A watchdog has given Canada's overseas eavesdropping agency a good report card, but has hinted that the secretive organization may occasionally push the boundaries when it comes to collecting information on Canadians.

Communications Security Establishment Canada collects foreign intelligence for Ottawa, but is not allowed to spy on Canadians, whether they’re living at home or abroad.

But an annual report by CSEC commissioner Robert Decary suggests the agency "may use information about Canadians" when seeking new sources of foreign intelligence.

Decary says CSEC only pursues such methods "when other means have been exhausted" and when it believes they are likely to turn up new sources of information.

"CSEC conducts these activities infrequently, but they can be a valuable tool in meeting Government of Canada intelligence priorities," Decary writes in his latest report, which was released last week.

The agency does not need ministerial permission to engage in these activities "because they do not involve interception of private communications," though Decary says CSEC is guided by ministerial directives.

While Decary did not provide further details on these methods, he says CSEC follows the rules closely when carrying out its activities and takes "satisfactory measures to protect the privacy of Canadians."

CTV's Mercedes Stephenson said it is possible that CSEC comes into peripheral contact with Canadians' data when it looks at general trends in communication.

"They may be looking at larger patterns, or metadata trends," Stephenson told CTV News Channel from Ottawa on Friday morning.

"And sometimes in that large cyberspace dragnet that they're looking into, there may be cases where Canadian data gets pulled into that."

Metadata is the electronic signature that accompanies the text sent in emails, and can be used to determine when, where and by whom the message was created.

But Stephenson said the CSEC commissioner makes clear in his report that the agency is not doing anything illegal in its daily operations.

"Nobody has had their privacy violated…and they are not deliberately targeting Canadians, which they are not allowed to do," Stephenson said.