be in Canada, and therefore permissible under the Privacy Act.
But the watchdog makes several recommendations for bringing the program fully in line with the privacy law — all of which the border agency has agreed to act on.
The border agency initiated the program in July 2011 by posting on its website a list of 30 people described as being "accused of, or complicit in, war crimes or crimes against humanity."
A press release was headlined: "Government will not tolerate war criminals in our communities."
The Canadian Council for Refugees complained to the privacy commissioner later that year on behalf of Abraham Bahaty Bayavuge, a Congolese man who says he was merely a civil servant in his homeland and did nothing wrong.
The listing included his photograph, name, alias, gender, date and place of birth, last known address and identifying features.
In her letter of finding sent to the council last week, then-assistant privacy commissioner Chantal Bernier partially upheld the complaint, saying the border agency's references to "war crimes" or "war criminals" were "potentially misleading and not adequately justified by the CBSA."
She pointed out that Bayavuge and others on the list were denied admission to Canada because they had worked for governments involved in war crimes or gross human rights violations. But the Canadian government's language might lead the public to conclude Bayavuge had been convicted of war crimes in a criminal court, which was not the case, she said.
Bernier, now interim privacy commissioner, found the border agency's wording to be a violation of a Privacy Act provision requiring government institutions to ensure the personal information they use is as accurate and complete as possible — particularly given the "potentially severe consequences" of such disclosure for people on the "wanted" list.
Lawyer Pia Zambelli, who serves on the refugee council's legal affairs committee, welcomed the privacy watchdog's finding that the border agency unfairly tagged many people as war criminals.
"It was a gross exaggeration, and sort of sensationalist in a way," Zambelli said in an interview. "They were trying to make these people out to be hardened criminals, and that's just not consistent with what the evidence actually was in their cases in many instances."
The council cites a recent Supreme Court decision that effectively makes it tougher to exclude someone from Canada simply because they worked for a regime that committed abuses — meaning some who appeared on the initial "wanted" list might today be accepted as refugees.
In her finding, Bernier also questioned the need to keep Bayavuge's personal information online for at least six months after he was apprehended, and took exception to the fact his full date of birth and identifying features were left on the site for any length of time after his arrest.
The border agency told the watchdog it now deletes profiles from its website within 30 days of a wanted person's apprehension, and it has agreed to revisit the amount of personal information disclosed — or at least provide justification for releasing it.
The border agency also acknowledges the need for a privacy impact assessment of the "wanted" program after the commissioner's office said it was "deeply concerned" about the agency's failure to use the standard policy tool.
Also on HuffPost