OTTAWA—The national intelligence watchdog says Canada’s cyberspy agency may have broken the law in disclosing personal information about Canadians. The Ottawa-based Communications Security Establishment, given its foreign-intelligence mandate, suppresses details that identify Canadians, or even people in Canada, in its reports. Such identifying information ranges from names of people to email addresses and computer IP addresses. However, other federal agencies and foreign partners who receive these reports can ask for details of the information if they have legal authority and proper justification. The National Security and Intelligence Review Agency looked at 2,351 disclosures of information about Canadians over a five-year period and found that more than one-quarter of them were not sufficiently justified. During the review period, the CSE approved 99 percent of such requests from domestic clients, says an unclassified version of the findings made public Friday. The CSE also released additional personal information to clients beyond what was …