Bill C-12 (Historical)

Safeguarding Canadians' Personal Information Act

An Act to amend the Personal Information Protection and Electronic Documents Act

This enactment amends the Personal Information Protection and Electronic Documents Act to, among other things,
(a) exclude, in certain circumstances, business contact information from the application of Part 1 of that Act;
(b) specify the elements of valid consent for the collection, use or disclosure of personal information;
(c) permit the disclosure of personal information without the knowledge or consent of the individual for the purposes of
(i) identifying an injured, ill or deceased individual and communicating with their next of kin,
(ii) performing police services,
(iii) preventing, detecting or suppressing fraud, or
(iv) protecting victims of financial abuse;
(d) clarify the meaning of lawful authority for the purpose of disclosures to government institutions of personal information without the knowledge or consent of the individual;
(e) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of the individual, personal information
(i) contained in witness statements related to insurance claims, or
(ii) produced by the individual in the course of their employment, business or profession;
(f) permit organizations, for certain purposes, to use and disclose, without the knowledge or consent of the individual, personal information related to prospective or completed business transactions;
(g) permit federal works, undertakings and businesses to collect, use and disclose personal information without the knowledge or consent of the individual to establish, manage or terminate employment relationships;
(h) provide a framework for organizations to notify individuals proactively about disclosures of their personal information made in certain circumstances to government institutions; and
(i) require organizations to report material breaches of security safeguards to the Privacy Commissioner and to notify certain individuals and organizations of breaches that create a real risk of significant harm.

[Bruce Hyer, Green, Thunder Bay—Superior North, ON]

This amendment reverts back to the proposed language for notifying the Privacy Commissioner about security breaches, which is found in the previous PIPEDA reform bills C-12 and C-29, but it is stronger and clearer. Why? It creates a mandatory security breach disclosure requirement at the federal level, and that is long overdue. Geist at the Senate said that Bill S-4 establishes the same standard of “a real risk of significant harm” for both notifying the commissioner and the individuals, but also said this is very puzzling. It means that there is no notification for systemic security problems within an organization. This is very likely to result in significant under-reporting of breaches. Our amendment creates incentives for organizations to better protect that information and allows Canadians to take action to avoid risks including identity theft.

[Philippa Lawson]

I agree, and I like the section for that reason. It provides the clarification that the industry needs. However, the point I'm making is that those additional words that are not in the formulation from Bill C-12 actually restrict the application of this. They do not expand it; they restrict it. The earlier formulation was that consent is only valid if it's reasonable to expect that the individual understands it. That means that it has to be reasonable to expect that the individual in question in that particular transaction understands it. So the earlier formulation covers everyone. If it's a child, if it's a senior, whoever it is, that individual needs to be able to understand it.

The new formulation restricts it. The new formulation says that you only have to worry about individuals to whom you are directing your activities, and it's very easy for an organization to say, “We are directing our activities to adults, not to children.”

[Dr. Michael Geist]

I think that if every time a USB key went missing, there were requirements to disclose, then yes, you would find that organizations would be spending a lot of time disclosing. However, if we look back at the Bill C-12 and Bill C-29 standard, that's not the standard we talked about. It set a material breach as the standard.

You can debate whether or not that's the appropriate standard, but at a minimum it gets us at a number of breaches that this law will not. Moreover, it does so in a way that I think was good for companies too, because rather than companies being faced with this either/or of going to the expense and potential embarrassment of simply disclosing or not, it said as an intermediary step, let's discuss this on a confidential basis with the Privacy Commissioner's office and determine whether or not it warrants that broader disclosure.

Frankly, that was a good thing for organizations to potentially avoid having to make those broader disclosures, in some circumstances, and it provided the comfort of ensuring that users knew that, at a minimum, we had an advocate, the Privacy Commissioner, who was going to be made aware of these circumstances.

It's puzzling to me why this was removed in favour of a process that, frankly, does less to protect Canadians and, ultimately, actually can create larger costs for companies as well.

[Dr. Michael Geist]

Sure. I'll do that. I'd also like to just note a couple of things. The commissioner did not appear before the Senate committee on Bill S-4. Because of the long delays in getting a commissioner appointed at that time, there was no commissioner, but people from that office were in a position to appear because it had been studied. So the commissioner actually didn't appear on Bill S-4.

In terms of lengthy study, with respect, let's be clear. The committee began a review of this bill in November 2006, and by May of 2007 it released its report.

We got first reading of Bill C-29 in May 2010. A second reading took until October. There were never any hearings held on Bill C-29.

The next bill that was introduced was Bill C-12, which was the second attempt at this bill. It sat at second reading for two years without moving forward. There were no committee hearings held on it.

We finally now have Bill S-4, on which there were two sets of hearings. Four days were allocated to this piece of legislation within the Senate: one day for the minister to appear; another day for clause-by-clause; two days for hearings. So if we're going to talk to witnesses about not having appeared, frankly, there were very, very few witnesses who had the opportunity to appear at all. This is, with all respect, not a well-studied bill. It is a bill that has now come through three times, and in most instances there has been no study whatsoever. When the Senate had the chance to hear on this bill, there was not even a privacy commissioner in place to deal with it, due to the long delay in finding a new commissioner to replace Commissioner Stoddart and later acting commissioner Chantal Bernier.

With respect to the commissioner's support, yes, I too can cherry-pick particular comments from the Privacy Commissioner about where the commissioner supports the legislation, but I can also note that the commissioner's office has been consistent in saying that it finds it problematic with respect to voluntary disclosure, and yet that hasn't changed, and in identifying a number of other improvements.

So the question is this. Is this a well-studied bill that we ought to get on with? With respect, it is both not well studied and ought to be fixed. Canadians deserve better.

[Dr. Michael Geist]

My concern with the security breach disclosure provisions, which I think quite clearly are long overdue—we've been passed by by so many other countries and jurisdictions on this—is frankly that we had it better in the earlier iterations of this bill, in Bill C-12 and Bill C-29, which, as I'm sure you know, created a two-step process.

The first step is notification to the Privacy Commissioner of a material breach, and that, of course, didn't include the necessity of the real risk of significant harm. It was more a matter of the breach itself.

Then you get into the secondary question of under what circumstances you go down the much more challenging avenue of having to disclose this breach to everyone who's affected, recognizing that there may be circumstances in which that's appropriate and others in which it's not.

What we've done here, by removing that and creating a higher threshold for all disclosures, I think means that systemic breaches don't get disclosed. It means that, many times, important material breaches simply don't get disclosed, and organizations that have underlying problems don't have to fess up at all.

I think we recognize that in some circumstances we have the incentives for organizations not to disclose because of the costs and the embarrassment factor. We also want to ensure that we don't have so many disclosures that consumers are receiving notifications on a daily basis, and they simply tune all of that out.

There is a balance to be struck, but I think we did a much better job, the government did a much better job, of striking that balance, particularly for things like systemic breaches within an organization, by saying, “Surely that's the sort of thing that we would want the Privacy Commissioner's office to know about”, and yet we've effectively removed that in this bill. It's hard to understand why.

[Philippa Lawson]

Thank you very much.

Good morning, committee members. Thank you for the opportunity to address you on the matter of Bill S-4, which proposes amendments to PIPEDA.

My involvement with this legislation goes back to its genesis with the CSA model privacy code and the subsequent initiatives to legislate voluntary standards. As a lawyer with the Public Interest Advocacy Centre at the time, I was a public interest representative on the committee that drafted the code. I later advocated for legislation that eventually took the form of PIPEDA.

I have been closely involved with PIPEDA ever since, first in my role as a consumer advocate with PIAC and later as director of CIPPIC, both of whom I understand you have already heard from. In particular, I have conducted studies of private sector compliance with PIPEDA. I have lodged a number of PIPEDA complaints with the Privacy Commissioner. I have taken the Privacy Commissioner to court in order to establish that she had jurisdiction to enforce PIPEDA against foreign corporations acting in Canada. I published a study of security breach notification laws in 2007. I've been urging the government to adopt mandatory security breach notification laws since 2003.

Today I am speaking on my own behalf as a lawyer and privacy advocate. The last formal submissions I made on PIPEDA reform were in 2008 in my role as director of CIPPIC. Those submissions focused on three issues: security breach notification, protection of minors, and compliance and enforcement. The analysis and proposals made in those comments remain apt today, and I would be happy to provide copies of that submission to anyone who is interested.

I'm happy to see that the government has seen fit to address all three of these issues in Bill S-4, but I am disappointed that the measures in each case fall far short of what is needed. I will address each of these three topics briefly, but before doing so I would like to address an elephant in the room. That elephant is consent.

There is a pretense that companies are obtaining informed consent from customers to the collection, use, and sharing of their personal data. But anyone who takes the time to study what is actually going on will quickly see that this is, to a large extent, a fiction and that meaningful consent is rarely obtained from consumers.

Negative option consent is commonly used but rarely brought to the attention of customers. Consent is in fact often assumed simply by virtue of use of the service. Changes to privacy policies are simply posted on the company website and customers are expected to inform themselves. No one really expects individuals to read through lengthy, complex terms of service for every transaction. People simply don't have the time. If they do take the time to read the terms, they may find that they are notionally consenting to have their personal data used for purposes such as—and I'm quoting here from privacy policies that I've looked at—research, marketing, product development, and business purposes. In further violation of PIPEDA, many companies are refusing to deal with customers who won't agree to unnecessary uses of their personal data, such as marketing.

A reality check is needed on what is happening in the marketplace with so-called customer consent. In the meantime, proposed section 6.1 is a helpful qualification on what the law already requires. It may have some positive effect on what is, in my respectful submission, a widespread disgrace.

However, the current wording of proposed section 6.1 could actually have a perverse effect on the protection of children or seniors. If you read the clause, you will see that it fails to protect vulnerable populations to whom an organization's activities are not directed. All that a company needs to do to exploit children is to direct its activities to adults and then turn a blind eye to the fact that children are signing up. A simple fix is to revert to the earlier wording of this clause found in Bill C-12. However, if if the aim is to protect children, a much more effective approach is simply to prohibit certain uses of personal data about children.

I have a few words on breach notification. This is long overdue, and it will certainly be an improvement on the current situation. But are the proposed rules going to be effective? Breach notification is about more than notifying individuals. An equally important goal is to create incentives for organizations to put in place strong security safeguards.

In order to create such incentives, there needs to be a real risk of significant financial harm to a corporation from failing to put in place adequate security measures. This is the test you should be applying to your assessment of the proposed breach notification regime: is there a real risk of significant financial harm to corporations from non-compliance?

I am not convinced there is. Fines apply only to failure to report or failure to keep records and require cumbersome proceedings and proof of intent. Civil lawsuits are too costly to make sense in most cases, and the Privacy Commissioner may be dissuaded from using publicity for this purpose as a result of subsection 20(1.1), which prohibits disclosure of breach notification reports. I do not understand that section.

Until there are real financial incentives for corporations to take appropriate measures to prevent breaches from happening in the first place, and to otherwise comply with privacy laws, non-compliance with PIPEDA will continue to be a cost of doing business in Canada.

I'd like to finish with a few comments on private investigations. I am very concerned that, if the proposed changes to the current investigative body regime exception go through, this bill will actually set back privacy protection in Canada.

I will not repeat the able submissions of my colleague Dr. Geist on this subject, but let me just point out that in the new world of cheap data storage and powerful data analytics, the only limits on how far companies will go in their efforts to detect fraud, criticism, or contractual breaches will be what you put in this law. With today’s technology, it’s less costly to gather more data and to apply analytical tools to a large database than it is to restrict the intake of data to that needed in the first place.

In this context, insurance companies and other companies will, no doubt, argue that it's reasonable for them to conduct what amounts to broad and deep surveillance of their customers in order to detect fraud.

Paragraph 7(3)(d.2) would allow just that. It requires no formal investigation. The disclosure just needs to be reasonable, not even necessary as in the previous formulation in Bill C-12. This provision would open the door to routine sharing of personal data among organizations based on nothing more than the always present risk of fraud. Moreover, there would be no transparency or accountability requirements. It would be a major setback for consumer privacy.

I understand that this amendment was based on the Alberta model, but I looked at the Alberta model, and subsection 20(n) of the Alberta statute is not as permissive as this. It actually limits sharing to certain kinds of organizations.

I urge you to remove these clauses from the bill and stick with the current investigative body regime. I also urge you to adopt the transparency measures that my colleague Dr. Geist recommended.

Thank you very much.

[John Lawford]

We are proposing today a hybrid model, one that looks a lot like what was in Bill C-12. In order for it to be two steps, you would have to have a reporting of material breaches of security safeguards, as it was worded in that bill, that affect personal information, as a first step, only to the Privacy Commissioner. Then, as in Alberta, it's better to leave the decision about whether to notify individuals with an impartial third party, the Privacy Commissioner, rather than again leaving it up to the company, which is what this bill.... It places a lot of responsibility on companies, actually. If they make a call badly, it's just preferable to leave it in the hands of an impartial third party.

That would be what we propose, that two-step approach.

[John Lawford]

I would disagree. I think that Bill C-12 which was previously there, had made the effort to set a bar for material breach reporting to OPC, which was based on the seriousness of the information lost and the number of people affected. Again, it also threw in this business about systemic problems, which I think is complicating things. That would mean that the number of material breaches reported to the Privacy Commissioner would not be overwhelmingly burdensome because it would be larger breaches affecting people in a serious way.

[John Lawford, Executive Director and General Counsel, Public Interest Advocacy Centre]

Thank you very much, Mr. Chair.

Honourable members, my name is John Lawford. I'm the executive director and general counsel of the Public Interest Advocacy Centre, a national non-profit, federally incorporated organization founded in 1976 that provides legal and research services on behalf of consumer interests, and in particular, vulnerable consumer interests.

Due to the time I'm going to be speaking today solely to the breach notification amendments. However, I'll be happy to take questions on other aspects of the bill.

PIAC believes that the goal of an effective data breach notification law is to actually notify individuals of the loss, unauthorized access, or theft of their personal information from an organization whenever it is possible for the individual to take steps to avoid financial, reputational, or other harms, or to minimize these impacts. In our view this goal can be accomplished in a manner that also removes conflicts of interest in reporting breaches; reduces compliance cost and risk for business, in particular small business; generates data for better policy outcomes; engages, improves, and leverages the expertise of the Office of the Privacy Commissioner, OPC, in dealing with breaches; and encourages business and consumers to make investments in data security.

Unfortunately, Bill S-4, as written, will very likely result in fewer reported breaches than even now and operate in an opposite manner. Namely, it will create a culture of fear, recrimination, and non-reporting. Bill S-4, incentivizes not reporting data breaches by leaving the determination of whether a breach creates a real risk of significant harm to an individual totally in the hands of the organization that suffers the breach. This obvious conflict of interest is fatal to the purpose of the bill as there is no advantage to a company to report and every advantage to hide a data breach.

The conflict of interest in having a company assess whether an individual faces a real risk of significant harm from a data breach is one that will be settled in close cases and some more egregious ones by the company concluding there is no such risk. Such an assessment avoids the cost, reputational damage, and inconvenience faced by the company. It also avoids putting the company on the radar of the OPC for an audit or an investigation.

While it's true the company does face prosecution under the amended section 28 of PIPEDA and a possible fine up to $100,000, perhaps even per record, that offence is premised on not reporting a breach knowingly. Any organization that sets up even the most basic process to come to a conclusion that a breach was not a real risk of significant harm would have a very strong defence. This flaw is exacerbated by the bill's requirement to report all breaches regarding a real risk of significant harm simultaneously and relatively instantly to the OPC, whose role is purely observational, to affected individuals and to unspecified third parties who may be able to help. Which individuals to notify will be determined solely by the company involved, which will be dealing with the chaos of several reporting requirements that frankly make little sense as structured. The incentive again will be to keep the reporting to individuals to as few in number as possible. Contrast this with our vision of how Bill S-4 could work.

Step one, replace the initial reporting to all parties on the real risk of serious harm test for the requirement to immediately report material security breaches involving personal information to the OPC only. In Bill C-12 of the previous parliament, in that version, proposed section 10.1, did this very well with one exception. We would recommend removal of the systemic problem assessment, which the bill required and which also led to the disincenting of reporting.

Step two, leave the decision of whether to order—and yes, I said order—a company to report a data breach to individuals to the OPC. The company would have no say in the matter. The OPC would be an impartial third party arbiter of whether a breach was a real risk of significant harm to affected individuals. The OPC would gain experience, expertise, and authority in assessing breaches. The OPC decisions would be made public, meaning Canadians would finally know which companies had breaches, because this is presently not known for all breaches under the voluntary breach notifications referred to and the private conversations that we know the Office of the Privacy Commissioner has with companies.

Finally, the gathering of security failings generates data that could lead to better policy outcomes based on encouraging companies to invest in improved data security.

This approach would also benefit business, especially small business. With the OPC making the individual notification call, the business would be relieved of the compliance costs in hiring consultants to manage its data breach response, as the OPC would specify when, how, and how much notification was required. It would virtually eliminate the risk of civil liability for data breaches. The OPC could provide extensive breach notification guidance and materials to ease the reporting process for business in dealing with the stress of a breach.

This committee could save time and effort in designing step two by essentially copying the relevant section of Alberta's Personal Information Protection Act, namely section 37.1 of that act.

Finally, a rewrite of Bill S-4, as suggested, should encourage both business and consumers to take personal information security and the response to it more seriously. For business, a step-one requirement to report security breaches to the OPC would drive investments to improve systems in order to avoid having to report breaches. For consumers, a step-two notification could be treated as authoritative, serious, and OPC-approved assurance of impartiality, and spur consumers to take action to appropriately deal with breach notification and, finally, to reflect their judgment of the information-handling practices of the business to those businesses.

Thank you very much. I await your questions.

[Tamir Israel, Staff Lawyer, Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic]

Thank you, Mr. Chair, and committee members.

My name is Tamir Israel, and I'm a staff lawyer with CIPPIC, the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic, at the University of Ottawa. CIPPIC works to advance the public interest in policy debates that arise at the intersection of law and technology. We're very grateful for this opportunity to provide our input into Bill S-4, the digital privacy act, which will make some important changes to PIPEDA, Canada's federal commercial sector privacy law.

Concern over privacy and lack of trust in organization practices remain an ongoing concern for a number of Canadians. A recent survey commissioned by the Privacy Commissioner found, for example, that over 75% of Canadians have avoided the use of a mobile application because of the information requested, and close to 60% have turned off location tracking functionality on their mobile devices out of concern that others will access the information. These types of statistics are telling, and they show that Canadians remain concerned, and are acting on their concerns, when engaging with digital content.

Even as concerns grow, avoiding privacy-invasive practices becomes increasingly difficult. Every device, from our mobile phone to our car to our television at home, is now a cause of concern for those wishing to maintain a sphere of privacy. The task of keeping up with the multitude of settings and privacy policies on all of these is time-consuming, and increasingly out of reach for many segments of the digital population.

Against this backdrop, Bill S-4 introduces some much-needed improvements to PIPEDA, while at the same time raising some concerns. We're particularly pleased to see the inclusion of compliance agreements and an extended appeal period, as those take some important initial steps towards resolving long-standing problems with PIPEDA's complaint mechanism. We hope that additional changes will be considered at the next statutory review of the bill, which is coming up in the next couple of years. We particularly point to long-standing problems with the lack of proactive compliance incentives as something that we think still needs to be addressed.

With respect to Bill S-4, I'd like to address three parts of the bill very briefly: the new consent requirement, breach notification regime, and some of the information sharing exceptions.

Clause 5 of Bill S-4 will enact proposed section 6.1 of PIPEDA, which seeks to strengthen the consent obligations so that individuals will be aware of the nature, purpose, and consequences of the activities that an organization seeks to carry out with their data. In general, this will mean that where an organization targets or becomes aware that it's dealing with vulnerable individuals such as youths, additional steps to ensure that its privacy practices are understood will have to be taken.

If dealing with young children, it may not be possible at all to make the young children themselves aware of the consequences of their actions, and verifiable parental consent might be required. This is in line with industry practices for minor-specific sites that interact with very young children. There are already legal obligations in some jurisdictions, such as in the United States, under COPPA.

The consent provision will also have a positive impact in other contexts. Strengthening the obligation of organizations to ensure that customers are aware of the nature and consequences of data practices will help individuals make more informed privacy choices in general.

We're a little concerned that recent changes to the bill over its predecessor may shift the focus of the provision to individuals whom the activities are directed at, as opposed to specific individuals whom the organization is dealing with. We're concerned in particular that one common practice would, for example, put in a privacy policy that no children under 13 are permitted on the service; then, when they become aware that large numbers of children under 13 are using the service, the way the consent is phrased might be taken to preclude the additional obligations that should normally apply in that context.

With respect to Bill S-4's breach notification obligation, we're very grateful to see this notification obligation coming into force. It's much delayed and needed. The breach notification obligations have become a standard for 47 states throughout the U.S., and the White House recently announced a federal breach notification bill.

The breach notification regime that Bill S-4 would enact requires that individuals and the Privacy Commissioner be notified where a breach of security safeguards creates a real risk of significant harm. As are my colleagues from the Canadian Bar Association, we're concerned that the standard for notifying the Privacy Commissioner is too high. Additionally our experience has been that it's very useful to have notification directly to the Privacy Commissioner of a majority of breaches for tracking purposes and to generally improve incentives to adopt rigorous technical safeguards.

Even a breach of safeguards that does not lead to the risk of significant harm can be indicative of a general laxity in technical safeguards that should be addressed. We think it's good to have a notification requirement to the Privacy Commissioner that's more comprehensive even where there's no real risk of significant harm to specific individuals.

We're very grateful to see a penalty regime for instances where the breach notification obligations are knowingly ignored. We think that at least over time it would be good to improve this into a more generalized administrative monetary penalty regime. The fines currently in PIPEDA are designed as penalties for very overt offences. An administered monetary penalty regime would be more fitting as it would be focused on securing compliance. That gives businesses more leeway where innocent mistakes are made on the one hand and it may have more teeth where repeat offences are made or where there's a need to secure compliance. I think that would help improve the rigour of this bill, this breach notification regime.

I'll speak briefly to the information sharing elements of the bill. We find a number of these problematic. They raise some potential issues particularly on the private sector side, but we also have some concerns on the public sector side as well. Subclause 6(10) of Bill S-4 replaces the current investigative bodies exception, which permits an exhaustive list of non-governmental regulatory bodies such as the Law Society of Upper Canada to receive information relating to an investigation.

The issue that's intended to be addressed is the difficulties inherent in getting listed as an investigative body. New bodies emerge on occasion, the names of existing bodies change, and each time this happens regulations need to be passed. It's an onerous process. We support addressing that issue.

