The Gun (Transfer) Registry is Here; This is What You Need to Know.

At midnight on May 18th, the regulations imposed by Bill C-71 on the transfer of firearms came into effect. That means every gun transfer, including non-restricted transfers, must now be registered with the government - in a fashion. But there's been a lot of misinformation circulating around these regulations, and very little effort put towards adequately informing consumers (and businesses) as to what these changes mean. So here's what you really need to know about this latest regulatory change.

Death by Acronym

First, update your email. The majority of transfers will be put through the RCMP's web services portal, and if you either haven't registered an email through the Individual Web Services portal or are using a deprecated email you cannot access, you may not be able to receive incoming transfers or register outgoing transfers. The process is relatively painless, and most users will find themselves prompted to update or confirm their email immediately upon logging into the updated CFISIWS (Canadian Firearm Information System Individual Web Service - we think). And no, we don't know what people without email addresses are expected to do - and neither does anyone else, it seems.

From there, individuals can scroll to the bottom, and select "Verify Buyer's License" to begin the process of obtaining a transfer number. The first prompt inquires as to whether or not the transferee (buyer) is a business or individual, with corresponding subsequent forms to be filled out and filed to obtain the transfer number.

Note that individual-to-individual transfers do not require any information be provided on the firearm being sold. C-71 quite specifically does not require individuals to register the gun, but rather just the transfer.

This is in contrast with the retailer-dictating portion of C-71, which requires all transfers emanating from a Business Firearms License include the make, model, serial, and type of firearms being transferred, as well as the transferee's license number, and the transfer number used to accomplish a sale. Furthermore, C-71 requires retailers keep these records for 20 years.

What People Aren't Talking About

When news broke that these registration components of C-71 would be coming-into-force in mere days, firearms sales took off. Hot on the heels of useless gun bans locking away millions of firearms needlessly for the past two years (and the foreseeable future), licensed gun owners have been obviously reticent to provide the authorities any more information than absolutely required about their possessions, and so many used the (short) advance notice provided to buy guns before these registries were put in place.

And many in the firearms industry used that same short notice to sell; urging customers to purchase firearms before the 18th deadline. However, in the ensuing frenzy, misinformation and outright disinformation were propagated throughout the Canadian gun community. Discussions turned to transfer licenses and all manner of misunderstandings about the information being collected, where it was being kept, and how it could be misused. Here is the reality:

1. Individual-to-individual transfers can be done 24/7 via the online portal and will not require any information on the gun.
2. Retailers who sell a firearm must keep, for 20 years, a record of the firearm's serial, make, model, and type (rifle, shotgun, etc), the buyer's license number, and the transfer number obtained from the RCMP to complete the sale, and the date of the transfer.
3. Those records will be kept by the retailer. These records are not submitted, nor retained by any authority; not the CFO, not the RCMP, not Public Safety. Yes, they can be demanded by police, who will not necessarily require a warrant to obtain them - but to make a long story short, they can only do so in the course of an investigation, and even then, the records required to be remitted are limited to those collected: Gun make, model, serial, and type, the buyer's license number, and transfer number/date. Retailers are not obliged to provide any additional transfer details (unless determined to be incumbent to an investigation).

So, it's not as bad as you might have been led to believe, but as any Canadian has surely learned after seven years of Liberal governments, worse is always possible...

Potential Issues

While these new regulations do constitute a registry of sorts, it is patently not the same as the defunct Long Gun Registry, which was intended to provide police with a constant and reliable way of knowing what guns all license holders owned in real-time (it didn't). It's most a transactional registry as far as the government is concerned; they'll know who is buying and selling guns, but not what guns they currently possess. That obviously opens the door up to future regulation in the form of purchase limits around quantities, but there has been no such law or policy introduced as yet.

The second, and much larger issue these regulations raise pertains to the security of very sensitive private information - your information. Government officials were eager to point out that most gun stores use a Client Management System, or CMS, in support of their sales operations, and that most CMS systems already collect buyer data in the form of emails, names, and other relevant contact information often used by retailers to support everything from sales newsletters to warranty support. However, conjoining the C-71-imposed regulation requirements with any sort of information that would allow someone to identify you poses a massive security risk.

I specifically raised this issue to the Standing Committee on Public Safety in the Senate; these records are likely only protected by provincial privacy statutes which means in the province of BC, for example, the maximum penalty for stealing or these records is a $10,000 fine. Given the value of a handgun on the black market in Canada hit $7,000 during COVID, that penalty is woefully small, given the potentially devastating results of a CMS system with identifiable customer records and C-71's gun registry components getting stolen or screenshotted by an ill-meaning employee. Such a record would effectively form a criminal break-and-enter shopping list, and if retailers do not take appropriate precautions to maintain the C-71 records' anonymity, your address could end up on just such a list.

WTF?! How can I protect myself?

As with anything in life, it does eventually come down to caveat emptor, and each consumer will have different levels of risk they are willing to accept. However, in the absence of any sort of comprehensive best practices document having been produced, we suggest retailers take the following steps to protect their customers, which when followed should ensure consumers are as safe today as they were before the 18th:

1. Limit the staff who have access to the records required by C-71. The regulations do not specify how these records must be kept or maintained, and so we strongly suggest retailers keep these records in a manner that allows access to be very strictly controlled and monitored, and completely divorced from any records that would allow a customer to be publicly identified.
2. If possible, keep as many of the records as possible off-site. This could take the form of a daily upload to a secure cloud service (if they're secure enough for banks, they're secure enough for us), or literal pages from a ledger moved to a secure drop box off-site or safety deposit box.
3. Retain either a firearms- or privacy-specific lawyer to confront any demand for these records to be produced, to safeguard customers from erroneous police enquiries. Eventually, the industry should aspire to have a handful of specialist lawyers on a communal retainer, to protect all gun shops and their customers.

None of this is accidental

The onerousness of this legislation and the potential security risks it poses are not bugs; they're features. And I can say that unequivocally because I quite literally warned the government about exactly these security issues. When asked to testify on C-71 at the senate, I made these privacy concerns the entirety of my focus; asking the Senators to amend the legislation so as to provide security or direction on the record-keeping and maintenance to keep gun owners safe.

They did not.

So, why did the government enact legislation it knew could make gun owners targets for criminal theft? The answer is assuredly a Cabinet Confidence secret, but the reasons range from plain old negligence to far more nefarious theories that will strike many as slightly tinfoil-adorned. But then again, we were also told there'd never be a gun registry again, and yet here were are.

For anyone looking for information on Bill C-71, please consult this official legislative summary; it is the absolute best plain(ish)-English analysis of the bill.