Work Plan – Reviews Under Way and Planned

The Commissioner uses a risk-based and preventive approach to reviews, setting priorities of what to review where risk is assessed as greatest for potential non-compliance with the law or as a potential threat to the privacy of Canadians. A three-year work plan is updated twice a year. Developing the work plan draws on many sources, including: regular briefings from CSE on new activities and changes to existing activities; the classified annual report to the Minister from the Chief of CSE on priorities and legal, policy, operational and management issues of significance; and issues raised in past or ongoing reviews. To learn more about the Commissioner's risk-based and preventive approach to reviews, please visit the office's website.

Once Bill C-59 is in effect, the Commissioner's office's ongoing reviews will be transferred to the National Security and Intelligence Review Agency for completion. However, the office expects that the four reviews that are carried over from 2017–2018 will be completed in 2018–2019. These are: a review of a particular method of collecting foreign signals intelligence conducted under a ministerial authorization and a ministerial directive; a review of CSE targeting activities; a review of CSE assistance to the Canadian Security Intelligence Service (CSIS) under part (c) of CSE's mandate and sections 12 and 21 of the CSIS Act (formerly, this type of CSE assistance was executed under what was called Domestic Intercept of Foreign Telecommunications and Search warrants); and a separate review that derived from the concluded 2016–2017 review of CSE disclosures of Canadian identity information.

A follow-up review will also be conducted on CSE support to CSIS under part (c) of CSE's mandate regarding a certain type of reporting involving Canadians.

The Commissioner will continue to conduct annual reviews of:

• foreign signals intelligence and cyber defence ministerial authorizations, including spot check reviews of one-end Canadian communications acquired and recognized by CSE;
• CSE disclosures of Canadian identity information; and
• privacy incidents and procedural errors identified by CSE and the measures subsequently taken by CSE to address them.