We're a little concerned that the remedy adopted to address that exception may open the door to unwanted information sharing, particularly in the context of intended lawsuits or where a private company wants to investigate the customer of another company. The provisions adopted in Bill S-4 are an improvement over those in Bill C-12 because they limit the situations in which a company can disclose their customers' information to another company to situations where it can reasonably be expected that if the customer were aware it would compromise the investigation or the impending lawsuit.

However, we're still concerned that this will open the door to customer sharing in a context where the courts have said very specifically that there's a specific process for when you're looking to go after an individual with a potential lawsuit. What you should be doing is filing a statement of claim and going through third party discovery processes, which have built-in safeguards for privacy.

We're concerned that this exception will at the very least give some companies the impression that they will be able to disclose their customers' information. We've had some fairly prominent examples of this in Canada. Some ISPs have been asked, in court so far...because the Federal Court of Appeal has said to date that you cannot disclose your company's information to a potential plaintiff without a court order.

Some of these have gone through the court system and they have even been problematic there. Copyright trolls have asked for the identities of thousands of ISP customers. We've seen other examples where this type of thing could be problematic, so we would appreciate clarification that this exception is not intended to facilitate the types of requests that are to facilitate lawsuits in essence.

We also have some brief concerns relating to proposed section 10.2, which is part of the breach notification regime, which obligates companies who are already disclosing to an individual and to the Privacy Commissioner that a breach of security safeguards has occurred. These companies will also be obligated to notify an open-ended list of companies and government bodies that they believe might assist in the reduction of harm.

In principle, this exception is logical. However, we would like to see some more safeguards in this exception.

Part of the issue is that many agencies that deal with security, particularly in the cyber context, are the same agencies that also conduct investigations on a range of other issues, and security can implicate the private data of several thousand if not tens of thousands of individuals. We're concerned that more information than is necessary may get passed along in these exchanges when they occur.

[Suzanne Morin, Executive Member, National Privacy and Access Law Section, Canadian Bar Association]

Thank you, Jean.

I will limit my opening remarks to just two areas regarding the breach notification regime. The first one is thresholds for reporting to the Privacy Commissioner, and then the second area will be record-keeping.

As you may know, unlike its predecessor, Bill C-12, clause 10 of Bill S-4 sets out a single test or threshold for both notifying individuals of a breach and reporting to the Privacy Commissioner. In effect, every breach that is notifiable to an individual will now also be reportable to the OPC, requiring businesses to change their current practices. The objective of reporting to the commissioner in essence is to track the volume and nature of breaches to see if there are any trends and to allow the commissioner to work with organizations, small and medium-sized organizations, who may need assistance.

This objective is very different—very different—from the objective of notifying individuals so that they can mitigate harm that may result from the breach. This distinction is actually very well understood both by industry and by the Privacy Commissioner's office. In fact, industry players have been following for years the guidelines “Key Steps in Responding to Privacy Breaches”, which were jointly issued by the Privacy Commissioner with their B.C. and Alberta counterparts. These guidelines have existed for several years and have been followed by the industry very successfully. While the threshold for notifying individuals should be based on the existence of a real risk of significant harm, which is what Bill S-4 does today, reporting to the OPC should be premised on the existence of a material breach.

Second, regarding record-keeping, we are of the view that the mandatory record-keeping for all breaches of security safeguards regardless of significance is unworkable, extremely impractical, and places too great a burden on all organizations regardless of size or industry, with no commensurate benefit for the protection of Canadians. In fact, this is really our overarching concern when these new record-keeping obligations are considered in light of the new proposed offences which, in our view, strip away the delicate balance in PIPEDA. In no event should a deficiency in logging be an offence.

As currently drafted, and due to the lack of a specific materiality threshold for reporting breaches to the OPC that I just referred to, every single breach of security safeguards, once again regardless of how trivial, must be diligently logged because it will be an offence to do so improperly or imperfectly.

In closing, we should be focusing on those breaches of security safeguards that might have the most impact on Canadians.

Once again, on behalf of my colleague and me, thank you for the opportunity to meet with you here with today, and we welcome your questions.

[Annick Papillon, NDP, Québec, QC]

Very well.

Bill S-4 could force private sector organizations to report any losses or breaches of personal information. However, unlike what is set out in Bill C-12, the test proposed for this mandatory reporting is subjective since it enables the organizations themselves to determine, and I quote:

if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.

In your view, is that test reasonable?

[Dr. Éloïse Gratton, Partner and Co-Chair, Privacy, McMillan LLP, As an Individual]

I will start. Thank you for the invitation.

I'll give the first part of my presentation in French and the second, in English.

I'd like to start by discussing the legal framework governing privacy protection and the response of business. Despite the legislation that exists, the Personal Information Protection and Electronic Documents Act, or PIPEDA, companies and organizations have no real incentive to comply with the act and implement appropriate security measures. What's the worst that could happen from a company's perspective? What are the risks if they don't comply with the act? Not much. The worst case scenario is that their reputation might be tarnished. For example, if a complaint is made, and at the end of the investigation, the commissioner decides to release the company's name, then obviously, the company's reputation might be sullied. That very seldom happens, though.

There is another potential risk. When an individual is notified by the commissioner that the act was in fact breached, that person can take the company to Federal Court for damages. The court has made a few such rulings in the past decade. In five to ten cases, the Federal Court awarded small amounts. In some cases, it awarded no damages, and in others, $5,000.

Last fall, in its ruling on Chitrakar v. Bell TV, the Federal Court awarded $20,000 in damages, and that was a first. Is this the beginning of a new trend? Perhaps. Only time will tell. One thing is for sure: not everyone has the means to take legal action against a company to obtain small amounts in damages. In privacy violation cases, the amounts often range between $5,000 and $10,000. Engaging in a court battle is a complicated and painstaking process.

Furthermore, at the federal level, no incentives exist with respect to class action lawsuits over privacy violations, which have the potential to improve compliance. Incentives do exist in other jurisdictions. And in many cases, companies comply with privacy legislation as a result. Just think of the recent security breaches. Last January, a security breach occurred at Human Resources and Skills Development Canada. In April, a security breach occurred at the Investment Industry Regulatory Organization of Canada, or IIROC. And class action suits were launched in relation to both of those breaches.

In the case of IIROC, a portable drive containing the financial information of 52,000 brokerage firm clients was lost. The damages sought were $1,000 per individual. That has the potential to motivate companies to comply, but under PIPEDA, that isn't an option. The legislation contains no such provision to motivate companies. And even if it did, a class action lawsuit isn't necessarily appealing because authorization to proceed isn't always granted.

In the Quebec case of Larose c. Banque Nationale du Canada, the Superior Court made a ruling in 2010. A typical breach, it involved a lost laptop containing the financial information of many clients. One of the clients was not very happy and took the National Bank to court. At the authorization stage, counsel for the complainant had to show that, as a result of the security breach on the bank's part, actual identity theft had occurred. The court stipulated that the fear of identity theft alone did not entitle someone to compensation. Had there been no evidence of actual identity theft, the court would not have granted authorization for a class action.

That tells you just how high the bar has been set. Proceedings of this nature are not straightforward. And the damages aren't very high. So what's left? If you can't seek compensation because you're afraid you were the victim of identity theft as a result of a security breach, there is little else you can do.

Let's come back to the legislation concerning security measures. Companies are advised to adopt security measures based on the level of sensitivity of the information. Even when companies contract out services to a third party, the legislation says they are still responsible for the information and must ensure its protection through the contract. In reality, what we often see is companies using cloud services or third-party contracts. They contract the service out and then turn a blind eye to what goes on.

I would like you to consider a provision in a piece of Quebec legislation that I see as very useful. It imposes an additional obligation on companies preparing to give or transfer personal information to a third party via a contract. I am referring to section 26 of An Act to Establish a Legal Framework for Information Technology. It reads as follows:

Anyone who places a technology-based document in the custody of a service provider is required to inform the service provider beforehand as to the privacy protection required by the document according to the confidentiality of the information it contains, and as to the persons who are authorized to access the document.

The person who entrusts the function to a service provider and transfers the data to the provider, whether via cloud computing or some other means, has an obligation to tell the service provider how to protect the information in question. I think incorporating a similar provision in our legislation could be useful.

I am active in the protection of privacy and personal information. There is a prevention component to my work. That entails advisory services, compliance, training, policy development and so forth. I am also involved in crisis management. I help with the management of security breaches, provide assistance when complaints are made to privacy commissioners in various jurisdictions and give advice related to privacy class action lawsuits. Clients rarely ask me to do any prevention work for them unless they have had some sort of crisis first. That shows that companies aren't very tuned in to the issue. And yet, the legislation exists. Are they motivated to comply with the act? Not especially, because they wait until a security breach has occurred before taking action. Not until a crisis arises do they realize how costly it can be and that they might do well to invest in prevention.

It's also interesting to see just how many resources are being deployed to compliance and prevention around the coming into force of Canada's new anti-spam legislation. That piece of legislation is being taken seriously. It includes liability provisions that apply to administrators, executives and employers. And since the penalties it sets out are quite stiff, companies take it seriously. Ever since its coming into force was announced, the legislation has monopolized my practice almost full time. Is spam a bigger problem or greater evil than security breaches or identity theft? I doubt it. Why, then, is the situation the way it is? What are we waiting for to motivate companies to invest in prevention?

I have one last point. My second part will be very short.

Some studies show that most security breaches are the result of human error. I am referring to two studies, in particular, that were conducted two years after the requirement to report a security breach was imposed on companies. The first was done by Alberta in 2012-13 and lists all the notifications and security breaches. According to that report, human error was at fault in many of the cases. The second study was done by the Ponemon Institute in 2013 and says that in 33% of cases, employee error was to blame.

That, too, shows that companies aren't taking employee training around privacy protection seriously. Very often, the security breach resulted from a laptop being left in a car. Was the employee aware that behaviour posed a risk? Was a relevant policy in place? Was appropriate training available? The jury is out.

I know time is running. The second part is going to be quick.

I want to raise the fact that currently under PIPEDA we don't have mandatory breach notification, and I believe that this may well play an important role in addressing some of the financial harm that may be triggered in the case of identity theft following a security breach.

If individuals, whether they be consumers, employees, are notified, it will help them to better protect themselves against harm, such as identity theft, because once they're notified they're going to pay special attention to their financial statements every month, every day, tracking down any suspicious or unauthorized transactions. They're going to monitor their credit through credit-rating agencies, such as Equifax and TransUnion. It will also provide businesses with an incentive to establish better data security practices in the first place.

What's the status on mandatory breach notification outside of Canada? We have it in Europe and in the United States. Most of the states in the U.S. have breach notification laws. In Canada, Alberta so far is the only private sector jurisdiction that has this law, and they prescribe fines up to $100,000 for businesses. They have realized that this breach notification obligation in their law has increased the reporting of security breaches, and it has also increased the privacy training. Businesses are more inclined and are more motivated to spend, because they realize that it's going to be an obligation to disclose the breach if there is such a breach.

In Quebec there is a consensus that it is needed. In 2011, la Commission d'accès à l'information du Québec published a report in which they said that this is needed. It's a matter of time. It's in the hands right now of the legislature, but we will have also this obligation in Quebec shortly, hopefully.

At the federal level, we've had various bills that have been introduced: Bill C-29, BillC-12, Bill S-4 recently, and Bill C-475. The latest one is Bill S-4. Will Bill S-4 do the job if it becomes law? It's better than having nothing, that's for sure. Maybe it's not perfect, but it's better than having nothing.

I guess it would create the incentive for businesses to disclose, and I think we need to trigger that incentive. In an ideal situation there should be clear monetary penalties for not reporting security breaches to individuals and to the privacy commissioners. There should be a duty to report a breach as soon as possible. I'm cautious with providing fixed delays, because I've been on the other side. Sometimes there's a breach and you need to do the investigation before you start notifying individuals and privacy commissioners, because you need to know exactly what happened and what needs to be told or not told.

The Privacy Commissioner, I believe, should be given the power to order an organization to report a breach to customers. These orders should be made public and the organization should be named. I think that would create the necessary incentive for them to invest in preventive measures, which would be beneficial to address a financial harm resulting form identity theft.

This is my last point. It would not be a bad idea to have a uniform breach notification law in Canada. Various systems could become problematic when there's a breach. I know that a few years ago, the Uniform Law Conference of Canada drafted a breach notification act. Maybe it could be used as a tool.

Thank you. I think my time is up.

[The Chair, NDP, Pat Martin]

Your time is pretty much up; there are about 10 seconds left. But I would like to clarify, perhaps, Mr. Jenkin's response.

The PIPEDA act is up for review. It was due to be reviewed about two years ago. It was reviewed once about seven years ago, and the government's response to that review was Bill C-28, which died on the order paper, and Bill C-12, which died on the order paper. So if there was a government response, none of those elements was ever implemented; the act was never amended or changed.

I don't want Mr. Ravignat to think that a review led to amendments to the act. It did not.

Or did you mean something else?

Personal Information Protection and Electronic Documents Act

[Megan Leslie, NDP, Halifax, NS]

Mr. Speaker, I have a great crowd behind me, because this is a really important bill. There is such a great response. I really want to thank my colleague from Terrebonne—Blainville for working on this important piece of legislation. She deserves congratulations for a lot of reasons. It is a great piece of legislation.

My colleague was elected in 2011. She is proof positive than an individual MP can advocate for constituents, give a caucus important advice in a critic role, represent NDP values in a critic area, and make concrete legislative suggestions to the House. The fact that we have such a good piece of legislation before us speaks volumes about her ability to make a difference here in Parliament.

The former CEO of Google, Eric Schmidt, said that as of 2010, we create more information in just two days than was ever created up to and including 2003. That is an incredible statistic. It is massive. We create about 2,000 years' worth of information every couple of days. That is just one way of measuring how the digital world we live in today is different even compared to just 10 years ago.

Change is happening quickly when it comes to technology, innovation, and information sharing. It is increasingly an issue for Canadians, because in the last 10 years, with the growth of the digital economy, social media, and Internet access, greater amounts of personal data are shared. They are collected, used, and disclosed.

This bill identifies a problem. The problem is that our privacy laws are not built for a digital age when we create and share so much personal information.

PIPEDA was adopted in 2000. I remember it quite well, because I was a law student, starting in 2001, and we talked about what the implications would be for the groups, organizations, and communities we worked with. At that time, there were almost no social networking sites, microblogging sites, or video-sharing sites. Tumblr and YouTube did not exist, and there was no such thing as Facebook. I remember the first time I ever googled something, and it certainly was not a verb at that time.

Now over 18 million Canadians have a Facebook account, including many of us here in the House. A lot of us use this form of social networking. That number of 18 million Canadians is more than half of Canada's population, which is incredible.

Can anyone remember a time when they could not YouTube a viral video or find an old friend on Facebook? It was a completely different world 10 years ago. Now we are light years ahead of where we were in 2000.

What we are talking about here would transform the digital world in Canada. It is the type of change that affects Canadians on a huge scale. As Canadians, we are incredibly connected. We are the second-greatest Internet users in the world. More than 80% of us access the Internet regularly. Approximately 70% of us think that our personal data is less secure and less protected than it was 10 years ago, and 97% of Canadians would like to know when their personal information has been exposed because of a data breach.

It is worth noting these statistics, because most Canadians agree with the goals of this bill. It is absolutely unthinkable that we would expose so many Canadians to risks to their online privacy, especially when many people are aware of and concerned about these risks.

We need to update our privacy laws to recognize these changes and keep up with them; otherwise, we risk leaving Canadians unprotected. Canadians have moved on from 2001. It is time that our privacy protection laws moved on as well.

I would like to stress the importance of taking advantage of the opportunity this bill presents. We know that the Conservatives presented a privacy bill, Bill C-12, that came out of the 2006-2007 review of PIPEDA. However, it has been languishing on the order paper since 2011. That is far too long. Not one but two PIPEDA reviews are overdue.

We need privacy protection for the 21st century, but we also need it in the 21st century. Bill C-475 responds to these pressing challenges for protecting our privacy in a new digital age.

In a May 2013 review of PIPEDA, the Office of the Privacy Commissioner of Canada identified pressure points where PIPEDA needed to be changed. The first two of these pressure points, and arguably the most important ones, are addressed in Bill C-475.

The first pressure point identified in the report was enforcement. The report points to the fact that under PIPEDA the Privacy Commissioner is limited to the role of an administrative investigator, and that while she may seek resolution through negotiation, persuasion, and mediation, she actually has no enforcement powers.

The report says:

The days of soft recommendations with few consequences for non-compliance are no longer effective in a rapidly changing environment where privacy risks are on the rise. It is time to put in place financial incentives to ensure that organizations accept greater responsibility for putting appropriate protections in place from the start, and sanctions in the event that they do not. Without such measures, the Privacy Commissioner will have limited ability to ensure that organizations are appropriately protecting personal information in the age of Big Data.

Bill C-475 answers this recommendation in giving enforcement powers to the Privacy Commissioner to order organizations to comply with privacy legislation and to fine them if they refuse to take action within an established time period.

The second pressure point in the Privacy Commissioner's report was to “shine a light on privacy breaches”. It recommended that PIPEDA should:

require organizations to report breaches of personal information to the Commissioner and to notify affected individuals, where warranted, so that appropriate mitigation measures can be taken in a timely manner.

This is really common sense. First of all, we want to know when our personal information has been put at risk. As I said before, 97% of Canadians agree that they want to know when there has been a breach in their privacy. The harm that comes from these breaches can include identity theft, financial loss, negative credit ratings, and even physical harm. We should be aware that we have been exposed to a higher level of these risks when our privacy has been breached.

I will wrap up by saying that the Privacy Commissioner stressed that too often the rights of individuals are displaced by organizations' business needs and that it is becoming increasingly clear that the balance between these rights and needs is no longer there.

I would like the House to know that New Democrats are not stuck in the past. We recognize the imbalance, and with the bill we will take the first steps to make sure to protect the interests of businesses and consumers in the new digital age.

[Scott Andrews, Liberal, Avalon, NL]

Mr. Speaker, it is a pleasure to contribute to this debate today. I listened to the parliamentary secretary speak to the bill. He left out a few interesting facts.

Bill C-12, which was the government's bill, was introduced in 2007. Five long years have passed since then, and the government has not kept its commitment to changing PIPEDA and making the necessary changes. Twice the bill has fallen off the order paper. The government has not been taking PIPEDA very seriously at all.

I commend the member for bringing forward the bill. It would deal with two small measures. First, it talks about reporting the loss or disclosure of unauthorized access to personal information. Where a reasonable person would conclude that there exists some possible risk, the commissioner would have to be notified. The other part would give the commissioner some actual teeth to dig in and fine when personal information is lost.

We, as a government, are falling behind the rest of the world when it comes to protecting people's privacy.

I find it comical that the parliamentary secretary says that PIPEDA has kept its relevance. I am going to quote Commissioner Stoddart with respect to its relevance. She stated:

Back in 2001, when PIPEDA began coming into force, – and even when I became Privacy Commissioner in 2003 – there was no Facebook, no Twitter and no Google Street View. Phones weren't smart. “The cloud” was something that threatened picnic plans. And predictive analytics was largely the domain of tarot card readers.

A lot has changed since 2001, and our PIPEDA legislation just has not kept up.

This is a good start. It would give the commissioner more enforcement powers. Currently the commissioner can only publicly shame a company for breaching PIPEDA. It is time for the commissioner to have the strong enforcement powers needed. Some of that may have been contained in the government's bill, Bill C-12, but that bill has not seen the light of day.

Bill C-475 is with us now. It is something we need to refer to committee. We need to update our privacy laws, and we will be supporting the bill.

[Mike Lake, Conservative, Parliamentary Secretary to the Minister of Industry]

Mr. Speaker, I am pleased to speak to private member's Bill C-475 as presented by my hon. colleague from across the aisle.

Bill C-475 proposes to amend the Personal Information Protection and Electronic Documents Act known as PIPEDA, a law that has been in place for over a decade. PIPEDA has proven its value and retained its relevance in the face of unprecedented technological change.

At its core, PIPEDA gives individuals control over whether and how their personal information can be collected, used or disclosed during commercial activity. This protection fosters trust and confidence in the online marketplace, an important part of the Canadian economy that is growing by leaps and bounds.

The government is committed to updating PIPEDA. In fact, the Minister of Industry met with the Privacy Commissioner only yesterday. However, any changes that are proposed should have been discussed thoroughly with business, consumer advocates and academics or fall within the framework of the existing legislation, as is the case with the former Bill C-12. The proposed new measures put forward in Bill C-475 were not. The proposed amendments in Bill C-475 give the Privacy Commissioner new powers and present a major change to PIPEDA and the role of the commissioner. The impact of such a change on all stakeholders has not been considered.

The Privacy Commissioner's role as defined in PIPEDA is to serve as an ombudsman, a role she has performed impressively to the great benefit of Canadians. Indeed, the commissioner has been internationally recognized and applauded for her success. It was in recognition of this that her term was extended to three years in 2010.

As the commissioner's term enters its final months, the government is pleased to have this opportunity to express its gratitude for the commissioner's dedication to the protection of the privacy of Canadians.

Let us begin by highlighting some of the successes so far. PIPEDA's ombudsman model has proven very successful in setting a high standard for the protection of personal information in Canada. PIPEDA allows for mediated solutions to privacy conflicts that can give both individuals and companies a clear understanding of their rights and responsibilities. A less formal dispute-resolution mechanism is far less intimidating for individuals and easier for them to navigate.

PIPEDA's current oversight and redress regime reflects a deliberate decision by Parliament to adopt a mechanism that avoids litigation when resolving privacy disputes. PIPEDA also provides the Privacy Commissioner with a range of powers to address privacy issues. She can investigate, enter premises and compel evidence, mediate a settlement, make recommendations, publish the names of those who contravene PIPEDA and take matters to the Federal Court.

Bill C-475 would give the Privacy Commissioner new, quasi-judicial enforcement powers. Unfortunately, the enforcement regime proposed by the private member's bill is fraught with procedural failings. As my colleagues will note, the bill contains a list of consequences for non-compliance. This includes a monetary penalty of up to $500,000, a very significant amount.

However, should penalties imposed on small firms be as large as those for multinationals? Unfortunately, the bill completely overlooks this matter. The size of the firm or its ability to bear the burden of monetary penalty is apparently not a factor to be considered.

Given the potential severity of the monetary penalty, it is also puzzling to observe that this particular remedy only applies to failure to comply with orders. Indeed, organizations that have been found to wilfully violate the privacy of individuals, including those that have profited significantly from the violation, are not subject to this penalty. They are only penalized if they have failed to change their ways after having been caught. There are many outstanding issues and questions with respect to the enforcement measures that are being proposed in Bill C-475.

PIPEDA already provides the Federal Court with the ability to provide any remedy it deems appropriate, including orders to correct practices, award damages, or order offending parties to publish a notice of corrective action. Clearly, PIPEDA establishes a comprehensive process for taking action against privacy violations. Businesses, both large and small, together with individuals, have found much success in the resolution of their disputes.

We must ask, then, how the proposed enforcement measures are going to affect the level of co-operation that exists between organizations subject to PIPEDA and the Privacy Commissioner. Would the enforcement regime of Bill C-475 change the current dynamic between organizations subject to PIPEDA and the commissioner, making the parties more adversarial and the process counterproductive? These are questions that cannot be taken lightly.

Finally, the implications of these new powers on the structure and resources of the Privacy Commissioner's office do not seem to have been considered during the drafting of Bill C-475. The new powers would place an undue burden on personnel within the Privacy Commissioner's office. One cannot simply add new enforcement powers to a law without thorough study and consideration of the impact on its existing oversight regime or on its regulator.

We cannot support Bill C-475. There are too many omissions and fundamental questions left unanswered in this bill.

In spite of the difficulties with this private member's bill, though, the issue of compliance with PIPEDA certainly warrants further exploration. The government will continue to send a strong message about the importance of complying with PIPEDA, given its critical role in building trust and confidence in the online marketplace. Furthermore, there must be an opportunity for all Canadians with an interest in privacy issues to be comprehensively canvassed and thoroughly heard.

To conclude, the government does not support private member's Bill C-475. Instead, the government remains committed to updating PIPEDA in a more considered and comprehensive manner. Our government will have a balanced approach, one that takes seriously the protection of private information while establishing a regulatory framework that is workable for businesses.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

moved that Bill C-475, An Act to amend the Personal Information Protection and Electronic Documents Act (order-making power), be read the second time and referred to a committee.

Mr. Speaker, I am having a déjà vu. I feel like I already delivered a speech for the first hour of debate.

I am very pleased to have the opportunity to reopen the debate on an issue that is extremely important for Canadians and our digital industry and that is the issue of protecting personal information.

My Bill C-475 seeks to modernize the Personal Information Protection and Electronic Documents Act, which has not been updated since the arrival of the first generation of iPod. That is an eternity in a modern and ever-changing society like ours. Several million Canadians have never known a world without smart phones. This legislation that governs crucial aspects of our lives does not respond to the challenges of our time.

As I have already mentioned, we use the Internet every day. We use the Web to socialize, share our ideas with others, work, contribute to the Canadian and global economies, participate in democracy and educate ourselves. The Internet is indispensable to our personal, academic and professional development.

The Internet is central to the lives of both children and adults, who use it for entertainment and as a work tool. However, all of our web activities create a digital information footprint, which makes it even more clear that we need to protect our information.

I would like to share some facts that show how big a role the Internet plays in our lives. Quebeckers and Canadians spend about 45 hours a week online More than 70% of Canadians use it daily. Our citizens have more than 18 million Facebook accounts. The digital economy is a sector that is growing exponentially.

Our democracy is becoming increasingly digitized. One example is petitions, which allow our citizens to speak up and become involved in regional, national and international issues. Canada as a country is firmly plugged in.

We are increasingly managing our lives digitally. Because of this major shift, new rules are needed. These rules must take into account the new risks associated with this shift.

Since the beginning of this year, we have seen what a huge impact the loss of personal information has on our communities, for all citizens, regardless of their vulnerability or level of digital literacy. Millions of Canadians are affected by the loss of information, and this is happening more frequently every year, according to the Privacy Commissioner.

A study published in 2011 showed that every publicly traded Canadian company experiences an average of 18 privacy breaches a year. That is a lot.

Two recent reports revealed that 7 million Canadians have lost $3 billion as a result of cybercrimes. The most common crimes are identity theft and privacy and security breaches. Companies should protect against such breaches.

These reports said that 94% of companies say that they have never experienced a privacy breach. These numbers frighten me. In addition, the more information that is shared on the Internet and our smart phones, the more chances there are that our information could be lost or stolen. This only encourages crime groups in the very lucrative phishing market that have managed to scam thousands of Canadians and steal $76 million, last year alone, through 156 million emails sent from all over the world.

This is an international problem and we have to address it immediately. Unfortunately, the current legislation to protect privacy and Canadians' personal information has not been updated to address these risks and put in place appropriate measures for our society.

The current legislation does not provide for Canadians to be notified of a breach of their personal information. In fact, organizations are not required to notify them, regardless of the seriousness of the breach. This means that they cannot take appropriate action to protect their identity or their credit in order to reduce any harm they might suffer.

Compliance with Canadian legislation governing the sharing of personal information is another major problem in Canada. In 2011, the Privacy Commissioner noted that a quarter of the most-visited websites in Canada do not comply with Canadian law; they disclose our data without our consent. What is much worse is that companies that choose to ignore our laws do not currently suffer any consequences.

For more than 10 years, Canadians have been waiting for a better regulatory framework, and they are rightly expecting results. It is in that spirit that I decided to draft Bill C-475.

I would like to quickly remind my colleagues of the two simple and effective mechanisms proposed by Bill C-475 to enhance the protection of Canadians' personal information.

First off, Bill C-475 requires that the Office of the Privacy Commissioner be notified by any organization having personal information under its control when there is a possible risk of harm to users. Experts in the commissioner's office will assess the seriousness of the situation against a criterion for harm that sets a high standard. They will recommend whether or not the organization should notify the users affected. This mechanism allows for an objective analysis of the risk and better management of the risk through an expectation of a high level of security, rather than a subjective analysis based on the interests of the organization, which may differ from the interests of users.

In addition, objective risk analysis will ensure that users are not bombarded with notifications of data breaches that do not affect them at all or present a minimal risk. Indeed, this framework will ensure that users are not bombarded with useless notifications. They will only be notified after a thorough risk assessment by the Office of the Privacy Commissioner. The process will empower Canadians to take steps to protect themselves much more quickly, in addition to reducing the harm done to them.

The second mechanism provided for in Bill C-475 is designed to give the Office of the Privacy Commissioner order-making power when an organization fails to obey the law.

The Federal Court would have legislated authority to penalize organizations that fail to carry out an order issued by the commissioner.

These mechanisms are straightforward and clarify the commissioner's powers. In short, the Office of the Commissioner will now have the power to enforce the law, which unfortunately is not now the case. All too often, the commissioner's recommendations are not being followed, and it is Canadians' privacy that is suffering.

This bill was drafted to address the concerns of Canadians, people in the digital industry, civil liberties organizations, Internet experts and specialists in the protection of privacy, some of whom we heard testify during the study conducted by the Standing Committee on Access to Information, Privacy and Ethics on social networks and privacy.

Bill C-475 is a direct response to requests from the community to adapt the law to suit our digital age by providing some flexibility for people in the industry and protecting the ombudsman's role of the Office of the Commissioner.

The bill therefore takes a very balanced approach, despite what members opposite said last May. On October 9, information and privacy commissioners and ombudspersons from Canada's federal, provincial and territorial governments met in Vancouver for their annual meeting. They voted in favour of a resolution calling for reforms to address a series of measures they are interested in looking at and supporting, including the key principles in my bill. These measures follow up on recommendations Commissioner Stoddart put forward last May with the aim of modernizing the Personal Information Protection and Electronic Documents Act in order to strengthen the authority to enforce the act, including the commissioner's ability to make orders and make it mandatory for organizations to report when information has been compromised.

The bill is also balanced with regard to companies, since clear roles and processes enable them to plan their policies and response. It will be clear for organizations that they are required to report a breach to the Office of the Commissioner, but they will not be responsible for deciding what the ultimate risk is. Companies that are law-abiding will no longer have to compete with companies that are not.

Finally, this bill makes it possible to bring our privacy protection legislation up to the same level as countries such as Germany, Great-Britain, Australia and France, as well as Canadian provinces such as Quebec and Alberta. Canada, as a world leader in technology, must implement international standards. A cross-Canada survey published in April by the Office of the Privacy Commissioner, found that 97% of Canadians would want to be notified if the personal information they had given to an organization were compromised. In addition, 80% of respondents would grant more powers to the Office of the Privacy Commissioner.

The principles defended by my bill have garnered support from all classes of stakeholders affected by these changes, including industry representatives, civil liberties organizations, academics specializing in all areas, consumer protection agencies and even by the Privacy Commissioner and the ombudsman for privacy and information.

This fall, the public consultations I conducted in my riding and the West confirmed the growing interest of Canadians in privacy issues and their support for my bill.

The Union des consommateurs, for example, has stated that:

[it] believes that the implementation of the principles proposed by the NDP, through their private member's bill amending the Personal Information Protection and Electronic Documents Act, constitutes a real advancement to better protect the privacy of consumers.

Michael Geist, the Canada research chair of Internet and e-commerce law at the University of Ottawa said the following:

Bill C-475 is a far better proposal ...Those provisions would do far to ensure a greater respect for Canadian privacy law and give Canadians the assurance of notifications in the event of security breaches.

A few years ago, my colleagues on the other side introduced a bill to modernize the Personal Information Protection and Electronic Documents Act. Therefore, I know they share my concerns about the privacy of Canadians.

Furthermore, in the Speech from the Throne last week, the Conservatives reiterated their willingness to defend the rights of consumers, and the protection of privacy is a crucial part of these rights.

However, Bill C-12 did not receive the serious consideration it needed in the House, and today its principles no longer reflect the reality of our current needs. Moreover, due to the prorogation of Parliament, Bill C-12 has died on the order paper.

My bill is the most up-to-date bill and the only one currently on the table.

I urge my colleagues across the way to reconsider their position on Bill C-475, not only because it meets the current needs of citizens and surveillance authorities, but also because, if we wait for the reintroduction and re-evaluation of an outdated bill, it will take months or even years. Canadians need to be protected now, and Bill C-475 will help restore their confidence in the companies with which they do business, as well as in our institutions.

Canada has a deplorable record on the international front when it comes to privacy, and the increasing costly attacks on our personal information demonstrate beyond a shadow of a doubt that we cannot afford to wait any longer; we must act now.

Canada's Privacy Commissioner, Jennifer Stoddart, said it best on October 9, 2013:

We live in a world where technologies are evolving at lightning speed and organizations are using our personal information in ways previously unimaginable—creating new risks for our privacy. Our laws need to keep up. Canadians expect and deserve modern, effective laws to protect their right to privacy.

By voting in favour of Bill C-475, my colleagues would be meeting Canadians' expectations. If the members of this House truly care about the privacy of their citizens, they have absolutely no reason to vote against my bill.

If the Conservatives take their commitment to consumers seriously, they must vote in favour of Bill C-475.

I would also like to reiterate that I am willing to work with all parties in order to ensure that Canadians have the protection they deserve in this digital age.

We must work together, as parliamentarians, to better protect the privacy rights of our citizens, our youth and seniors.

Privacy

[Christian Paradis, Conservative, Minister of Industry and Minister of State (Agriculture)]

Mr. Speaker, we thank the Privacy Commissioner for her report, and we indeed have taken measures to have tougher measures. That is why we introduced Bill C-12, which would improve privacy safeguards.

It is unfortunate that the opposition decided to play political games and needlessly delayed the bill.

We seek the support from the opposition. Everything covered in this bill is in response to what was recommended by the committee. I urge the opposition to support Bill C-12 immediately.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, it is clear that Conservatives do not take the privacy of Canadians seriously. The commissioner herself has raised concerns about Bill C-12. To paraphrase the Privacy Commissioner, the Conservatives are taking a soft approach when it comes to protecting Canadians' privacy online.

The commissioner made it clear. The present lack of oversight for online snooping is putting Canadians' privacy at risk.

When will the Conservative government agree that we need a tougher law, better oversight, and reporting mechanisms? When will the Conservatives start protecting Canadians' privacy online?

[Christian Paradis, Conservative, Minister of Industry and Minister of State (Agriculture)]

Mr. Speaker, naturally we thank the commissioner for her report. Our government is truly determined to protect Canadians' privacy.

That is why we introduced Bill C-12, which strengthens guarantees to protect personal information and implements the committee's recommendations. With all due respect, the bill introduced by my colleague does not cover all these aspects.

We will take the time to carefully study the commissioner's report. However, I would ask the NDP to support Bill C-12, which addresses the committee's findings.

[Dr. Michael Geist, Canada Research Chair, Internet and E-commerce Law, University of Ottawa, As an Individual]

Thank you, Mr. Chair.

Good afternoon. As you heard, my name is Michael Geist. I'm a law professor at the University of Ottawa, where I hold the Canada research chair in Internet and e-commerce law, but I appear before this committee today in a personal capacity, representing only my own views.

I appreciate the invitation. I'm certainly supportive of the committee's study on the issue of SME adoption of digital technologies.

As the committee has already heard, Canada fares relatively poorly in some areas when compared with peer countries. For example, you heard from Shopify's Harley Finkelstein on the lower e-commerce adoption rates by Canadian firms as compared to those in the U.S. There are many other studies that point to the same concerns. A 2011 CEFRIO study on Canadian SME ICT adoption found that mobile device usage was relatively low; moreover, many of the online collaborative tools—application sharing, web sharing, video conferencing—are only used by a small minority of Canadian SMEs.

The Canadian Chamber of Commerce's 2010 study on SME use of e-business solutions arrived at similar conclusions. Moreover, it pointed to Canada's declining rank, whether in the World Economic Forum's global competitiveness index, the OECD's broadband ranking, or The Economist's e-readiness ranking.

Of course, I suggest that the committee is well aware of these shortcomings, as your May 2012 report, “E-commerce in Canada”, cited similar statistics and studies and took note of the performance of Canadian SMEs.

So we have a problem, and while I'm pleased that the committee is looking at this, you'll forgive me if there is a sense of déjà vu about this discussion. This committee is currently also studying broadband and Internet access across Canada, has completed a study on the IP regime in Canada and, as I've just noted, also completed a study on e-commerce. As you know, you're not alone. The Canadian Heritage committee has completed a study on the entertainment software industry in Canada. The Access to Information, Privacy and Ethics committee completed a study on privacy and social media. The Justice and Human Rights committee has studied cyber-bullying. The Senate committee on Transport and Communications last year released a study on the wireless sector.

My point is that our problems with the digital economy, including SME digital technology adoption, are not the result of a lack of study. Many of these issues have been studied intensively for years. At least part of the problem lies in Canada's lack of a cohesive, forward-looking digital economy strategy. That failure is plainly hurting all aspects of our digital economy. It creates business uncertainty, it undermines consumer adoption of e-commerce, harms innovation, and sends an unmistakable signal that this is simply not a policy priority.

For an SME, the effects of Canada's digital economy strategy failure—something I've often termed as Canada's “Penske file”—can be found everywhere. Let me give three quick examples.

The failure to craft a cohesive strategy to ensure a competitive broadband and wireless market means higher costs and less choice for business and consumers alike. High data rates have often meant that the adoption of mobile solutions have been costlier in Canada than elsewhere, which hurts the business case for ICT investment. Further, when Canadian businesses travel to other countries to explore new opportunities, they face some of the highest roaming fees in the world.

Second, on the regulatory front, the digital economy strategy failure has meant that important legislation has stalled, creating legal uncertainty. For example, an SME considering an electronic marketing campaign will want to know what is permitted under Canadian law. I think that this government rightly passed anti-spam legislation in 2010, but the regulation-making process has dragged on for years, meaning that the law has still not taken effect. As a result, there is uncertainty about what is permitted, uncertainty about what will be permitted, and tailoring an e-marketing strategy is difficult.

Third, and somewhat similarly, Canadians want all businesses, including SMEs, to take security and privacy seriously. Making investment in these areas means factoring these issues into account. Yet with Bill C-12, the privacy reform bill languishing in the House of Commons, and, with all respect, inaccurate criticisms of a private member's bill on security breach disclosure requirements, the message, quite frankly, to SMEs is that the Privacy Commissioner may be concerned with the state of privacy law, but it is not a priority.

Now we could talk about, and I hope we do have the chance to talk about, what a digital economy strategy incorporating SME digital technology adoption might look like, including some of the legislative reforms, educational initiatives, skills training, as well as commitments to increase competition and ensure access for all. But my starting point is simply to say that without a broad-based digital economy strategy that weaves together these various issues, we should not be surprised by the lagging performance by Canadian SMEs. Indeed, we've practically scripted it.

I look forward to your questions.

Incorporation by Reference in Regulations Act

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, it is a pleasure to rise this evening to address this bill. I have never had the honour of sitting on the statutory instruments regulations committee. It sounds as if it might be a very interesting committee. I do find it most fascinating that the government has chosen to use this particular bill, given that we are allocated four or five hours, which is probably more hours of debate than for many other pieces of legislation. However, at the end of the day, it is going to be interesting. I suspect that we might see differing opinions. We in the Liberal Party have a great deal of concern with regard to this bill. We cannot see ourselves supporting it at this time, and we will have to wait and see what happens at committee stage and see if the government is going to be able to address the issues.

We were talking about a different bill, Bill C-475, during private members' business, and it dealt with personal information. A government member stood up and made a comment on how wonderful it would be to have Bill C-12 debated, given that all sides of the House seemed to be supportive of Bill C-12. The member made the suggestion that he would even be prepared to see that bill debated right away. Maybe if the Conservatives recognize the importance of that bill, they might also want to call that; the last time it was brought before the House being back in September 2011. We will have to wait and see.

Another concern that was raised was in the form of questions that I asked both Conservative speakers in regard to the whole issue of the French language. I come from the province of Manitoba, and the French language issue in terms of laws and regulations was a critically important ruling that came from the Supreme Court of Canada. The ruling reflected on many of Manitoba's laws and, because of not having appropriate translation, the court had virtually given Manitoba a time schedule to pass all sorts of other regulations and laws in order to keep them in effect. It gave us a bit of a sunset clause in terms of needing to pass this in order to comply. Otherwise, we would have had a series of laws, whether provincial legislation or regulation, that would have become void. Therefore, we take the issue very seriously in terms of some of the things, and that is the reason I posed the questions.

In looking at Bill S-12, there are a couple of things that are really important to note. Quite often, the intent might be clear. Individuals, whether members of Parliament or those assisting in trying to create legislation or regulation, will be fairly clear on what it is they are trying to accomplish, the actual intent. The real challenge is to try to take that intent that is being expressed and put it into words, and in our case also to ensure that the translation is in essence saying the same thing whether in English or in French. That is a very important point.

As an example, one of the first issues that came up was related to Air Canada. It was an important issue, through which I suspect many individuals who might be listening in on the debate might get a better sense of the importance of converting intent into appropriate words. I recall the Air Canada Public Participation Act that was brought in a number of years ago. There is absolutely no doubt that, if we look at the debates and some of the discussions that took place in the committee, we would find that the intent that was being spoken was that communities like Winnipeg, Mississauga and Montreal would be guaranteed their overhaul maintenance positions.

This literally translated into thousands of jobs in Winnipeg, hundreds of jobs that were in essence guaranteed in that law. That was the intent.

If we read the legislation that is there today, I think most Canadians, in reading it, would come to the same conclusion to which I came. I raised that issue shortly after being elected back in December 2011. When I raised it, it was to challenge the government. It was to tell the Prime Minister that we had a law that said these overhaul maintenance bases were supposed to be guaranteed. Air Canada was legally obligated to maintain those bases.

The Prime Minister and the government responded by saying that this was not necessarily their interpretation. Apparently, the government found a lawyer somewhere who said that this was not the case, that there was no legal obligation.

It did not matter what we attempted, whether it was through postcards or petitions. Many different stakeholders and individuals read the law and said that the law was pretty clear.

I raise that because at the end of the day is it very important. When we think of a regulation or a law, we often talk about what we are hoping to achieve by passing it, but what is written down on that piece of paper and translated is what counts.

As legislators, we have to take that responsibility very seriously. In recognizing what this legislation is doing, it is offloading a great deal of responsibility. I know the record will clearly demonstrate that this has not necessarily been a government that wants to take responsibility. By allowing this legislation to pass as it is, we need to recognize that there will be more laws being put into place with less scrutiny from the House of Commons.

That is one of the effects that the passage of this bill will have. We need to be very clear on that point.

Another profound impact the legislation will have is in regard to the whole idea of incorporation by reference and what will happen in regard to that secondary language, whether it happens to be English or French. We are in a bilingual nation and there is an expectation. I will provide a little more comment on that in a few minutes.

The legislative summary that was provided by the Library of Parliament had some interesting information that is worth expressing. One point deals with the amount of regulation versus laws in terms of numbers of pages. It is interesting to note, and this is a quote from the parliamentary library, “There are, at the federal level alone, approximately 3,000 regulations comprising over 30,000 pages”. Compare that to somewhere in the neighbourhood of 450 statutes, which comprise roughly 13,000 pages.

Furthermore, departments and agencies submit to the regulations section, on average, about 1,000 draft regulations each year, whereas Parliament enacts about 80 bills during the same period. The executive therefore plays a major role in setting the rules of law that apply to Canadian citizens.

What we will find is that the number of laws in comparison to regulations is decreasing as we rely more on regulations. When we go into or finish second reading and then it goes to committee stage, how often do we hear from government representatives or policy analysts who say “this is what the clause says and further explanation will be provided via regulation?” We hear a lot of that.

Why then should we be concerned? We have to be careful that we recognize the importance of laws versus regulations and the incorporation of references into regulations.

We start off with our Constitution and our Charter of Rights. These are things that no one would question. We then go on to laws that would be passed in the House of Commons, then to regulations. Finally, we would go to the incorporation of reference.

Look at each stage and how difficult it is to change the Constitution. We do not see too much public will or interest in changing the Constitution. In terms of legislation, the same principle applies. There is a process of changing legislation. There is first reading, second reading, committee, third reading, the Senate and finally royal assent. There is a great deal of scrutiny that takes place.

What about regulations? There is a legal examination and registration that have to take place. Ultimately, publication takes place in the Canada Gazette.

We can see the difference between them. Each level has a different sense of accountability or process that we have to follow. If we take just the one component, the legal examination, the examination for the passage of legislation will come through here. There are all sorts of responsibilities that all members, particularly critics, caucuses, vested interest groups and stakeholders of a wide variety, have in ensuring there is some form of due diligence and a sense of accountability.

What about the regulation? When it comes to legal examination, we know there is an obligation for the Clerk of the Privy Council. There have been four things that were cited again, dealing specifically with this bill, that came from the Library of Parliament. Those four things in passing or ensuring that there is some form of legal examination of that regulation.

The first is, “(a) it is authorized by the statute pursuant to which it is to be made”. Another way of saying it is that if we want to change or pass a regulation, we want to ensure it is in compliance with the legislation or a current law that has been passed by the House of Commons.

The second is, “(b) it does not constitute an unusual or unexpected use of the authority pursuant to which it is to be made”. That would be something that would obviously make a whole lot of sense. After all, it cannot override a law, like a law cannot override our Constitution.

The third is, “(c) it does not trespass unduly on existing rights and freedoms and is not, in any case, inconsistent with the purposes and provisions of the Canadian Charter of Rights and Freedoms and the Canadian Bill of Rights”. We are asking that the Clerk of the Privy Council, in consultation with others, ensure that it does not contradict some of those basic rights. Before, if it was a law, it would be something where members, and in particular the Minister of Justice, would play a much stronger role in ensuring the compliance in that regard.

The fourth is, “(d) the form and draftsmanship of the proposed regulations are in accordance with established standards”. This is something where one would expect our legislative counsel and others that assist us to ensure the wording was correct. That is why at the beginning I commented on the importance of wording, that in fact one can be very clear orally what the intent is, but we have to ensure that this intent is put into proper words because it is the wording that is of critical importance.

I would like to quote from the Library of Parliament because I believe it is stated quite well in terms of what specifically, when we think of regulations, is actually at stake in dealing with Bill S-12. I quote directly from the report that has been provided to us from the Library of Parliament. It states:

When Parliament confers a power to make regulations, the regulation-maker usually exercises this power by drafting the text of the regulation to be enacted. The regulation-maker may also decide that the contents of an existing document are what should be used in the regulation it intends to enact. One way to make the contents of such a document part of the text of the regulation would be to reproduce it word for word in the regulation. Alternatively, the regulation-maker can simply refer to the title of the document in the regulation. The contents of the document will then be said to be “incorporated by reference”. The legal effect of incorporation by reference is to write the words of the incorporated document into the regulation just as if it had actually been reproduced word for word. The incorporation by reference of an existing document is no more than a drafting technique, and a regulation-maker need not be granted any specific power in order to resort to this technique. This is referred to as “closed” or “static” incorporation by reference.

We need to be very careful with that. When we talk about international standards, what we are really saying is that incorporation by referencing says that we are going to take a third party standard, whether international, provincial or it does not even have to be a government agency. It could be any sort of a third party and it could be a one paragraph document or it could be a 500-page document.

I see my time has run out. Hopefully there will be a question and I will be able to conclude my comment on that aspect of it.

Personal Information Protection and Electronic Documents Act

[Laurin Liu, NDP, Rivière-des-Mille-Îles, QC]

Before I begin, Mr. Speaker, I would like to remind the members opposite that Bill C-475 does not represent a comprehensive review of the Personal Information Protection and Electronic Documents Act, and for that reason, it cannot be compared with the government’s Bill C-12, which does in fact constitute a thorough review and is much broader in scope. Therefore I would invite the members to learn more about this bill before criticizing it.

I am especially pleased today to speak to this bill which was introduced by my colleague from Terrebonne—Blainville. Since being elected she has worked tirelessly on various issues related to the digital world. In particular, she fought against Bill C-30 and forced the Conservative government to kill its online spying bill. She also held public consultations on the North Shore on personal information protection as it relates to her bill.

Today, with Bill C-475, my colleague is calling for the Personal Information Protection and Electronic Documents Act to be modernized to take into account the new digital reality. It is hard to believe that this legislation has not been modernized since it was first passed 13 years ago in 2000. Back then, there were no iPods, smart phones, Facebook or Twitter, and I did not even have an email address. It is time for the government to blow the cobwebs away and modernize this legislation to better protect Canadians’ personal information.

The Personal Information Protection and Electronic Documents Act is based on the ombudsman model. The primary duty of the privacy commissioner is to investigate complaints concerning privacy breaches. The privacy commissioner has the power to investigate, to file complaints, to conduct audits and to publicly report on an organization’s personal information management practices. However, the act does not give the commissioner the power to make compliance orders, or in other words, to order organizations to amend their practices or face a fine if they fail to do so.

To clearly grasp the issue here, I would like to give a few examples that illustrate the need to give the Privacy Commissioner more powers. The commissioner recalled that in 2010, the retailer Staples had failed to delete all of the client data stored on devices such as laptops or USB hard drives that had been returned to their stores and were slated for resale. What is most disturbing is that this retailer had been investigated twice before and was still not complying with the commissioner’s orders.

Let us be honest here. The government created a watchdog who in essence has been muzzled. This watchdog does not have the power to enforce the act. This initiative by my colleague from Terrebonne—Blainville would give the Privacy Commissioner the means to do her job.

Another example is Google Street View, which collected personal information such as email addresses, emails, usernames, passwords, telephone numbers and street addresses. The commissioner found that this practice constituted a serious breach of Canadians’ right to privacy. In this instance, the outcome was a little more positive. Google appears to have accepted the recommendations of the commissioner, who observed that the company was on the right track to resolving these major problems.

I should also like to mention the Edmonton-based site Nexopia, which describes itself as the largest social networking site for young Canadians. The site has over 1.6 million registered users, 80% of whom live in Canada. Nexopia.com users create profiles, engage in blogging, create photo galleries and post articles, artwork, music, poems and videos. The problem is that Nexopia does not have any kind of system in place to block public searches of the profiles of young users, and the website does not allow users to shield their profile from the public. You can see the problem.

These facts are troubling, considering that young people are often careless when it comes to their personal information and that they are targeted by many companies and some offenders. The commissioner conducted a thorough investigation, found that this organization was not in compliance with the legislation in a number of areas and issued 24 recommendations.

Following the release of her report, the federal Privacy Commissioner was forced to ask the Federal Court to make an order compelling Nexopia to stop retaining personal information. Since this action was launched, Nexopia has changed hands, and we are still waiting for the new owner to follow up on all of the commissioner’s recommendations.

Bill C-475 introduced by my colleague attempts to resolve much of the problem by amending the Personal Information Protection and Electronic Documents Act in two ways. First, it would give the Privacy Commissioner enforcement powers, the power to order an organization that has failed to comply with the act to take the necessary steps to comply. Any organization that refused to take action within the timeframe set by the commissioner would risk a fine of up to $500,000.

As well, the bill makes it mandatory to signal any data breaches that could harm an individual. If an individual's personal information has been compromised in a way that could harm that individual, the organization responsible must inform the privacy commissioner of the violation. The commissioner can then determine if the violation could harm the individual and may force the organization responsible to inform the individual that their personal information has been compromised. Non-compliance could result in a fine of up to $500,000.

We believe that this will help increase compliance with the law, reduce the cost of the current process, and reduce delays. It will also establish solid case law that will allow individuals and organizations to better understand their rights and responsibilities.

I would like to point out that three provinces already have laws that are basically similar to the federal law concerning privacy in the private sector. Unlike Ottawa, the provinces of Quebec, Alberta and British Columbia empower their commissioner to make binding decisions in certain circumstances.

As my colleague mentioned when she introduced the bill, it seems that there is a consensus among the public to increase fines for offenders. As the Commissioner said, it is important to note that Canadians are the heaviest Internet users worldwide, spending an average of 45 hours a month online.

We are also among the most avid users of networking websites in the world. I was not surprised to hear that half of Canadians are on Facebook. In light of those statistics, it is not surprising that privacy is an ongoing concern for Canadians.

The 2011 Canadians and Privacy Survey found that the vast majority of respondents are in favour of stiff penalties for organizations that fail to protect peoples' privacy. More than 8 out of 10 respondents want to see measures passed to name offending organizations, impose fines or take the organizations to court.

The Commissioner herself is calling for more power to fulfill her mandate. In her 2011 report, she said:

In recent years, we have seen very serious, large-scale data breaches. Data breach notification, in itself, may not be sufficient to create the kind of incentives necessary to ensure that organizations take security issues more seriously in the current environment. Many other countries are taking a harder line on breaches. For example, the United States has been a leader in this area and virtually all states have data breach laws. Meanwhile, a European Commission Regulation proposed in early 2012 included data breach provisions and very significant fining powers for European data protection authorities. Commissioner Stoddart has encouraged the federal government to explore strengthened enforcement options that would create stronger incentives for organizations to ensure personal information is adequately protected.

The report could not have been any clearer.

Why are the Conservatives so soft on those whose business practices are compromising Canadians' personal data?

As a final point, it is important to understand that the Personal Information Protection and Electronic Documents Act and this bill apply to the use of personal information only in the private sector. Ideally, the proposed measures would also apply to government organizations.

I know in the past my hon. colleague has asked the Standing Committee on Access to Information, Privacy and Ethics to examine the possibility of opening up the Personal Information Protection and Electronic Documents Act to resolve this issue.

In closing, it is unfortunate that the Conservatives oppose this, and I hope we can come up with a solution to this serious problem.

[Mike Lake, Conservative, Parliamentary Secretary to the Minister of Industry]

Mr. Speaker, I am pleased to rise today to comment on private member's Bill C-475 tabled by my colleague, the member of Parliament for Terrebonne—Blainville.

First, I will correct the record for the hon. member. I think it was February 15, and I do not know if the hon. member was here, when our House leader certainly made very clear that we were willing to move Bill C-12 to committee, but it was obstructed by the opposition party that denied consent for that.

The Internet has become a platform for commerce. More and more online transactions rely on flows of information, including personal information. In fact, personal information is often cited as the lifeblood of the modern economy. It is a key asset and a driver for innovation. However, for information to continue to be an engine of growth and innovation, it is necessary to maintain a solid foundation of trust in the fair and responsible handling of personal information.

As the opposition is well aware, the government already has amendments to PIPEDA before the House in the form of Bill C-12, the safeguarding Canadians' personal information act. The amendments in this bill are the result of extensive public consultations and reflect the work of our parliamentary committee and legislative review process. They reflect the values of Canadian consumers as well as the realities of the marketplace.

Bill C-12 establishes broad-based, balanced, comprehensive improvements to PIPEDA which set out enhanced protections for Canadians' privacy, while ensuring that legitimate business needs for information are met.

By contrast, the opposition's approach to privacy in Bill C-475 introduces only two new measures in PIPEDA. The first of these is a potentially costly and administratively burdensome data breach notification regime.

Bill C-475 would require that organizations report every data breach involving a “possible risk of harm”, no matter how remote to the Privacy Commissioner of Canada. The commissioner must then spend time determining whether each one of those breaches poses an “appreciable risk of harm”, and thereby warrants notification to affected individuals.

In contrast, the government's Bill C-12 proposes an approach to data breach notification that balances the cost to organizations of unnecessary notifications with the needs of consumers.

Bill C-12 would require notification to individuals only in situations where the organization determined that a breach carried a “real risk of significant harm”, which includes both financial harm, such as fraud, and non-financial harm, such as humiliation. This would eliminate the need for costly notification where it was not needed. This would minimize the compliance burden on organizations and reduce the risk of notification fatigue among consumers, while ensuring individuals would get the information they needed to protect themselves.

The opposition's Bill C-475 contains a lengthy list of consequences for non-compliance. This includes a monetary penalty of up to $500,000, which I am sure members will agree is a significant amount. However, should penalties for small businesses in our communities be as large as those of multinationals? The opposition seems to think this should be the case because Bill C-475 is silent on this question.

In contrast, the proposed measures in Bill C-12 reflect the importance of personal information to the smooth functioning of the marketplace. They address barriers to information flows, which were unforeseen when the act first came into force. They clarify and streamline privacy rules for business, while at the same time providing companies with the information they require to continue to grow and prosper.

Consumer information plays a role in many legitimate businesses. Financing transactions and acquisitions that occur in the normal course of development of many businesses require an assessment of business assets. These assets can include databases containing the personal information of customers the businesses intend to keep serving or information about the training and skills of employees who will continue to work with the business. Without the ability to access this personal information, it can be difficult for companies to assess the economic viability of a particular transaction.

Bill C-12 proposes to amend PIPEDA to enable companies to review personal information when necessary to conduct the proper due diligence prior to engaging in business dealings. Before any information can be shared between parties to a business transaction, each party must enter into a formal agreement that constrains the use of the information to purposes related to the transaction itself. In keeping with PIPEDA's existing principles, the agreement must also require the parties to protect that information with strong security safeguards.

Bill C-12 involves amendments that will remove barriers to the availability of information that is necessary to establish, manage or end an employment relationship.

Private sector representatives and the Privacy Commissioner of Canada have recognized that adjustments to PIPEDA were needed to reflect the unique context of the employment relationship.

As a result, Bill C-12 would amend the act to address situations where, for example, employers might need to collect and use the personal information of their employees to issue identification cards and control access to restricted areas.

These measures have been carefully balanced to maintain the protection of employee privacy by limiting the collection, use or disclosure of employees' personal information to that which is absolutely necessary and by ensuring that individuals are notified when their information is being collected, used or disclosed in the employment context.

Bill C-12 also follows up on other key recommendations. For instance, it would provide greater certainty and would clarify rules for business by streamlining private sector investigations. PIPEDA currently allows companies to share personal information with organizations that have a legitimate mandate to conduct investigations into breaches of agreements and contraventions of the law.

However, under PIPEDA, a burdensome and lengthy regulatory process is required in order to render this effective. To date, four separate regulatory processes have had to be launched to allow for the designation of 84 organizations or classes of investigative organizations with more expected.

Under Bill C-12, if passed, Parliament will act to replace this onerous regulatory process with an exception that will enable the information to be shared only in limited circumstances. Indeed, the government will only allow this information to be shared when it is necessary for the conduct of investigations and for fraud prevention.

I believe Bill C-12 provides a better model for the enhancement of privacy protection in Canada. I do not believe Bill C-475 provides the same balanced and comprehensive model.

I call upon members to support Bill C-12 rather than Bill C-475. I would mention for my colleagues from across the way that if they actually want to pass Bill C-12, as they seem to, both parties have mentioned it in the last few minutes, we would be glad to have that discussion and move it to committee tomorrow.

[Murray Rankin, NDP, Victoria, BC]

Mr. Speaker, I am very pleased to rise today in support of Bill C-475, put forward by my colleague from Terrebonne—Blainville. This is an extremely important initiative for all Canadians.

Frankly, the question that arises is: Whatever happened to Bill C-12? This was to be the government's showpiece legislation to reform private sector privacy in Canada. That was back on September 29, 2011, and it is missing in action. As my colleagues have said repeatedly, privacy is the victim. Canadians are expecting, in this 21st century world in which we live, this digital economy, that their privacy will be protected.

I want to say in my remarks that this is good for business. This is actually essential for business. We can talk about privacy protection in the private sector as a human right, but we can also talk about it as being good for business, and I want to give a couple of examples where, in fact, we have kind of missed the boat on that.

The government had the opportunity. There was a requirement for it to bring in Bill C-12. It did not do this because of privacy protection concerns or even for good business reasons; it had to do it because the Personal Information Protection and Electronic Documents Act required that there be a statutory review. It has taken a long time, and I guess we will have another statutory review before it ever deals with Bill C-12. The point is that it is not just bad for privacy for all the reasons I have said, including the digital economy changing so utterly since 2001, but it is bad for business. That is a language the government, presumably, will understand, so let me talk about business.

We live in a world of big data. The current Foreign Affairs magazine talks about the rise of big data. Canadian Business magazine talks about a couple of examples where Canada, sadly, dropped the ball. Let me explain.

A few years ago Google made overtures in Quebec, but the provincial government and Hydro-Québec were unwilling to provide the kind of electricity required so a large data centre could be situated in that jurisdiction. What happened? Google went to Finland and, as a result, the company built a 350-million-euro data centre. Facebook is currently building a 900,000-square-foot facility 100 kilometres south of the Arctic Circle in Sweden. There is a gigantic industry available for gigantic data, and Canada is missing the train. Why is that?

We have cheap electricity by world standards. That should be easy. We have a very secure Canadian Shield in which we could situate these large data centres. Places like Kamloops in British Columbia have been considered. Here is what else we have. We have laws in the private sector that are substantially similar to those of the European Union. It has a very strong data protection law there. It cares deeply about privacy in that jurisdiction. Companies like Facebook have come to Canada and, essentially, test driven their new privacy regimes to see if they pass muster under the Canadian privacy laws, because if they do, they probably will pass muster in the European Union, the U.K. and places of that sort, since our laws are substantially similar.

Canada is perfectly situated between the United States and Europe with a relatively robust privacy protection regime to attract lots of business, but we dropped the ball. The government has utterly dropped the ball with Bill C-12. Who knows if it will ever see the light of day? I say that is tragic for business.

My colleague from Terrebonne—Blainville has spoken strongly in favour of privacy as a constitutional right, and that is true, of course, but the business side of this is good as well. What does her bill do? It does two fundamental things. It deals with breach notification, which according to the Privacy Commissioner of Canada today, 97% of Canadians think is a good idea, according to a poll. Talk about a no-brainer. Second, it talks about better enforcement provisions and order-making powers. Let me speak about each of those things that her bill would do.

First, in Bill C-475 there is a requirement to notify the commissioner of a breach if there is a possible risk of harm. We have seen lots of breaches where credit card information has found its way to various places it ought not to be, and the like, medical information, information that Canadians hold dear. If there is a risk of harm, the notification must be made in a form prescribed in regulations or otherwise specified by the commissioner.

We do not put everything in statutes; we wait for regulations to put flesh on the bones. That is how we do business. It is not surprising that is the way this has been proposed in Bill C-475 as well.

Then there was some concern because the bill talks about the commissioner requiring the organization to notify affected individuals to whom there is an “appreciable risk of harm” as a result of the data breach. Somehow I gather we should be criticized for the appreciable risk not being spelled out. Well, do we have “reasonable person” standards spelled out in our laws? Do we have every situation in the Criminal Code spelled out? Of course not. We use general words. We allow courts and commissioners and regulatory bodies to figure out what those mean. That is the way we do business. It is not surprising that has not been spelled out in detail here either. That is entirely consistent with normal Canadian drafting processes.

The commissioner would have the ability to order the private sector organization to notify individuals and the bill provides a certain number of criteria that should be considered in doing so. Then there is the possibility of an administrative monetary penalty, depending on certain factors that are listed, of up to $500,000. There is, of course, the issue of the right of action that the commissioner might have against an organization that has not complied with orders.

To me, these are entirely common sense, entirely 21st century provisions. I am so pleased that Canada's highly respected privacy commissioner, Jennifer Stoddart, has agreed entirely with these initiatives at a press conference in Toronto today. I thought this quote was perfectly in line with my colleague's bill. She said:

Personal information has been called the oil of the digital economy. As organizations find new ways to profit from personal information, the risks to privacy are growing exponentially.

That goes to the point that the law we have in Canada, although good at the time in 2001, is entirely out of date and everyone knows it has to be improved. The Conservatives seem to not want to do that. Therefore, this bill would at least get us half the way there with two key things.

Finally, we would have order making power for the commissioner. I live in British Columbia. In my province and in the provinces of Quebec, Alberta and Newfoundland and Labrador, people have had the ability for this umpire in the game, this ombudsperson, to make orders where appropriate, and the sky has not fallen. It seems to me it has worked extremely well.

Why is it that we have taken so long to come up with what has been proven to be a huge success story at the provincial level? Imagine that: an administrative body making an order. How many thousands of examples can we find in Canadian legislation of just that kind of power? This is hardly surprising or radical. It is consistent with administrative justice regimes we find at the federal and provincial levels across the country.

The other thing Canadians want is breach notification. That is the other key element in this initiative. Why? It is because it is the most visceral example of privacy violation. When thousands of records frequently find themselves in the hands of others, not only is there a risk of identity theft and enormous personal loss, not only is it a drain on our economy if that occurs, but there is also a sense of enormous personal violation when individuals' privacy is put at risk.

There is an example in the United Kingdom, where someone left a data stick in the back of one of those black London taxis. It contained the records of several million British taxpayers. Just think what one could do with that information, not just economically. Think of the kind of very sensitive information that would entail. One could find out who was paying money to people, for example, who might have children of whom their current partner was unaware. That would be shown by way of alimony payments and maintenance payments that could be deducted from income tax.

There are a zillion examples of those kinds of breaches. Canadians are worried about that. According to our privacy commissioner, 97% in a survey expressed that concern.

I want to congratulate my colleague for her excellent work in bringing forward Bill C-475. I am shocked that our Government of Canada has not seen fit to move forward with Bill C-12. We get more platitudes about it but no action. I am thankful for the action this legislation entails.

[Scott Andrews, Liberal, Avalon, NL]

Mr. Speaker, I listened to the member talking about supporting Bill C-12. The problem is that the bill has been sitting on the order paper now for almost a year and the government has done absolutely nothing in advancing it, so that we could get it to committee and have a debate on it. One thing that Bill C-475 does is move forward the debate on privacy and the access to and protection of people's private information.

We are encouraged by Bill C-475 and want to get it to committee so we can update the legislation that has been in place. Only today, the Privacy Commissioner of Canada, Commissioner Stoddart, said we are falling behind and we are at risk of not being up to date with others around the world.

PIPEDA has been in place since 2001 with no changes since that particular date. On that, Commissioner Stoddart said:

Back in 2001, when PIPEDA began coming into force, --and even when I became Privacy Commissioner in 2003--there was no Facebook, no Twitter and no Google Street View. Phones weren’t smart. “The cloud” was something that threatened picnic plans. And predictive analytics was largely the domain of tarot card readers.

Things have changed in the last 15 years and we need to get up to date. Bill C-475 is a good first start. We need to also look at the commissioner's white paper released today, because she did say we are at risk of falling behind.

The reforms that need to be made to PIPEDA include stronger enforcement powers, requiring organizations to report breaches of personal information, requiring organizations to publicly report the number of disclosures they make and modifying the accountability principle.

One of the things the commissioner even said today is that she has no power. The only power the commissioner has is to name companies who breach these laws, so we need strong legislation and enforcement powers, and we need to make sure she has power to fine. Some of that may be in Bill C-12, but we have not seen that and we have not seen it being moved forward in the legislature.

These things do need to be updated. We look forward to having some more debate and getting this bill to committee so that we can really dig into it to see how these changes are going to have an impact and what improvements may need to be made to the bill from the information commissioner. We look forward to doing that in committee.

[Parm Gill, Conservative, Brampton—Springdale, ON]

Mr. Speaker, I am pleased to rise today to speak to private member's Bill C-475.

I thank the hon. member for the opportunity to discuss our government's approach to protecting Canadians from data breaches. This issue is one of many the government has committed to addressing in its own bill to update the Personal Information Protection and Electronics Documents Act, namely Bill C-12, which is currently awaiting second reading.

I wish to point out that the data breach notification regime proposed in Bill C-475 takes a starkly different approach than that in Bill C-12. Bill C-475 requires organizations to first notify the Privacy Commissioner of every potential data breach, regardless of context or remoteness. The Privacy Commissioner must then determine whether affected individuals should be notified. Given the potential number of breaches that could be reported, such a regime would increase costs and burdensome compliance procedures for Canadian businesses and would impose an unwieldy financial and administrative burden on the Office of the Privacy Commissioner, generating more costs than benefits for taxpayers.

In contrast to the approach in Bill C-475, Bill C-12 requires that organizations determine whether a breach of personal information poses a real risk of significant harm to individuals. The organization experiencing the breach is in the best position to understand and assess the risks and decide quickly what should be done to protect individuals without delay. With appropriate oversight by the Privacy Commissioner, the responsibility should rest with the organization experiencing the breach. Bill C-12 also requires an organization to report a potential breach to the Privacy Commissioner when there is real risk of significant harm.

The Privacy Commissioner retains oversight of the notification process and would have the option of initiating an investigation if it were believed that notification was not done properly or did not occur when it was required. This also provides her office with information on the nature and number of breaches that have occurred.

There are other differences between the approaches to notification taken in the two bills. Bill C-475 states two factors that are to be used by an organization when determining whether to report a breach to the Office of the Privacy Commissioner. These factors are the sensitivity of the information and the number of individuals impacted by the breach. The use of only these two factors to determine risk related to a breach does not allow for consideration of circumstances to determine if a potential breach could be harmful.

This approach in Bill C-475 to determine whether to report a breach to the commissioner would also not capture breaches impacting only one or a few individuals, even where there is a high risk of significant harm to those individuals. This leaves a large portion of potentially harmful incidents outside of the legislation.

By contrast, Bill C-12 lays out different factors for determining whether a breach poses a real risk of harm, namely the sensitivity of the information and the potential for the misuse of that information. This requires the organization to assess all the circumstances around the breach, including, for example, whether the information was encrypted, whether it was fully recovered, or whether the circumstances suggest criminal involvement. All of these issues must be considered when determining the risk related to a particular data breach. If not, we run the risk of not capturing all harmful breaches or of focusing on capturing too many remote potential breaches, thereby increasing the burden on organizations and quite possibly reducing the commissioner's capacity for dealing with those that would cause harm.

Under Bill C-475, the proposed threshold to be used by the Privacy Commissioner for determining whether to order an organization to notify individuals is “appreciable risk of harm”. This term is ambiguous and is not defined in the bill. It is therefore not clear what type of breaches this threshold is meant to capture.

The manner of notification to individuals required by Bill C-475 is stated as “...clear and delivered directly...in the prescribed form and manner”. However, there are no details provided on what that form and manner would entail. Furthermore, the bill would not provide for regulation-making power to address this. PIPEDA applies to a very broad range of organizations of all sizes to ensure the timely notification of individuals. The means of notification imposed by any legislative requirement should be flexible enough to accommodate the varying circumstances in which these organizations find themselves.

For example, Bill C-12 would allow organizations to use means of notification such as website notices or paid advertisements, where necessary. This can be an important tool in situations where there is a large group of individuals who have not provided their current contact details, for instance. Organizations need access to every method available to reach those concerned in a timely manner. The new requirement proposed by Bill C-475 would create considerable uncertainty and would be burdensome and costly for organizations. In the U.S., where this issue is tracked annually, the average cost to an organization of a single notification is estimated to be $194. The average total cost to an organization for a data breach is approximately $5.5 million. As entrepreneurs in our communities strive to grow our economy and create jobs for Canadian families, we should take care to examine more efficient alternatives to ineffective procedures. These new requirements might even diminish the value of notification because of notification fatigue, causing individuals to ignore the numerous notices they receive. Bill C-475 would thus undermine its own purpose.

In summary, the opposition's approach in Bill C-475 would impose an administrative burden on the Privacy Commissioner and a financial burden on organizations and would impede timely disclosure of data breaches to individuals. Bill C-475 also does not define key terms adequately and does not capture many potentially harmful breaches, such as those involving a small number of individuals.

The notification regime proposed under Bill C-12, on the other hand, is a careful, risk-based approach that would balance the need for notification to individuals with the cost of notification. The comprehensive approach of Bill C-12 could be applied to the vast range of circumstances and considerations faced by the various types of businesses, both large and small, that are subject to our federal private-sector privacy legislation.

I would therefore urge hon. members to oppose Bill C-475, and I invite the opposition to join us in support of Bill C-12 and move it to committee for detailed consideration as soon as possible.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, what is concerning about Bill C-12, which the government has brought forward, is that it actually lowers the standards for the protection of privacy rights in this country. It allows a subjective test for companies that are dealing with a data breach. The threshold now is that a company assesses significant risk before it informs citizens. It is as if the government is trying to create a hackers' paradise in Canada. It has no standards for defending private information when it is lost in its offices. It does not inform the Privacy Commissioner.

The Privacy Commissioner has said that the government's bill is insufficient for protecting the privacy rights of Canadians. Given the serious issues of identity theft and hackers, I would ask my honourable colleague this: In light of what the Privacy Commissioner has come out with today about the need for order-making powers and the authority to protect privacy data from hacking, how does she compare what she is trying to do with her bill, which is address the protection of privacy data in the age of big data, with the government, which is creating such a loophole that almost any company playing loosey-goosey with the privacy rights of Canadians would be able to slip through? It seems that the government would prefer to protect the bad apples than protect Canadian citizens.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

moved that bill C-475, An Act to amend the Personal Information Protection and Electronic Documents Act (order-making power), be read the second time and referred to a committee.

Mr. Speaker, it is with deep conviction that I initiate the first hour of debate on my Bill C-475, the purpose of which is to bring the Personal Information Protection and Electronic Documents Act into the digital age.

I would like to begin by reading from a statement by the Privacy Commissioner, Jennifer Stoddart, released this morning:

“PIPEDA is not up to the task of meeting the challenges of today--and certainly not those of tomorrow”.

It is therefore no surprise that she should have said this, because this legislation has not been updated since the arrival of the first-generation iPod. Matters evolve very quickly in the digital age, and the law is no longer relevant.

Millions of Canadians have never known a world without smart devices. It is an eternity in a modern society undergoing constant change, as ours is.

The Internet is central to our lives, because we use it daily. It is not surprising, therefore, to learn that Quebeckers and Canadians will spend about 45 hours a week online in 2013, that over 70% of Canadians use the Internet daily, and that our fellow citizens have more than 18 million Facebook accounts.

Canada as a country is firmly plugged in. For a few years now, laptops and devices like tablets have been used both recreationally and as working tools. They occupy an increasingly crucial place in our lives. We are moving more and more towards digital management of our lives. This major change means that new rules must be put in place and that they must reflect the new risks associated with these developments in the digital world.

Since the beginning of this year alone, we have witnessed serious losses of data, including data on 52,000 Canadian investors in February and more than 50 million clients of LivingSocial in April.

The Privacy Commissioner of Canada recently stated that breaches of personal data have been steadily increasing in recent years. In that connection, a study by Telus and the Rotman School of Management at the University of Toronto, published in 2011, showed that each public company experienced an average of 18 data breaches a year.

Unfortunately, the current legislation designed to protect Canadians’ privacy has not been updated to address these risks and put appropriate measures in place to protect society. The current legislation does not provide for Canadians to be notified of a breach of their personal information. Organizations are not in fact required to notify them, regardless of the seriousness of the breach. This means that our fellow citizens cannot take appropriate action to protect their identity or their credit in order to reduce any harm they might suffer.

I am referring in particular to our passwords, social insurance numbers, personal emails or even the bank account numbers needed to make online purchases. The sharing of personal information with third parties, without consent, is a major problem in Canada.

In September 2011, the Privacy Commissioner noted that a quarter of the most-visited websites in Canada do not comply with Canadian law; they disclose our data without our consent. This bothers me a great deal, particularly when I think of children, the elderly and people who have not had the good fortune to learn how the Internet works and what the risks are. What is much worse is that companies that decide to do this do not currently suffer any consequences.

For more than 10 years, Canadians have been waiting for a better regulatory framework. They are rightly expecting results along those lines, and it is in that spirit that I decided to introduce Bill C-475. The bill proposes two simple and effective mechanisms to improve protection of Canadians’ personal information.

First, it requires that the commissioner be notified by any organization having personal information under its control when there is a possible risk of harm to users.

Experts in the commissioner’s office will assess the seriousness of the situation against a criterion for harm that sets a high standard. They will also recommend whether or not the organization should notify the users affected.

This mechanism allows for an objective analysis of the risk and better management of the risk through an expectation of a high level of security, rather than a subjective analysis based on the interests of the organization, which may differ from the interests of users.

The process will restore to Canadians the power to take steps to protect themselves much more quickly, in addition to reducing the harm done to them.

The second mechanism provided for in Bill C-475 is based on the Alberta model. It is designed to give the Privacy Commissioner order-making power when an organization fails to obey the law. The Federal Court would have legislated authority to penalize organizations that fail to carry out an order issued by the commissioner.

These mechanisms are straightforward and clarify the commissioner’s powers. In short, the Office of the Commissioner will now have the power to enforce the law, which unfortunately is not now the case.

By providing better oversight of organizations and the use of personal information to which they have access, Bill C-475 gives Canadians an assurance of acceptable risk management and the right to protection of their information. This bill was drafted to address the concerns of Canadians, people in the digital industry, civil liberties organizations, Internet experts and specialists in the protection of privacy.

I had the opportunity to hear a great deal of evidence from experts during a study the Standing Committee on Access to Information, Privacy and Ethics conducted on social media and privacy from May to December 2012.

Bill C-475 is a direct response to requests from the community to adapt the law to suit our digital age by providing some flexibility for people in the industry and clarifying the ombudsman’s role of the Office of the Commissioner.

Moreover, during many consultations specifically discussing the bill, the same conclusions emerged. The bill therefore takes a very balanced approach. It is balanced with regard to Canadians, since objective risk analysis will ensure that they are not bombarded with notifications of data breaches that do not affect them at all or present a minimal risk. The bill is also balanced with regard to companies, since clear roles and processes enable them to plan their policies and response.

It will be clear for organizations that they are required to report a breach to the Office of the Commissioner, but they will not be responsible for deciding what the ultimate risk is. Companies that are law-abiding will no longer have to compete with companies that are not.

Lastly, the bill makes it possible to bring our privacy protection legislation up to the same level as countries like Germany, Great Britain, Australia and France, or indeed to the level of provinces such as Quebec and Alberta.

As a world leader in technology, Canada should be adopting international standards.

Bill C-475 offers a different vision from that proposed by my colleagues opposite, who in 2007 introduced Bill C-12, which is no longer supported by the Privacy Commissioner. They will probably tell me they have already introduced a bill to modernize the Privacy Act, but I would like to remind them that it dates from 2007 and is absolutely not representative of our day and age, particularly when you consider that technology changes extremely quickly.

Bill C-12 was introduced in the House, but there has been no debate for six years, and its content has therefore become outdated. It certainly no longer represents a serious attempt by the government to modernize the legislation in order to better protect the public. Moreover, a problem with the mechanisms proposed in Bill C-12 to deal with a breach shows that it is completely inadequate.

The risk threshold for notifying the Office of the Commissioner is very low and subjective. This poses two major problems. The first is that because the threshold is low, users and the Office of the Commissioner will be notified less often in the event of a breach.

Organizations could avoid notifying those concerned, which poses a major problem with regard to their security. Nor will they have the power to protect themselves and reduce the potential harm to which they are exposed.

The second problem is that experts testifying before the Standing Committee on Access to Information, Privacy and Ethics explained the need to obtain better data in order to gain a better understanding of the cybersecurity risks Canadians face every day. A low, subjective threshold reduces the data to which they will have access, which makes them less able to advise the government and companies on the risks associated with their practices.

My bill establishes an objective threshold, and the Office of the Privacy Commissioner will be mandated to assess the risk associated with a breach. The interests of Canadians, which we in this House have the responsibility to protect, will be paramount.

Quebeckers and Canadians support the measures and principles in my bill. In April the Office of the Privacy Commissioner published a cross-Canada survey showing that 97% of Canadians would want to be notified by an organization if their personal information was compromised. Note that this is the overwhelming majority. In addition, 80% of respondents would also grant more powers to the Office of the Privacy Commissioner. Again, a large majority of Canadians supported these measures.

My bill has garnered support from all classes of stakeholders affected by these changes, including industry representatives, civil liberties organizations, consumer protection agencies and academics specializing in law, communications, cybercrime and political science. I could go on, but there are too many to name them all.

The Union des consommateurs has stated that:

[it] believes that the implementation of the principles proposed by the NDP, through their private member’s bill amending the Personal Information Protection and Electronic Documents Act, constitutes a real advancement to better protect the privacy of consumers.

Michael Geist, chair of Internet and e-commerce law at the University of Ottawa and renowned public affairs pundit, has said about my bill that:

Bill C-475 is a far better proposal.... Those provisions would do far to ensure a greater respect for Canadian privacy law and give Canadians the assurance of notifications in the event of security breaches.

Steve Anderson, executive director at OpenMedia.ca, stated that:

We welcome...[this] online privacy bill because we think it's a tool that can later be applied to protect our privacy against reckless warrantless access to our private information by government authorities. This bill is a useful stepping stone to safeguard our privacy.

Canadians trust us to act in their best interests. They clearly want us to give them better protection. By voting for Bill C-475, my hon. colleagues will be giving them the reassurance of stronger support for their rights and the power to protect their privacy.

Business of the House

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, this afternoon we will continue the debate on today’s opposition motion from the NDP. Pursuant to the rules of the House, time is allocated and there will be a vote after the two-day debate.

Tomorrow we will resume the third reading debate on Bill S-9, the Nuclear Terrorism Act. As I mentioned on Monday, I am optimistic that we will pass that important bill this week.

Should we have extra time on Friday, we will take up Bill C-48, the Technical Tax Amendments Act, 2012, at report stage and third reading.

When we come back from constituency week, I am keen to see the House make a number of accomplishments for Canadians. Allow me to make it clear to the House what the government's priorities are.

Our government will continue to focus on jobs, growth and long-term prosperity. In doing that, we will be working on reforming the temporary foreign worker program to put the interests of Canadians first; implementing tax credits for Canadians who donate to charity and parents who adopt; extending tax credits for Canadians who take care of loved ones in their homes; supporting veterans and their families by improving the balance for determining veterans' benefits; moving closer to equality for Canadians living on reserves through better standards for drinking water, which my friend apparently objects to; giving women on reserves the rights and protections that other Canadian women have had for decades, something to which he also objects; and keeping our streets and communities safer by making real improvements to the witness protection program. We will of course do more.

Before we rise for the summer, we will tackle the bills currently listed on the order paper, as well as any new bills which might get introduced. After Victoria Day, we will give priority consideration to bills which have already been considered by House committees.

For instance, we will look at Bill C-48, which I just mentioned, Bill C-51, the Safer Witnesses Act, Bill C-52, the Fair Rail Freight Service Act, and Bill S-2, the Family Homes on Reserves and Matrimonial Interests or Rights Act, which I understand could be reported back soon.

I look forward also to getting back from committee and passing Bill C-60, , the economic action plan 2013 act, no. 1; Bill S-8, the safe drinking water for first nations act; and Bill C-21, the political loans accountability act.

We have, of course, recently passed Bill C-15, the strengthening military justice in the defence of Canada act and Bill S-7, the combating terrorism act. Hopefully, tomorrow we will pass Bill S-9, the nuclear terrorism act.

Finally, we will also work toward second reading of several bills including: Bill C-12, the safeguarding Canadians' personal information act; Bill C-49, the Canadian museum of history act; Bill C-54, the not criminally responsible reform act; Bill C-56, the combating counterfeit products act; Bill C-57, the safeguarding Canada's seas and skies act; Bill C-61, the offshore health and safety act; Bill S-6, the first nations elections act; Bill S-10, the prohibiting cluster munitions act; Bill S-12, the incorporation by reference in regulations act; Bill S-13, the port state measures agreement implementation act; Bill S-14, the fighting foreign corruption act; Bill S-15, the expansion and conservation of Canada’s national parks act, which establishes Sable Island National Park; and Bill S-17, the tax conventions implementation act, 2013.

I believe and I think most Canadians who send us here expect us to do work and they want to see us vote on these things and get things done. These are constructive measures to help all Canadians and they certainly expect us to do our job and actually get to votes on these matters.

I hope we will be able to make up enough time to take up all of these important bills when we come back, so Canadians can benefit from many parliamentary accomplishments by the members of Parliament they have sent here this spring.

Before taking my seat, let me formally designate, pursuant to Standing Order 81(4)(a), Tuesday, May 21, as the day appointed for the consideration in a committee of the whole of all votes under Natural Resources in the main estimates for the final year ending March 31, 2014. This would be the second of two such evenings following on tonight's proceedings.

Financial Statement of Minister of Finance

[Stella Ambler, Conservative, Mississauga South, ON]

Mr. Speaker, it is an honour to have this opportunity to speak about economic action plan 2013, which was put forward by the Minister of Finance last week.

As we all know, we are on track and continue to focus on economic growth, job creation and long-term prosperity while keeping our promise to balance the budget by 2015. We are quite proud of that.

I want to note that many Canadians may have heard of the 950,000 new jobs created since the economic downturn of 2009, but they may not be aware that most of those jobs are full-time, well-paying jobs with almost 80% of them in the private sector. I want to note that as a bit of a success story.

We have heard about the innovative initiative put forward in economic action plan 2013 for skills training. This initiative would address the demand for skilled labour, something I have heard about many times in Mississauga South. I heard about it when we were holding pre-budget consultation meetings and local economic round table meetings. I heard about it when I met with the Port Credit BIA and small business owners, who told me that they had skilled labour shortage issues in their businesses. I heard it again when the Minister of State for Finance spoke with Mississauga Board of Trade businesses, and the minister heard it as well. The hon. members for Mississauga—Streetsville, Mississauga—Erindale and Mississauga East—Cooksville held a town hall meeting where we heard the same thing. We in Mississauga are especially pleased to hear about the Canada jobs grant because it will help Canadians to become apprentices. It will help both the unemployed and the underemployed. We are talking about 130,000 people who will be helped through community colleges and other training institutions. This is good news.

What I want to talk about today are the initiatives in the budget that would affect certain people who have been contacting my office, people in Mississauga South in particular. I went through the budget in search of these types of examples and found my favourite page numbers from budget 2013. I would like to tell the House what they are.

I am going to start with tax relief for home care services. Lucie Shaw in Mississauga South runs Nurse Next Door. These individuals drive around in little pink Volkswagen Beetles and help people who live in their homes. We see on page 222 that the Minister of Finance has decided to expand tax relief for home care services by extending the GST and HST exemption for homemaker services to include personal care services to individuals who, due to age, infirmity or disability, require this kind of assistance at home. This change was effective last week. I am particularly pleased about that.

I also want to tell the House about page 243, which is a good page for two reasons. The first reason is this government will continue to support the Nature Conservancy of Canada with $20 million in 2013-14 to allow it to continue to serve ecologically sensitive land under the natural areas conservation program. Each federal dollar will be matched by $2 in new funding from other sources, leveraging additional funds for the conservation of Canada's natural environment.

The government is also working on the development of a national conservation plan, and I was a proud member of the environment committee when we studied the recommendations for the minister for the national conservation plan. It included a very strong component on urban conservation. To me and to my constituents in Mississauga South, which sits on Lake Ontario and has the beautiful Credit River running through it as well, these kinds of initiatives to protect and conserve our environment are very important.

On the same page and in the same line of thought is also a new initiative for improving the conservation of fisheries through community partnerships. Budget 2013 proposes $10 million over two years to improve the conservation of fisheries by supporting partnerships with local groups. In Mississauga South these local groups would be groups such as the Credit River Anglers Association and the Port Credit Salmon and Trout Association, which do great work in my riding. One would not think of this, because Mississauga South is obviously an urban riding and is right next to Toronto, but the constituents of my riding care very much about our lake, our river and our environment. This is a great way for this government to show what a high priority we put on conserving our natural environment.

I would like to draw attention to page 226, where the topic is financial literacy for seniors. In particular, this budget will support efforts to make public awareness a priority to improve financial literacy, because sometimes older Canadians can be vulnerable to financial abuse. It will help them make more informed decisions about protecting their financial interests in the future.

I sat on the Standing Committee on the Status of Women, which studied, voted on and tabled a report on elder abuse. This was one of the topics that we did not expect to come up, but financial abuse of seniors is actually quite a serious problem. In addition to improving awareness and improving financial literacy, we have also adopted Bill C-12, which helps to combat financial abuse of seniors by allowing banks to report suspected fraud to the police and other social service agencies.

The Protecting Canada's Seniors Act, which received royal assent in December 2012, protects seniors better by considering age and other personal circumstances as aggravating factors in applying tougher sentences for those who take advantage of the elderly. I am proud that we are supporting our most vulnerable in society through this budget.

With regard to innovation, in particular there is mention on page 201 of a business by the name of Electrovaya, which is located in Mississauga South. It was able to take advantage of Sustainable Development Technology Canada, SDTC, which the government is going to continue supporting with $325 million over eight years for the development and demonstration of new clean technologies that create efficiencies for businesses and contribute to sustainable economic development. Clean technology and efficient practices can save businesses money, create high-paying jobs, drive innovation and improve the productivity of Canada's natural resources. Electrovaya, which produces batteries for cars, energy storage and smart grid power is a great example.

I thank the Speaker for allowing me to tell the House about my favourite pages in budget 2013.

[Michel Bédard]

That is the biggest difference that jumped out at me. There are also smaller discrepancies, such as the one that I just mentioned.

For example, if Parliament were to adopt Bill C-12, Bill C-475 could still carry on through the legislative process. Some of its provisions would probably be amended because they would already be part of Canadian legislation. Certain ones, including those that I mentioned, could however amend the legislation. Those provisions would still be valid. Adopting Bill C-12 does not necessarily render Bill C-475 void.

[Michel Bédard]

Yes. In Bill C-475, for example, there is a provision to authorize the commissioner to take action against an organization that has lost private information. There is no similar provision in Bill C-12. That's an example.

Also, if you want to proceed to a detailed analysis of the two bills, we could. For example, under Bill C-12, when there is a loss of information the organization is compelled to notify the individual, whereas under Bill C-475 the notification would only be applicable if the Privacy Commissioner ordered that there be a notification.

So they are similar, but there are some distinctions as well, and there are also other provisions in Bill C-475 that are not in Bill C-12.

[Michel Bédard]

This bill will amend the Personal Information Protection and Electronic Documents Act with respect to compliance orders, and also with respect to loss of information. Portions of this bill are already in Bill C-12, which is a government-sponsored bill, but there are also elements of Bill C-475 that are not in Bill C-12.

Based on the fact that there some elements in Bill C-475 that are not in Bill C-12, this bill, even if Bill C-12 is adopted, could nonetheless itself proceed and on its own amend the law. So I suggest that it is not substantially similar to Bill C-12.

Response to the Supreme Court of Canada Decision in R. v. Tse Act

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, section 184.4 of the Criminal Code was struck down by the Supreme Court because the lack of definitions was seriously problematic. To put it in context, we were dealing with a criminal activity that was brought to the court. This was not about spying on ordinary Canadian citizens, which some of my colleagues on the other side would like to be able to do. This was about a criminal act and still the Supreme Court said that even in the case of a criminal act, the rule of law must apply. Therefore, the government had to define who was eligible to get that information.

In order for Bill C-55 to be charter compliant and compliant with the Supreme Court, the government has to define who is eligible and under what circumstances this breach of personal information is going to be allowed. We do not have that same standard on Bill C-12 yet. The government wants to be able to force telecommunications companies and other private businesses to turn over data and subscriber information, but it does not define who is eligible to gather it. That is very disturbing because under Bill C-30, which was the other piece of this triad of puzzles we had before us, a minister was able to designate inspectors. Who were the inspectors that he was designating? That was a very bizarre and wide loophole the government was creating for itself.

[Scott Simms, Liberal, Bonavista—Gander—Grand Falls—Windsor, NL]

Mr. Speaker, just on a quick point of clarification, I appreciate the parallels the member drew with Bill C-12 and ensuring that the “officer” is defined as a “police officer” and not just a “peace officer”, but my understanding from the decision from R. v. Tse is that it has more to do with the notification of the person whose communications were intercepted. That was the breach. There was an add-on after that about defining the police officer and such. However, I would like the member to comment on this further, because he is onto a good point.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, as always, it is a great honour to rise in this House on behalf of the people of Timmins—James Bay, who have put their trust in me to work on the issues of legislation before the House.

I am going to speak today on why the New Democratic Party is supporting Bill C-55 and what works about this bill, but also on the issues we need to look at and the prism that needs to be applied in terms of how the legislation was crafted, what it was in response to and how it ties into two other key pieces of legislation that this House has been asked to deal with.

One is Bill C-30 and the other is Bill C-12. Within each of the bills are key issues that reflect on the ability of the government to move forward with legislation and on how legislation is actually brought forward.

What is striking already, off the top of Bill C-55, is that it is a very narrow bill. It is simply addressing a section of the Criminal Code, section 184.4, that the Supreme Court struck down.

What we find is that legislation that is limited is usually more effective than legislation that is broad. Legislation is a very a blunt tool. Unfortunately, we have seen that the government likes to throw in all manner of legislation, often without thinking of the consequences or with very little regard for the consequences. We have seen one omnibus bill after another brought before the House without proper review and without a proper understanding of how they related to basic issues like charter rights.

I would like to say that I think the government is doing the right thing with Bill C-55 by having very narrowly defined legislation that addresses a major problem. I would like to think that the government thought this approach up on its own and that this is how it is going to start dealing with criminal matters and the reform of the criminal justice system, but that is not really what has happened here.

The government is responding to the fact that the Supreme Court struck down section 184.4 of the Criminal Code and gave it a deadline of April 13, which is only two weeks away, to address the problem.

I am going to speak a little about Bill C-55 and then explain how the implications of the Supreme Court legislation tie in to Bill C-30 and Bill C-12.

Under section 184.4, the Supreme Court ruled in R. v. Tse that police use of a warrantless wiretap to secure the safety of an individual is a correct step to take. If a life is at stake, law officers have the ability within Canadian jurisprudence to go in, get the evidence and secure a life. That is a long-standing practice within the Canadian law system.

However, the problem with section 184.4 is that there are no accountability mechanisms. What I find very interesting about the Supreme Court decision is that it says that even in the case of criminal activities—and what we were dealing with in this case was a kidnapping, a very horrendous attack against a citizen—basic charter rights still remain and have to be balanced.

The Supreme Court took the larger view and recognized that the spectre of criminality cannot be used to undermine the basic rights of citizens in this country. This is a concept that seems absolutely foreign to the Conservative Party, whose backbenchers jump up whistling and dancing every time they can come up with some extreme case of a criminal activity as a cover to allow them to undermine all manner of privacy rights, all manner of basic citizen rights. They have done it time and time again.

The Supreme Court has said no. The test of law in this country is what is reasonable versus unreasonable. What is reasonable is that if law officers know someone is at risk and need to get that information immediately, it is reasonable to go for the warrantless wiretap to gather that information without the judge's warrant, which can then be obtained later. What is unreasonable is to do that without any oversight mechanism.

Section 184.4 will clarify this, because it defines—and this is a very important thing again in dealing with Bill C-12 and Bill C-30—who is eligible, the police; how it is to be used, under specific circumstances; and why it is to be used, to protect the rights of citizens balanced against the right to bring safety to people who are perhaps under threat of criminal activity. The definition of how this breach of law would be allowed is crucial to Bill C-55.

When we look at Bill C-30, which was the bill that this was supposed to be a part of, we see that none of these definitions of the who, the how and the why are there. In fact, it is so broad that the privacy commissioners from across Canada, in an unprecedented response to the government, wrote against the government's attempt to undermine the basic civil rights of Canadian citizens.

Whenever the Conservative government attempts to do something that it knows will not pass a charter challenge or attempts to pull something that it knows the Canadian public will not stand for, it uses a bogeyman. The minister used perhaps the most baseless attack that has ever been uttered in the House of Commons when he said that anybody who was concerned about privacy rights or the individual rights of citizens in this country or who dared raise a question to him was on the side of child pornographers.

That was about as ugly as it can get. Of course, now we see who is on the side of child pornographers: Mr. Tom Flanagan, who said that it is a victimless crime. We see the right-wing media is concerned about Mr. Tom Flanagan, a very famous and very rich right-wing white man. It was his rights, we are now being told, that were somehow trampled upon. One reporter said that he thought it showed the fundamental shallowness of Canadians that they were outraged that Mr. Flanagan was defending the rights of child pornographers.

However, that was the kind of language being used by this minister to cover up the fact that there were major flaws in Bill C-30. If we tie it back to Bill C-55 in terms of the Supreme Court, the government must have known that none of its provisions would have passed the charter challenge because they did not meet the basic standards of jurisprudence.

Let us look at the lack of the who, the how and the why in terms of Bill C-30 as compared to Bill C-55. Bill C-30 may be brought back by the government; we are not yet sure. Under clause 33, the government would be allowed to designate an inspector to go into a telecom to demand information for being in compliance with Bill C-30.

The minister may designate inspectors, that is his choice, but there is no definition of what those inspectors are. Are they police? Are they private security? Are they political staffers? We do not know. Bill C-30 would allow the extraordinary ability of the minister to appoint inspectors. Under clause 34, these inspectors would be allowed to go into public telecoms to gather information on private citizens. That is clearly something that would never pass the charter challenge.

In contrast, in Bill C-55 we see that they have defined the right to ask for warrantless information to just the police, which is the proper place it should be. We should know who is able to gather that information on us.

What they wanted to do under Bill C-30 was allow warrantless access to subscriber information on the data use of anybody with a cellphone or an ISP address, which would pretty much mean 95% or 96% of the Canadian public. Unspecified persons could gather that information.

The privacy commissioners of Canada spoke out against this. They said that contrary to the Conservative Party's claims, it had nothing to do with being just like a phone book. Ann Cavoukian said that this was “one of the most invasive threats to our privacy and freedom that I have ever encountered”. About being able to demand and being forced to turn over this information, she said:

...customer name and address information ties us to our entire digital life, unlike a stationary street address. Therefore, “subscriber information” is far from the modern day equivalent of a publicly available “phone book”. Rather, it is the key to a much wider, sensitive subset of information.

That is what the Conservatives wanted to be able to gather.

The abuse of privacy rights did not end there. Under Bill C-30, they also wanted to force telecoms to basically build in back-channel spy communication, so that as they expanded their networks, they would have to build in the monitoring system to keep track of any citizen the government felt it should be able to look at at any time, again without any oversight and without citizens knowing they would be spied upon.

Ann Cavoukian, the Information and Privacy Commissioner of Ontario, said that what they were in fact doing, although they perhaps did not realize it, was creating a hacker's paradise. If we allow wormholes throughout the telecom system to allow police to spy on it, then certainly the hackers, who are usually about three steps ahead of everybody else on this—and we see massive international gangs using sophisticated cyberhacking—would be able to benefit much more than the police or security services.

In terms of the how, Bill C-55 limits the ability to get a warrantless wiretap based on the possibility of a threat to a person. Afterwards there would have to be oversight mechanisms and reports would have to be published and reported to Parliament so that we would know how these warrantless wiretaps are being used. Bill C-55 defines and protects this breach of the private rights of citizens, whereas under Bill C-30, the door was kicked down and all the basic rights of citizens were thrown out.

Of course we know that Bill C-30 was responded to in a massive and very exciting and positive response from the public, a backlash that said that we demand that our privacy rights be protected and defined under the rule of law in this country. It was an unprecedented backlash against the government. The Minister of Justice has been pretty much hiding under his desk publicly ever since. It is a good sign that we have a engaged citizenry here that knows the difference between what is reasonable and unreasonable.

In Bill C-55, the government is limited to gathering information under the reasonableness of protecting an individual who is facing threat compared to the unreasonableness of doing away with all manner of privacy rights whatsoever. In this manner, I would say that the Canadian public are foremost across the world in standing up for their rights, much more than the government, which has very little respect for the privacy rights of Canadians. In other democracies with privacy rights in the digital age and the age of big data and CCTV cameras, other citizens are steadily having those rights eroded, whereas in Canada we want to maintain those rights.

In Bill C-12, which is the other piece of legislation to compare Bill C-55 to, again we see the government showing no respect for the privacy rights of Canadians. There is no understanding of the importance of privacy rights. We certainly saw that with the massive data losses of private financial information on over 500,000 Canadians at HRSDC. We have seen other data breaches. We saw the government's cavalier attitude when, rather than warning citizens that their personal financial data may have been breached, its only desire was to protect the minister, and it kept the breach quiet for two months. Any manner of international gangs could have had that data, gone after people's credit and created massive widespread fraud, because that is what can happen if the public is not alerted.

Under Bill C-12, the government wants to change the reporting threshold for private business when these privacy breaches happen. This is very important in terms of defining how we protect the rights of citizens. Under the changes the government is bringing in Bill C-12, private companies that have our data, whether a bank, a Sony PlayStation, or all manner of online transactions, would only have to report the breach to the Privacy Commissioner if they thought there was a significant risk of harm. “Significant” is an extremely high bar to set. Meanwhile, all manner of abuse could happen underneath it.

Also, private businesses would be very wary about the idea of going public with the fact that they may have lost Visa card information or personal data information for 100,000 or 200,000 or 500,000 people, because it affects their basic online business model. Everything is now done online. However, we see the government telling private businesses that they only have to report a privacy breach if it might cause significant harm. That completely fails the basic test and the understanding of the importance of privacy rights in this country.

We believe that there has to be a very clear rule that if companies fear they have been hacked and that privacy data has been breached, it has to be reported to the Privacy Commissioner, who has such an extraordinary role to play in protecting and reviewing the evidence and deciding whether action must be taken.

However, we see that again the government is undermining the role of the Privacy Commissioner and we have to ask why. As more and more Canadians operate their businesses online and as our financial transactions occur online, the last thing we want to do is create a hackers' paradise in Canada, while the rest of the world moves further ahead of us. Ann Cavoukian has spoken about this.

It is extraordinary that Canada was once seen as the world leader in privacy data. Our Privacy Commissioner is definitely seen as a world leader, but our legislation is falling further and further behind where the Europeans and the Americans are going. As our Privacy Commissioner is asking for the tools to update, to deal with the cyberthreats and to deal with the protection of personal information in the age of big data, the current government is undermining the legislation.

How does that relate to Bill C-55? There are direct connections in the language among Bill C-12, Bill C-30 and what we have seen in Bill C-55. Bill C-12 would allow organizations and companies, including telecommunications companies, to disclose personal information to government institutions, perhaps the police or perhaps not, without the knowledge and consent of the individual when performing policing services. This is under subclause 6(6), but there is no definition of what “policing services” are.

Again, it is the language of Bill C-30, the lawful access and online snooping language, that would allow some undefined security person or force to obtain information on private individuals from telecommunications without defining who would be eligible to gather that information, whereas Bill C-55 would limit it to the police so that is very clear.

I agree with my colleague on the Conservative side and I am telling him that they are going to need to bring Bill C-12 to the same standard, where we define who is eligible to ask for that information. Without doing that, we will end up going before the courts again. If we define that it is the right of the police to ask for that information, then that would meet the test that would be laid out in Bill C-55, but Bill C-12 would not meet that test right now. The issue is that there is no oversight mechanism in Bill C-12. If they did ask for this ISP information on individual users, there are no mechanisms under Bill C-12 for reporting what was happening, and that would fail the test of Bill C-55.

It is clear that what the Conservatives had been attempting to do was to take Bill C-30, which was their desire to be able to snoop on as many people as they wanted as often as they wanted and however they wanted, and build in a number of other subsets in other legislation to make that operable. Bill C-12, which includes changes to the Privacy Protection Act, would certainly allow them to do that. However, being that we have had the public backlash on Bill C-30 and being that we now have defined Bill C-55 very clearly regarding the who, the how and the why of this being allowed, we would need to clarify the same mechanisms under Bill C-12.

We see that the Conservatives are on the straight and narrow right now. They did not want to come. They were dragged, kicking and screaming, and it is our job to ensure they stay on the straight and narrow. We want to work with them. It is hard for them and we will do our part to keep them on the straight and narrow. We will do that 12-step program of accountability and I want to work with my colleagues on that, but they just keep sliding off that wagon. They want to go after personal freedoms. They want to go after individuals. They want to do that spying thing. However, they cannot do it because we have the rule of law in this country.

We are asking them to come work with us and learn from some of their colleagues who might have a little more experience in some of these matters. Certainly the Supreme Court has laid down the test that has to be met. Now that Bill C-55 is in place, the problems with Bill C-12 are too clear to ignore. Then, what we need to do with Bill C-12 is to ensure that Bill C-30 will never come back and that the online snooping provisions of the current government will not come back.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, we know this government has very little respect for privacy. We have seen this in the speeches made by my colleagues here, and in the bills this government has introduced. We also see that it has little respect for the provisions of the Canadian Charter of Rights and Freedoms, the rights and freedoms that are guaranteed to Canadians. From time to time, it introduces bills that are at odds with the Constitution.

I am very happy that this time, it decided to comply with the provisions of the charter and amend the Criminal Code so that section 184.4 protects individuals’ privacy, as guaranteed by the charter.

We know that section 184.4 applies to the interception of private communications, and the Supreme Court recently ruled on this subject. Bill C-55 adds measures that would require persons whose private communications have been intercepted to be so informed at least 90 days after the interception, and reports to be produced annually.

These measures are essential. The fact is that when you take away the need to obtain a warrant in order to intercept private communications in extreme situations where a life is in danger, it is important that there be oversight, with a system in place so that we know what happened and why someone found it so important to intercept those private communications without a warrant.

The NDP understands how important it is for the police to have the tools to respond appropriately in dangerous situations, but at the same time, we cannot neglect the rights entrenched in the charter. Even in cases involving criminals, even in extreme cases, we have to respect the law as it stands. We have to respect the principles of Canadian law, the Canadian Charter of Rights and Freedoms and the Constitution. It is essential.

While I am happy that this government is finally respecting the Canadian Charter of Rights and Freedoms in adopting these measures, I should emphasize that this government, given the espionage agenda we saw with Bill C-30 and with Bill C-12, amended this bill to make it consistent with the charter only after being compelled to do so by a Supreme Court justice. So this was not something it decided to do on its own; it was an obligation flowing from the Supreme Court decision. If this government truly had the interests of Canadians at heart, it would have done this itself, instead of waiting for the Supreme Court to rule on the matter.

It should also be noted that this bill was introduced as the government was announcing the death of Bill C-30, which enabled designated persons, who were none too clearly defined, to gain access to personal information without a warrant and without judicial oversight.

Once again, this government tried to go after personal information, and to treat all law-abiding Canadians as criminals, with no warrant or judicial oversight. If this government wanted to, it would have said that it is important, when looking for information without a warrant, to have a reporting mechanism or something of the kind, so that people are accountable, that personal information is sought only in extreme cases, and that law-abiding people are not treated as criminals, in contrast to what Bill C-30 proposed.

While Bill C-55, following the Supreme Court decision, ensures respect for section 8 of the Canadian Charter of Rights and Freedoms when private communications are intercepted, Bill C-30 introduced measures that were inconsistent with the right we are guaranteed under section 8 of the Canadian Charter of Rights and Freedoms to be protected against unreasonable search or seizure.

There were two bills. The first was withdrawn, and I am very happy about that. Canadians are also very happy that the government decided not to continue with Bill C-30. The second bill says that Bill C-30 was inconsistent with the Canadian Charter of Rights and Freedoms. I hope the government will realize to what extent its own bill, its espionage agenda—I am going to call it that because this is not the first time we have seen attempts of this kind—seriously affected the protections Canadians are guaranteed under the Canadian Charter of Rights and Freedoms.

The people of Canada were opposed to the measures contained in Bill C-30. The government accused its opponents of siding with pedophiles. I was myself accused of being a friend to pedophiles because I opposed that bill, like millions of Canadians right across the country. It has nothing to do with being friends to pedophiles, and everything to do with believing in the protection of Charter rights and in the content of our Constitution. It is absolutely essential to protect the provision set out in section 8 of the charter. We cannot go against it, and the Supreme Court judgment demonstrates that.

If Bill C-30 had been passed, it would have empowered designated persons, again not specified, and selected by the minister, to require Internet service providers to supply names, IP addresses and email addresses without a warrant and without judicial oversight. The Supreme Court decision demonstrates the necessity at all costs of protecting the privacy of Canadians, and shows that the rights and freedoms guaranteed by the charter are not negotiable, contrary to what this government thinks. I trust it has learned its lesson.

I mentioned this already, and I would like to say it again. It seems that a little more reflection is needed on this. The government introduced Bill C-12, which still has not been debated, but which also contains measures regarding surveillance without a warrant. Instead of explicitly saying that it would allow the collection of personal information without a warrant, this bill expands the definition of people who have access to that information and who can consult Internet service providers, based on a vague, sketchy definition. The Privacy Commissioner even raised some concerns about that clause, which was included in the bill.

The mandate for online spying that the government has given itself is not finished. I hope the government has learned its lesson and that, in light of the Supreme Court decision regarding the proposal in Bill C-55, it will drop any attempts to spy on Canadians online, when they are obeying the law.

I want to emphasize that the government cannot cast such a wide net and treat all Canadians like criminals when they are online. Of course, there are criminals and people who disobey the law, and it is important that police officers have the tools they need to intervene. That said, the government cannot contravene the charter. It must respect all rights and liberties guaranteed in the charter.

Once again, I really hope the government has learned its lesson and that it will scrap its plan to spy on people online.

[Matthew Kellway, NDP, Beaches—East York, ON]

Mr. Speaker, I thank my colleague from Timmins—James Bay for his struggle on behalf of Canadians and their interest in their privacy rights, in particular with respect to the bills he mentioned, Bill C-12 and Bill C-30.

I cannot speculate on why the government has such callous and obvious disregard for the privacy rights of Canadians. I cannot account for the zealotry of the minister himself and, perhaps as my colleague suggested, the PMO, nor the disregard for the charter, the Canadian Bill of Rights and the other legislation that, frankly, obligates the government to bring forward legislation to the House only after it has been vetted for conformity with the charter.

There is obviously a trend here. I reflect on past speeches I have given and all of these issues ultimately go to accountability. Bill C-42 had the opportunity to provide the House with oversight of the RCMP, and the Conservatives ignored that. They go to Senate omnibus bills and so on and so forth.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, I listened with great interest to my hon. colleague's excellent discourse on this issue. I have a number of questions that I will try to get to in the limited time I have.

I am concerned because what we saw with Bill C-30 was an attempt to use the spectre of crime, the very debate of the accusation of an ordinary citizen supporting child pornography because we dared question the wisdom of the minister.

Bill C-30 would have used the cover of crime to allow all manner of attacks against basic privacy rights, including the fact that the minister could designate persons, and it was not clear who those persons were, to go in and demand warrantless access to information from telecom service providers on undisclosed persons. Who knows, it could be a political staffer who would be able to go in to telecoms to demand ISP information. That was under clause 35 of Bill C-30.

We still have a bill in the House, Bill C-12, which is supposed to be protecting personal privacy data, but we see that is creating all manner of loopholes. Bill C-12 would allow telecommunications companies to disclose personal information to government institutions, and it is unclear exactly who in the government, without the knowledge and consent of individuals for the purpose of "policing services". This is under clause 6(6) of the proposed Bill C-12. The language is in there again to undermine the rights of ordinary citizens to know that there will be due process and oversight.

Why does my hon. colleague think the government is so fixated on undermining the basic legal private rights of Canadian citizens?

[Françoise Boivin, NDP, Gatineau, QC]

Okay, but I think you may have misunderstood my question.

Bill C-55 is a response to the R. v. Tse decision. The title of the bill says so. The government might have used Bill C-30 and Bill C-12. Actually, many bills along the way could have tried to address the gaps identified in the R. v. Tse decision.

The government announced that it would withdraw Bill C-30 on the same day that Bill C-55 was introduced. Bill C-55 was tabled by the minister in the House less than a month ago. I think it was on February 11, 2013. It was then sent to committee on February 25, which is also very recent.

As you were working on Bill C-30, Bill C-55 was not in the picture. Could you tell me when you started to work on the drafting of Bill C-55?

[Hoang Mai, NDP, Brossard—La Prairie, QC]

Thank you.

Before this bill, there was Bill C-30. As my colleague mentioned, we are very glad that the government realized that a mistake had been made and took a step back. Now we have Bill C-55. And there were provisions from Bill C-12 that were supposed to apply. Is there any follow-through on that?

Aviation Safety

[Peter Van Loan, Conservative, York—Simcoe, ON]

Mr. Speaker, for the past two days we have seen a sudden show of enthusiasm from the opposition for one of our pieces of legislation, Bill C-12. I would like to seek the unanimous consent of the House at this time that, notwithstanding any other element of the Standing Orders, Bill C-12 be approved at second reading and sent to committee.

Telecommunications

[Christian Paradis, Conservative, Minister of Industry and Minister of State (Agriculture)]

Mr. Speaker, on the contrary, Bill C-12 will better protect the personal information of consumers.

We are trying to bolster consumer confidence in on-line shopping. Recommendations were made by the committee and we want to implement them quickly. If the NDP wants to vote immediately, we would be very pleased to move forward with this bill.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, although the Conservatives have decided to scrap their horrible Bill C-30 on Internet snooping, we wonder if they will manage to plant their controversial measures in another bill.

Bill C-12 contains hidden measures that would allow the government to obtain personal information without judicial oversight.

If the Conservatives are really serious about abandoning their Internet snooping bill, then why did they not withdraw Bill C-12 as well?

Business of the House

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, I welcome the implicit offer of assistance from the House Leader of the Official Opposition.

I look forward to discussions with him later on the possibility of moving forward both Senate reform and Bill C-12 on a unanimous consent basis straight to committee. I would be happy to do that with him.

This afternoon we will continue debating the Liberal opposition day motion. Tomorrow we will hopefully finish second reading of Bill C-48, the Technical Tax Amendments Act, 2012, a measure supported by all three parties. After that we will turn to third reading of Bill C-42, the Enhancing Royal Canadian Mounted Police Accountability Act; third reading of Bill S-7, the Combating Terrorism Act; and second reading of Bill S-12, the Incorporation by Reference in Regulations Act.

When we return from our constituency week on Monday, February 25, we will start second reading of Bill C-55, the Response to the Supreme Court of Canada Decision in R. v. Tse Act. This bill needs to be passed by mid-April before the Supreme Court ruling takes effect, which would render the important powers available to police ineffective.

After Bill C-55, we will consider Friday's unfinished business.

Tuesday, February 26, shall be the fifth allotted day, which will go to the Official Opposition, and it will therefore choose the subject of debate.

On Wednesday and Thursday, we will continue debating the bills I have already listed.

Additionally, Bill C-47, Northern Jobs and Growth Act, was reported back from committee yesterday, and I anticipate Bill S-9, Nuclear Terrorism Act, will be reported back soon. So we could also call these bills at report stage and third reading, if we have extra time next week.

Finally, on Friday, March 1, the House will start the second reading debate on Bill C-54, Not Criminally Responsible Reform Act. The Prime Minister announced this bill last week as part of our efforts to ensure we have a justice system that puts the rights of victims first.

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

Mr. Speaker, I rise here today to ask the hon. Leader of the Government in the House of Commons what his government plans to debate for the rest of the week and when we return after the constituency week.

Although we continue to debate a variety of bills that the government has included on the calendar and we continue to debate opposition motions, it is not always easy to really understand what the government is planning—unless of course it does not have a clear plan.

One thing that is clear from dealing with the government is that it does not seem to be much about action but all about talk.

I remember their introduction, with great fanfare, of Bill C-12, An Act to amend the Personal Information Protection and Electronic Documents Act, which would be quite useful to those who have potentially had their identity exposed to theft. It was introduced September 29, 2011, 493 days ago and has yet to be debated.

Then there is the infamous Bill C-7, Senate Reform Act, which the government claims to all who will listen that it cannot get it through Parliament. It has been 358 days since we have had an opportunity to debate that.

Who cannot forget Bill C-32, Civil Marriage of Non-residents Act, which the government refuses to bring forward for debate and a free and fair democratic vote in the House.

I wonder if all of these are going the way of the infamous Bill C-30, the Internet snooping bill, which the Minister of Public Safety so infamously torpedoed with his comments. It was left to die on the order paper.

Can the Leader of the Government in the House of Commons tell me what his plans are for the remainder of this week as well as the next? Does the government have anything representing an agenda whatsoever?

[Jennifer Stoddart]

Thank you for the question.

I haven't looked at the size of data breach fines, which are for something different from simply not obeying the law on consent when sharing personal information.

My remarks on the size of the EU fines were that they relate to whether you respect the law or generally do not, whether there was a data breach, and whether it happened because basically you weren't investing in security. We've seen that time and time again.

I believe that Industry Canada, which drew up the legislation, is best placed to look at what would be appropriate fines. My only point here—and I didn't come here prepared to talk about it, but the question was raised—is that we need some kind of appropriate sanction. How big that is, I can't answer, but I don't think we should go ahead with that part of Bill C-12 at this point, if Bill C-12 lags so far behind the world standard.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much, Mr. Chair.

Ms. Stoddart, thank you for joining us today.

After hearing all the testimony, I'm happy to hear your comments now. Differing opinions have been voiced. We have even heard opinions of international scope. That has really been useful to us.

You recently stated in the media that the Bill C-12 provisions on data breaches did not sufficiently protect Canadians' personal information. You even said that, under those circumstances, you could not fully support this bill.

Could you tell me what amendments should be made to the bill to adequately protect Canadians' personal information?

Privacy

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Mr. Speaker, the government did have this legislation before the House when the member's party forced an election about a year and a half ago.

This government has already taken steps to address the serious privacy concerns of Canadians. Notably, we have introduced amendments to the Personal Information, Protection and Electronic Documents Act contained in Bill C-12 that would empower and protect consumers by requiring organizations to inform the Privacy Commissioner and individuals when their personal information has been disclosed as a result of a data breach. These amendments would also clarify and streamline rules for business.

Protecting privacy is good for Canadians, good for business and it fosters trust and confidence in the online marketplace.

I trust I can count on the opposition member's support of Bill C-12.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, Conservative members keep promising us that they will modernize the legislation, except we have been hearing the same thing for seven years.

Bill C-12 has been on the order paper twice since I asked my question, but we have not debated it. Is it truly a priority of this government, or will they continue to say that amendments are coming? Canadians are tired of waiting. They want their information to be protected and these amendments to become law.

Will the government truly move forward with Bill C-12 or will it continue to make promises?

[Mike Lake, Conservative, Parliamentary Secretary to the Minister of Industry]

Mr. Speaker, I am happy to respond to comments made earlier by the hon. member about Canadian privacy laws.

The government takes the privacy of Canadians very seriously. The Personal Information Protection and Electronic Documents Act, or PIPEDA, is Canada's private sector privacy law. It is a good piece of legislation and has stood the test of time. However, some tweaks are needed. To that end, we have introduced amendments to PIPEDA. The amendments, which are contained in Bill C-12, will introduce new requirements for organizations to report data breaches to the Privacy Commissioner of Canada and to notify affected individuals when the breaches are deemed to pose a significant risk of harm, such as identity theft or fraud.

However, that is not all. These amendments will further protect the personal information of minors, by requiring organizations to consider the ability of their target audience to comprehend the consequences of sharing their personal information.

Bill C-12 is currently at second reading and, once done, will be headed to committee. I hope we can count on the support of opposition members in ushering in these important amendments to update Canada's private sector privacy law.

I would also like to add that there will be an opportunity to update PIPEDA during the second parliamentary review. While the timing of the review has yet to be determined, I can assure the opposition member that the committee undertaking the review will have an opportunity to examine the legislation, call witnesses and to consider making further amendments.

As I stated earlier, the privacy of Canadians is a matter that the government takes very seriously. I hope we can count on support from all members, including the member opposite, on the passage of Bill C-12.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, on September 25, I rose in the House to share Canadians' concerns about the protection of their personal information online. I also asked the government what it was going to do about this and whether it would finally update Canadian laws in order to protect Canadians' personal information online. Canadians have cause for concern about the protection of their personal information. The Privacy Commissioner published a report showing that many popular websites that we use every day are leaking personal information, which is very worrisome.

The Standing Committee on Access to Information, Privacy and Ethics is currently examining these issues and is finding that there are many problems and potential risks. Meanwhile, the Conservatives are stuck in the stone age. They are not modernizing our laws in order to ensure that those laws remain relevant given the existing digital reality and new risks.

The Personal Information Protection and Electronic Documents Act is supposed to be reviewed every five years. Unfortunately, we have still not been able to pass the first revision. Bill C-12 is seven years late, and that is very worrisome. We are also late in dealing with Canada's anti-spam legislation. The regulations have still not been implemented, despite the fact that we have been waiting for years for this to happen.

Meanwhile, things are changing. In the digital age, everything moves very quickly. We must be proactive in order to protect personal information and keep up with the digital age, rather than being left behind. When I asked my question, the Parliamentary Secretary to the Minister of Industry said:

“The government introduced Bill C-12, which is an important tool for ensuring a stronger digital economy”.

As I have already pointed out, Bill C-12 is seven years behind. It is already time for another review, which we are supposed to do every five years according to the act. Unfortunately, we are not yet there. The government keeps putting off the review on personal information protection.

While the government is dragging its feet, businesses have no obligation to issue warnings about compromised data. Furthermore, major websites continue to disclose personal information. I repeat: will the government join the 21st century and modernize laws to protect our personal information online?

[Karna Gupta]

I think when the original PIPEDA was passed by the legislature, we did go on record as part of the industry sector that agreed with the overall position of full disclosure on any of the major issues or breaches that came up.

Now, in Bill C-12 they are looking at an amendment. We haven't quite gone through all of them, but it does require further dialogue with the Privacy Commissioner as well as the industry body. That's really where it is.

We haven't done any more on Bill C-12 at this stage.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you, Mr. Chair.

This has been a fascinating discussion. I think one of the issues that we are trying to grapple with is the effect of risk if privacy is breached. This is a serious issue. We can develop as much as we want, but the risks to citizens are much higher now than they've ever been because of the ease of access.

I'm concerned about two areas. One is in terms of fraud. Scams such as the 419 scam can track people now. They can find information. They can tailor their pitch to you in an e-mail or on Facebook based on specific points of data that would not have been possible before. We're not going to know about their ability to catch people because many people who are caught up in a fraud are just too embarrassed to come forward. This is happening all the time, and it's happening because it's not the good players who are breaching data, but other people who are breaching data.

Mr. Gupta, given the seriousness of this, we're seeing that under Bill C-12, private companies should only need to report privacy breaches if it proves significant harm. That's a pretty high test. Don't you think that given what's out there, the Privacy Commissioner should be deciding whether a breach is something to be reported?

Business of the House

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, I did want to be in accord with the official opposition and NDP House leader. However, my disappointment was that before we started debate on Bill C-45, what we first encountered was a delay tactic in the form of a concurrence motion brought by the Liberal Party. Indeed, that was very disappointing to us and a surprise because Bill C-45 is important. It is the government's top legislative priority for this fall. All parties know that. He is quite right that I did want to see it debated in substance in the House rather than see those kinds of tactics to avoid debate.

Bill C-45's measures will further Canada's economic recovery and ensure the foundation for more good-quality jobs on top of the over 820,000 net new jobs we have already had. It includes an extension of the highly successful small business hiring credit that is directly helping Canadian entrepreneurs create new jobs.

Unfortunately, we have seen the NDP take an anti-job creation position. Believe it or not, the NDP finance critic actually dismissed the hiring credit as yet again another across-the-board cut for small businesses.

We want to see taxes lowered. We do not want to see higher taxes or an NDP carbon tax. That is why we have a budget bill that keeps those taxes low.

I am pleased to say that we will be voting on C-45 on Tuesday night at second reading, which will give us the opportunity to send it to the finance committee for consideration. The parliamentary secretary for finance has made it clear that she will ask the finance committee to ask, I believe, 10 other committees to study elements of the bill and potentially make recommendations with respect to changes or adopt its contents. The opposition and government members are free to make amendments at committee based on their own study as well as on the studies of those other committees. Therefore, there will be ample study of the bill and that is good for all.

Bill C-45 will continue to be debated this afternoon, tomorrow, Monday, and Tuesday. As I said, the vote on the bill will take place on Tuesday evening.

On Wednesday, we will take up report stage—and, hopefully, third reading—of Bill C-28, the Financial Literacy Leader Act. Should we be able to make quick work of that debate, the House will take up Bill C-12, the Safeguarding Canadians' Personal Information Act, at second reading.

On Thursday morning, the House will consider second reading of Bill S-2, the Family Homes on Reserves and Matrimonial Interests or Rights Act. And, after question period, we will turn to Bill S-8, the Safe Drinking Water for First Nations Act, also at second reading.

Finally, on Friday, we will start report stage of Bill C-24, the Canada–Panama Economic Growth and Prosperity Act. This bill would implement our free trade agreement with the Republic of Panama—an agreement whose time has long come. In fact, when I was the public safety minister, I was honoured to be present when the Prime Minister concluded negotiations in Panama City, some 38 months ago.

[John Lawford]

For the time being, the answer is yes, according to the commissioner's guidelines.

Bill C-12 also provides for that, but it has not become law yet.

[John Lawford, Executive Director and General Counsel , Public Interest Advocacy Centre]

Thank you, Mr. Chair.

I am here alone. Janet Lo, my co-counsel, sends her regrets. She's in a lock-up for CRTC on Bell-Astral.

The Public Interest Advocacy Centre is a non-profit organization that provides legal and research services on behalf of consumer interests, and in particular vulnerable consumer interests, concerning the provision of important public services. We have been deeply involved with the Personal Information Protection and Electronic Documents Act, PIPEDA, from a consumer perspective since its passage. We have published several recent reports: one on children's privacy online, one on a do-not-track list, and one on data breaches.

I've given the clerk a copy of references to those and summaries.

We're here today to talk about the immediate future of privacy. It is largely to be defined by services such as social networks. But social networks provide challenges to our concept of personal information and the commercial interests that are involved with that.

PIAC recently brought a complaint to the Office of the Privacy Commissioner of Canada under PIPEDA against Nexopia.com Inc., a social network based in Alberta and largely aimed at a teen audience. This real-life example illustrates the challenges of dealing with privacy and social networks, and unfortunately the inadequacies of PIPEDA to deal with improper privacy practices, even those where the improprieties involve children and teens.

PIAC alleged that Nexopia provided no comprehensible descriptions of the collection, use, and disclosure of the personal information of their largely underage users. We said that the company did not adequately detail its disclosure of information to advertisers, nor did it adequately detail how it used this information to serve up targeted teen ads. We complained that the default settings for personal information like gender, age, location, and pictures were open to the Internet—that is, not even closed to members of the site—and that this was unreasonable and even dangerous for the young users of the site. Finally, we noted that Nexopia appeared to keep personal information forever, even if an account were deleted.

The Privacy Commissioner upheld all our complaints. That was February 2012, some two years after we filed it.

Regarding default settings, the Privacy Commissioner wrote, in part:

We do not consider making portions of a user's profile available to anyone on the Internet to be consistent with users' reasonable expectations, particularly when a user has clearly indicated his or her preference to share information on a more limited basis.

However, Nexopia has said to the Privacy Commissioner that they will not implement the four recommendations related to retention of data. The Privacy Commissioner has had to go to Federal Court to enforce her findings. Why?

First, the Privacy Commissioner has no order-making power. She has no fining power. Social networks that judge privacy findings too inconvenient or expensive, it appears, can continue to operate in a privacy-violating manner.

Second, the refusal reveals the real nature of social networks: they are financed by personal information. Asking a social network to destroy data appears to them like removing an asset from the balance sheet.

The Privacy Commissioner's trip to Federal Court will show if business purposes or the personal privacy of individuals is paramount under PIPEDA. However, the larger issue for you at this committee is how to help design laws to avoid this type of conflict from arising in the first place, particularly in the fast-moving social networking and online space.

Now I'll move to Bill C-12 and breach notification.

LinkedIn and eHarmony suffered large data breaches this spring. Social networks are now major targets of hackers, and there is a risk of exposure of personal information that is not intended for general viewing from these websites. This is in addition to the leaking of personal information from websites noted by the Privacy Commissioner at the end of September in a recent study.

Bill C-12 is intended to amend PIPEDA to provide for data breach notification. However, it does not succeed. It allows the company suffering the breach to make the determination of whether the breach is material enough to even report to the Privacy Commissioner. Part of that determination is an assessment, again made by the company of itself, of whether the cause of the breach or a pattern of breaches indicates a systemic problem.

It's extremely unlikely, in our view, that any company, but particularly a social network that trades in data, will declare that it has a systemic problem with data breaches and data handling that leads to breaches.

Bill C-12 is asking companies to declare that they, in effect, are negligent. As a result, we confidently predict that under Bill C-12 a social network or other online company will almost never notify the Privacy Commissioner of a breach that has not otherwise been made public. Companies are expected to determine whether to report data breaches directly to the consumers as well. They must determine if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.

First, this threshold is very high. It's higher than U.S. state law requirements and it's unrealistic. It's difficult to predict how personal information will be misused.

Secondly, Bill C-12 ignores the blindingly obvious incentive for companies to find no such risk to individuals and avoid notification and its cost. As a result, we confidently predict that under Bill C-12, social networks and other online media companies will almost never notify individuals of a breach that has not otherwise been made public.

There is another model in Canada for data breach laws: the Alberta Personal Information Protection Act. In Alberta, all breaches must be reported to the Privacy Commissioner of Alberta, on pain of fines. The Alberta Privacy Commissioner then determines if the breach is serious enough to notify individuals on a test of potential for any harm.

PIAC studied public attitudes to data breach notification in focus groups in 2011. Overwhelmingly, participants preferred the Alberta-type model to leaving companies to make this decision. We urge this committee to express these concerns about breach notification under Bill C-12 in its report.

I will turn now to privacy policies. Social network privacy policies are “take it or leave it” contracts. The burden of determining what is done with personal information is borne by the user. Yet social networks regularly rely on the consent of users to justify practices and point to the use of the site as the equivalent of consent to the entire privacy policy.

It's PIAC's view that this legal fiction is in fact used in place of informed consent in many social networks. Users simply do not read all the policy, and if they do, they do not understand it. Why is this? This is because major social networks define “personal information” in confusing ways, and none of them define it in the way it is defined in PIPEDA.

Many define personal information as personally identifiable information, which, as you recognize, is a U.S. legal concept. Recently, many larger websites have dropped any definition at all of personal information, only to give examples of treatment of certain data elements like gender or age. The clerk also has a copy, which should have been distributed to you, of wording of privacy policies that we're talking about.

This non-definition of personal information matters because users reading the privacy policy are not able to understand their real rights under PIPEDA in order to launch a complaint or to bring the company into compliance or even to contact the company.

The Privacy Commissioner appeared before this committee and stated that social networking sites do not do a sufficient job of explaining their use of personal information. She said she doubts in these situations that the social networking site has real consent. We think the Privacy Commissioner is right. But the complaint mechanism under PIPEDA is very poor enforcement. She needs order-making and fining power.

PIAC suggests, however, that given the challenges of big data collection by social networking and other online businesses, this committee go further and consider a full enforcement framework such as that for the do-not-call list for companies flouting Canadian privacy law.

I'm going to close with some forward-thinking ideas on social networking and privacy.

First of all, there are many related entities dealing with personal information created at social networking sites in order to monetize that information through advertising and other methods. This committee should study these relationships and consider rules for revealing related parties in personal information trafficking akin to those rules in securities law to bring increased transparency to data flows in social networking sites and marketing companies.

Secondly, the committee should consider a national do-not-track list.

Thirdly, the committee should study the nexus between privacy and competition law, and whether the Competition Bureau actually has a role to play in addressing privacy concerns and where a merger or other practice can reduce competition. For many online markets, competition for eyeballs depends on the currency of personal information or the value of big data.

PIAC thanks the committee for this opportunity to speak. We are happy to answer questions

in both English and French.

Thank you.

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, just to clarify, I would have been quite happy to have consented to the motion had the member not included in it a provision for an additional opposition day. Had the member decided to conclude that NDP was prepared, since its subject for today was food safety, to make the balance of the day the debate on Bill S-11 and then have it proceed to committee, we would have been quite delighted to consent.

In terms of his suggestions on the budget bill, I am looking forward to meeting with him and discussing with him what opportunities might exist there further.

Earlier today, the Minister of Finance introduced Bill C-45, the Jobs and Growth Act, 2012.

This important piece of legislation will bolster Canada’s economy and help improve communities with initiatives that build a strong economy and create jobs, support families and communities, promote clean energy and enhance neutrality of the tax system, and respect taxpayers’ dollars.

We will start second reading debate of Bill C-45 on Wednesday—once honourable members have had a chance to review the bill and discuss it at next week’s caucus meetings. The debate will continue on Thursday and Friday.

I genuinely hope all members will take advantage of the budget bill study week that is available to review the valuable measures that are set out as the second half of our legislative arm of our comprehensive economic action plan 2012. One highlight of the study week will be a briefing arranged by the minister for all hon. members on Monday evening. I hope many MPs can attend, and certainly more than the paltry attendance of opposition members that appeared this spring for the briefing on Bill C-38.

I look forward to a vigorous policy debate on the economy and not on procedural games.

I turn now to the business of the House leading up to Wednesday.

This afternoon we will see the conclusion of the NDP's opposition day. Regrettably, I was personally disappointed that the official opposition did not answer my call last week to lay out the details of its $21.5 billion carbon tax and how it would raise the price of gas, groceries and electricity. Though, I was encouraged that this week in question period the New Democrats actually did acknowledge the subject and raised it.

Tomorrow and Monday will see us resume second reading of Bill S-7, the combating terrorism act. I understand we should finish that debate sometime on Monday, at which that time we will then turn to Bill C-15, the strengthening military justice in the defence of Canada act; Bill S-2, the family homes on reserves and matrimonial interests or rights act; and Bill S-8, the safe drinking water for first nations act.

On Tuesday, we will debate the second reading of Bill S-11, the safe food for Canadians act, unless we find some other approach that would allow us to move on a more urgent basis. Since we did not get unanimous consent to move it forward quickly, we are hopeful there will be some other approach that can be agreed upon to move quickly with it. We hope that if we do debate it that day, we will be able to deal with it quickly and then spend the balance of that day debating Bill C-15 and Bill C-12, the safeguarding Canadians' personal information act.

Privacy

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, Bill C-12 is already out of date. The government is still stuck in a world of eight-track tapes.

This Facebook privacy concern is a concern to millions of Canadians, but the issue is bigger than that.

[Mike Lake, Conservative, Parliamentary Secretary to the Minister of Industry]

Mr. Speaker, this government introduced Bill C-12, which is an important tool for ensuring a stronger digital economy in Canada. We look forward to the oppositions' support in moving that forward.

[Tamir Israel]

I'll talk a little slower.

The growing importance and benefits of social media to Canadians cannot be understated. These are far-reaching and permeate every aspect of our individual, social, and political lives. The innovative and commercial growth of such networks should not be unduly restricted. At the same time, Canadians should not be forced to choose between their privacy rights and their right to participate in this new interactive world.

PIPEDA, which forms the backbone of privacy regulation in Canada, provides a flexible set of principles that cater to the legitimate needs of businesses while providing safeguards for user privacy. While PIPEDA has largely withstood the test of time, the privacy landscape has changed substantially since its enactment, and a decade of experience has exposed a number of shortcomings that should be addressed if the statute is to continue to meet its objectives.

I will quickly say a few words about the shifting privacy landscape and proceed to elaborate on four areas that I think need immediate attention.

In recent testimony before this committee, Professor Valerie Steeves pointed to research indicating growing lack of trust in online companies. A survey conducted for Natural Resources Canada in late 2009 similarly found that respondents' level of trust in different types of organizations to keep their personal information secure is moderate to low. The least trusted were small private sector businesses and social networking sites.

The study similarly found that the ability to control the context in which information is shared increased levels of trust. In another study conducted by researchers at Annenberg and Berkeley, 67% of Americans agreed or strongly agreed that users have lost all control over how personal information is collected and used by companies.

Feeding this sense of lost control is an increasingly complex ecosystem where the scope and nature of data collected increases daily, even as the sophistication of information collection and analysis mechanisms keeps pace. While Google and Facebook have been at the forefront of debates on these issues, numerous other companies are involved. Acxiom, a data broker based in Arkansas, has reportedly collected an average of 1,500 data points on each of its 500 million active user profiles.

Few of these users have heard of Acxiom, let alone had any direct interaction with the company. Yet the profiles, which data brokers such as Acxiom sell, are populated with their browsing habits; the Facebook discussions they have with their friends and family; their sensitive medical and financial information; their ethnic, religious, and political alignments; and even real-world locations visited. All this data is collected, analyzed, and refined into a sophisticated socio-economic categorization scheme, which Acxiom's customers use as the basis of decision-making.

The sheer complexity of the ecosystem that fuels databases such as Acxiom's defies any attempt to articulate within the confines of a privacy policy. A number of jurisdictions are looking at ways of addressing the need for greater transparency and choice. I will briefly focus on four here that I think are relevant specifically to PIPEDA. I'll point out as well that the nature of the data being collected in this ecosystem is also increasing in sensitivity. Newly emerging capacities are aiming to incorporate real-time location and even emotional state into the categories of information that are available for targeting. I'll touch on four changes I think we should focus on. The first is transparency.

Greater transparency is needed. To this end, the United States Federal Trade Commission has recently stated it will push data brokers to provide centralized online mechanisms that will help users discover which data brokers have collected their data. This can serve as the basis for the exercise of other user rights.

Informing users can be achieved in a number of contexts through greater integration of notification into the service itself. This not only allows for greater flexibility and nuance in notification, but also increases privacy salience by reminding users in context of the privacy decisions they are making. In addition, elements of privacy policies can be standardized, but care must be taken not to oversimplify data practices that are in reality complex. The dangers of oversimplification are that organizations will begin to rely on blanket and categorical consent, which are simple but do not provide customers or advocacy groups the details they need to properly assess their practices.

Another area I'd like to touch on is privacy by default or privacy by effort, which is an analog to that.

Transparency alone is not enough to protect privacy in this interconnected age we are in. In a recent consultation process on online privacy, it was noted that many online services are public by default and privacy by effort. New users will rarely know how to configure the complex web of the often conflicting privacy control services that are offered when first signing on. Settings constantly shift and change, as new ones are introduced and old ones replaced, or when new features are added to existing services. Simply maintaining a constant level of privacy is a never-ending effort.

Compounding such efforts is a tendency for social networking sites to make occasional tectonic shifts in the constitution and nature of their services. These are often imposed on ingrained users as “take it or leave it” propositions. At other times, pre-selected defaults are used to nudge users in directions that are very different from the service they have grown accustomed to.

As you've heard from other experts, the devil is indeed in the defaults. Stronger protections are needed to ensure new services and settings are introduced with privacy-friendly defaults that reflect the expectations of users and the sensitivity of the data in question, not whatever configuration is best fitted to the service provider's business model.

Under PIPEDA, the form of consent should already be tailored to user expectations and the sensitivity of the data that might be affected. However, in order to firmly ingrain this concept in service design, privacy by default should be explicitly adopted as a principle under PIPEDA.

Another area I want to touch on briefly is enforcement and process.

The committee has heard from a number of parties about the importance of ensuring that the Office of the Privacy Commissioner can enforce its powers. Adding bite to PIPEDA is critical for a number of reasons. First, it is necessary in order to provide incentives for compliance. Currently there are very few penalties for non-compliance. In most cases the most an organization can expect is the threat of being publicly shamed for non-compliance. Second, having these powers in place will assist the Office of the Privacy Commissioner in its interactions with large multinational organizations so it can carry out its mandate in protecting the privacy of Canadians.

In addition to adding penalties, procedural changes to the OPC's investigative and compliance framework should be explored. Compliance with OPC recommendations in a social networking context may be a long and complicated road, requiring changes to system design. However, under PIPEDA the OPC's legal mandate to exercise its powers over a particular complaint ends 45 days following the issuance of an official finding. The mechanism lacks the flexibility necessary to ensure Privacy Commissioner recommendations are carried out adequately.

Finally, I'll touch briefly on breach notification requirements.

Canada is in dire need of a breach notification obligation. Such an obligation will improve incentives to build stronger technical safeguards and provide users with opportunities to redress harm, such as identity theft and the potential humiliation that may result from a breach of their data.

Bill C-12, which is currently in first reading, provides a workable framework for breach notification, but it requires fixes and a commitment to introduce penalties for non-compliance if it is to be effective.

I would be happy to elaborate further on any of these points. CIPPIC plans to file a more detailed brief with the committee at a later point.

Thank you very much for your time and attention.

[Dr. Vincent Gautrais, Full Professor, Université de Montréal]

Thank you, Mr. Chair.

I would like to use my 10 minutes to share the opinion of someone who is not quite an expert on privacy issues. For some 20 years now, I have been interested in the relationship between the law and technology. It is from that perspective that I would like to expand on three points. Very often, I discuss those points to deal with the complexity that characterizes new technology. Those three points are very simple: who, what and how.

Let's begin with the “who”. Who should take action when it comes to those issues? I would like to begin with the first instinct we have—that of thinking that the legislator should act in such matters. I would nevertheless like to repeat the opinion of an old civil lawyer who said that legislating should be done carefully. This means that, in such a new field—which is so poorly controlled—adopting a piece of legislation very quickly is often a factor that prevents our habits from developing.

Therefore, I think that, in terms of legislation, we should be careful. We should take a step back and focus more on establishing a strictly minimalist approach in legislation, without developing, in my opinion, any new concepts. We have seen such concepts in Europe—including the “right to forget”, which was developed in a number of European pieces of legislation and seems to me overly difficult to apply.

Conversely, even if the goal is to limit the legislator's role, it does not mean that nothing should be done. There are some possibilities when it comes to privacy management as far as organization goes. I think that the options established in Bill C-12 are very interesting, especially with regard to providing the Office of the Privacy Commissioner of Canada with a bit more power.

This means that my second stakeholder in terms of privacy is the Office of the Privacy Commissioner. Let's compare what we do here with what is done elsewhere, in all of western democracies or, at least, in Europe. If we compare ourselves with countries such as Germany, Sweden or France, we realize that the office has fairly limited prerogative powers. Overall, the resources and the number of people who work within the Office of the Privacy Commissioner are, in Canada, half of those in Europe. I feel there could be some more resources to help develop habits. That's something I will talk to you about later. So it's a matter of informal standards in terms of privacy management.

As for the third stakeholder that would be likely to act in privacy matters, I have in mind organizations themselves—in other words, companies and public organizations that manage data. Pursuant to a point I will develop later on, I feel that those organizations are becoming increasingly accountable when it comes to the way they must manage personal information. The notion of accountability is hard to render in French. It has developed in all international fora—increasingly so over the past few years, or since 2004-2005. The notion of accountability is a concept that, in my opinion, should be promoted in this committee's projects.

So there you have the “who”, and that's what I had to say about the stakeholders who should be involved in those issues.

Let's now talk about the “what”. I would like to use a single sentence to summarize my thoughts on this: I fear the shade much more than the light. What do I mean by that? There are many fantasies and fears when it comes to social media. There are of course some genuine fears. My opinions differ from those of my colleagues, but there are some real fears. There are also some imaginary fears. In some respects, what I can put on a Facebook page does not frighten me at all. I encourage my three children to use Facebook, but I am sorry to say that they don't want to.

However, it's quite possible to use Facebook without privacy being affected. If schools and the Office of the Privacy Commissioner educate us, we should be able to manage that. I am referring to Twitter. Two days ago, the office posted a cartoon on Twitter to explain how people should manage privacy. That kind of a solution is not of a strictly legal nature. Law is not the only possibility in life; there are other solutions that can help change Facebook or Google users' behaviour.

In many ways, I have no fear of how Facebook may use information. I am also not worried about Google Street View, and that is something I would like to discuss. I am bringing this up because the Office of the Privacy Commissioner has made some recommendations against Google Street View. However, Google Street View is not dangerous. I have no problem with being seen in front of my home taking out the garbage. This is one example of imagined fears that are sometimes associated with social media.

That being said, there are nevertheless real problems and fears. We must keep an eye on new behaviours, and I agree with my colleagues when it comes to that. What scares me more is when the objective is changed, the reason why information was placed on Facebook or Google. In many respects, those changes of objective are made through a contract no one reads. An average social media user would have to spend 20 hours a month to read the privacy policies that apply to Google and all the websites they visit. That is unfeasible. Saying that protection goes through information and consent is an illusion. As Professor Kerr mentioned, that is a totally inapplicable legal tool.

As my colleague was saying, there are some cases where consent should not be given. For instance, some law firms—in Quebec and the rest of Canada—ask their students for their Facebook account to see who they are in real life. Such cases go against the law, and a judge could consider them to be a violation of the law. In fact, it may be useful to explicitly state that in a piece of legislation.

I have covered the “what”, but I will now talk about the “how”. I would like to come back to the notion of accountability, which is becoming increasingly developed. According to that notion, organizations must establish policies that will make it possible to objectify, if I may put it that way, their diligence in managing personal information. Forcing Facebook, Google or any other public sector company or organization to show everyone how they manage data internally would be a way to check how diligent they are. That notion is fundamental and very useful. It is actually the basis of an agreement concluded last November between the Federal Trade Commission, in the U.S., and Facebook, whereby the latter committed to open its books and show its management of data over a 20-year period. The future lies in the notion of accountability.

Once again, we have to be careful. This is coming from a technology expert who goes beyond the notion of privacy. There have been some rather unfortunate cases, especially in the area of securities. In 2002, several financial scandals erupted in the United States. To remedy that situation, all companies listed on the stock exchange were asked to open their books and produce internal reports to show how they were managing financial information. Many U.S. authors showed that large quantities of documents had been produced and financed by accounting firms, some of which were at the source of the financial scandals. Some $60 billion or $70 billion later, they ended up with a magnificent documentation that, in the end, is sometimes difficult to apply.

That is why this notion of accountability should not be introduced through a piece of legislation, but rather through informal practice standards, through codes of conduct. With a more negotiated approach, there would be no law imposing things within a generally quite short time frame, and the situation would be conducive to dialogue for establishing practice standards. Informal standards and codes of conduct are often criticized because they are not restrictive enough. When I compare our privacy system with the European one—with fairly substantial resources for monitoring the strict application of the legislation—it seems to me that a more in-between approach, a more negotiated approach, could have better results.

Thank you.

Extension of Sitting Hours

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

moved:

That, pursuant to Standing Order 27, the ordinary hour of daily adjournment shall be 12 midnight, commencing on Monday, June 11, 2012, and concluding on Friday, June 22, 2012, but not including Friday, June 15, 2012.

Today I rise to make the case for the government's motion to extend the working hours of this House until midnight for the next two weeks. This is of course a motion made in the context of the Standing Orders, which expressly provide for such a motion to be made on this particular day once a year.

Over the past year, our government's top priority has remained creating jobs and economic growth.

Job creation and economic growth have remained important priorities for our government.

Under the government's economic action plan, Canada's deficits and taxes are going down; investments in education, skills training, and research and innovation are going up; and excessive red tape and regulations are being eliminated.

As the global economic recovery remains fragile, especially in Europe, Canadians want their government to focus on what matters most: jobs, economic growth and long-term prosperity. This is what our Conservative government has been doing.

On March 29, the Minister of Finance delivered economic action plan 2012, a comprehensive budget that coupled our low-tax policy with new actions to promote jobs and economic growth.

The 2012 budget proposed measures aimed at putting our finances in order, increasing innovation and creating suitable and applicable legislation in the area of resource development in order to promote a good, stable investment climate.

The budget was debated for four days and was adopted by the House on April 4. The Minister of Finance then introduced Bill C-38, Jobs, Growth and Long-term Prosperity Act, the 2012 budget implementation bill. The debate at second reading of Bill C-38 was the longest debate on a budget implementation bill in at least two decades, and probably the longest ever.

On May 14, after seven days of debate, Bill C-38 was passed at second reading.

The bill has also undergone extensive study in committee. The Standing Committee on Finance held in-depth hearings on the bill. The committee also created a special subcommittee for detailed examination of the bill's responsible resource development provisions. All told, this was the longest committee study of any budget implementation bill for at least the last two decades, and probably ever.

We need to pass Bill C-38 to implement the urgent provisions of economic action plan 2012. In addition to our economic measures, our government has brought forward and passed bills that keep the commitments we made to Canadians in the last election.

In a productive, hard-working and orderly way, we fulfilled long-standing commitments to give marketing freedom to western Canadian grain farmers, to end the wasteful and ineffective long gun registry, and to improve our democracy by moving every province closer to the principle of representation by population in the House of Commons.

However, in the past year our efforts to focus on the priorities of Canadians have been met with nothing but delay and obstruction tactics by the opposition. In some cases, opposition stalling and delaying tactics have meant that important bills are still not yet law. That is indeed regrettable.

In the case of Bill C-11, the copyright modernization act, a bill that will help to create good, high-paying jobs in Canada's creative and high-tech sectors, this House has debated the bill on 10 days. We heard 79 speeches on it before it was even sent to committee. This is, of course, on top of similar debate that occurred in previous Parliaments on similar bills.

It is important for us to get on with it and pass this bill for the sake of those sectors of our economy, to ensure that Canada remains competitive in a very dynamic, changing high-tech sector in the world, so that we can have Canadian jobs and Canadian leadership in that sector.

Bill C-24 is the bill to implement the Canada-Panama free trade agreement. It has also been the subject of numerous days of debate, in fact dozens and dozens of speeches in the House, and it has not even made it to committee yet.

Bill C-23 is the Canada-Jordan economic growth and prosperity act. It also implements another important job-creating free trade agreement.

All three of these bills have actually been before this place longer than for just the last year. As I indicated, they were originally introduced in previous Parliaments. Even then, they were supported by a majority of members of this House and were adopted and sent to committee. However, they are still not law.

We are here to work hard for Canadians. Adopting today's motion would give the House sufficient time to make progress on each of these bills prior to the summer recess. Adopting today's motion would also give us time to pass Bill C-25, the pooled registered pension plans act. It is a much-needed piece of legislation that would give Canadians in small businesses and self-employed workers yet another option to help support them in saving for their retirement. Our government is committed to giving Canadians as many options as possible to secure their retirement and to have that income security our seniors need. This is another example of how we can work to give them those options.

In addition to these bills that have been obstructed, opposed or delayed one way or another by the opposition, there are numerous bills that potentially have support from the opposition side but still have not yet come to a vote. By adding hours to each working day in the House over the next two weeks, we would allow time for these bills to come before members of Parliament for a vote. These include: Bill C-12, safeguarding Canadians' personal information act; and Bill C-15, strengthening military justice in the defence of Canada act. I might add, that bill is long overdue as our military justice system is in need of these proposed changes. It has been looking for them for some time. It is a fairly small and discrete bill and taking so long to pass this House is not a testament to our productivity and efficiency. I hope we will be able to proceed with that.

Bill C-27 is the first nations financial transparency act, another step forward in accountability. Bill C-28 is the financial literacy leader act. At a time when we are concerned about people's financial circumstances, not just countries' but individuals', this is a positive step forward to help people improve their financial literacy so all Canadians can face a more secure financial future. Bill C-36 is the protecting Canada's seniors act which aims to prevent elder abuse. Does it not make sense that we move forward on that to provide Canadian seniors the protection they need from those very heinous crimes and offences which have become increasingly common in news reports in recent years?

Bill C-37 is the increasing offenders' accountability for victims act. This is another major step forward for readjusting our justice system which has been seen by most Canadians as being for too long concerned only about the rights and privileges of the criminals who are appearing in it, with insufficient consideration for the needs of victims and the impact of those criminal acts on them. We want to see a rebalancing of the system and that is why Bill C-37 is so important.

Of course, we have bills that have already been through the Senate, and are waiting on us to deal with them. Bill S-2, which deals with matrimonial real property, which would give fairness and equality to women on reserve, long overdue in this country. Let us get on with it and give first nations women the real property rights they deserve. Then there is Bill S-6, first nations electoral reform, a provision we want to see in place to advance democracy. Bill S-8 is the safe drinking water for first nations act; and Bill S-7 is the combatting terrorism act.

As members can see, there is plenty more work for this House to do. As members of Parliament, the least we can do is put in a bit of overtime and get these important measures passed.

In conclusion, Canada's economic strength, our advantage in these uncertain times, and our stability also depend on political stability and strong leadership. Across the world, political gridlock and indecision have led to economic uncertainty and they continue to threaten the world economy. That is not what Canadians want for their government. Our government is taking action to manage the country's business in a productive, hard-working and orderly fashion. That is why all members need to work together in a time of global economic uncertainty to advance the important bills I have identified, before we adjourn for the summer.

I call on all members to support today's motion to extend the working hours of this House by a few hours for the next two weeks. For the members opposite, not only do I hope for their support in this motion, I also hope I can count on them to put the interests of Canadians first and work with this government to pass the important bills that remain before us.

[Dr. Ann Cavoukian]

Thank you very much for that question.

I think there's one way that we can do it. I'll refer you to a paper that we released this past summer—I'm trying to remember the name of it—“Privacy by Design in Law, Policy and Practice”. The idea for the paper came from Commissioner Pamela Jones Harbour, who is a former commissioner with the Federal Trade Commission. When she was talking to me about privacy by design, she said we could impose it as a requirement, a condition, in our consent decrees, in decisions that the FTC issues upon completion of an investigation, and we could include it as something on a go-forward basis that a company would have to follow proactively from that point on.

Justice La Forest kindly reviewed the paper that I just mentioned, which you can find on our website, and he said that privacy by design is an excellent idea that should be incorporated into administrative means of law addressing privacy on a go-forward basis.

One way we could do it—I know that Bill C-12 is looking at changes to PIPEDA—would be to have some way of saying that on a go-forward basis, at the conclusion of an investigation, a company would be required to follow privacy by design in any particular area that was problematic.

The other thing about privacy by design is that it's not a punishment. We always say privacy is good for business. There should be a privacy payoff to businesses that follow good privacy practices. Consumer confidence and trust are being eroded very quickly in this day and age, and you can strengthen that on the part of your customers. It is not something that is in fact a stick. It is both a carrot and an inducement to introduce privacy protections in a way that ultimately will save the company resources, because they'll be able to avoid privacy infractions and privacy investigations, and potentially, class-action lawsuits that are coming out.

There's so much happening on the privacy front that when we talk to companies about privacy by design we do it because they invite us to tell them how to do it. They want to do it, not only for the right reasons but for business-related benefits as well.

I think there is a way forward by imbedding it into new regulatory structures.

[Dr. Michael Geist, Canada Research Chair, Internet and E-commerce Law, University of Ottawa, As an Individual]

Thank you very much.

Good morning. My name is Michael Geist. I am a law professor at the University of Ottawa, where I hold the Canada research chair in Internet and e-commerce law. I was a member of the national Task Force on Spam, and I currently serve on the Privacy Commissioner of Canada's expert advisory committee, but I appear before this committee today in a personal capacity representing only my own views.

My opening comments will identify several areas for potential government action, but I want to provide a bit of context with three key caveats.

First, which I think may be stating the obvious, is that social media is an enormously important and positive development. The number of users is staggering and its role as a key source for communication, community, and political activity grows by the day. The opportunities presented by social media should be embraced, not demonized, in my view, and government should be actively working to ensure that it incorporates social media into its policy consultation processes.

Second, Canada has played a leadership role, to a certain extent, in the use and regulation of social media. The Privacy Commissioner of Canada was the first to conduct a major privacy investigation into Facebook and has led on other issues with respect to social media and Internet companies.

Third, while we have had some influence through those investigations, Canada has not led in creating the social media services used by millions around the world. I believe that the failure to articulate and implement a national digital economy strategy comes back to haunt us in these circumstances, where the ability to place an unmistakable Canadian stamp on social media is undermined by the policy failures that have done little to encourage the development of Canadian e-commerce and social media.

With those caveats, what is there to be done? I'd like to focus on four areas of interest.

First, I think we need to finish what we've started.

The government has introduced and even passed legislation that can be helpful in addressing some of the concerns that arise from social media, yet these initiatives have stalled short of the finish line. Anti-spam legislation, for example, received royal assent in 2010, yet has still not taken effect as final regulations have not been approved. In fact, Industry Canada officials now indicate that it could be well into 2013 before the regulations take effect. Given the amount of work that went into this legislation, I find it shocking that it has been left in limbo.

Moreover, Bill C-12, the PIPEDA reform bill that seeks changes arising from the 2006 privacy review continues to lag in the House of Commons, with there frankly seeming to be no interest in moving forward with the bill. Indeed, I'd argue that the bill is even now outdated, and a full PIPEDA review to address emerging concerns such as order-making power—as you just heard—and damages, and tougher security breach requirements than those found in the bill is needed. In fact, the Bill C-12 security breach reporting rules are primarily bark with little bite, given the absence of penalties for failure to comply.

Successive governments have promised a digital economy strategy for years and have failed to deliver. The strategy has come to be known as the “Penske file”, a reference to the Seinfeld episode that involves working on an imaginary file. While other countries are now years into implementing their strategies, in Canada we still lag behind.

I think it also should be noted that these issues must increasingly be addressed in concert with the provinces. The line between federal and provincial jurisdiction on many of these issues is blurry, and legal challenges against federal legislation is a real possibility. Work is needed to begin to develop minimum standards that can be implemented at the provincial level, should federal leadership be challenged in the courts by companies seeking to circumvent their privacy obligations.

Second, the devil is in the defaults. In many respects, social media and Internet companies are the most powerful decision-makers when it comes to privacy choices. As my colleague Professor Ian Kerr says, the devil is in the defaults. In other words, the choices made by leading social media companies with respect to default privacy settings are the de facto privacy choice for millions of users. Given the increasing pressure to generate revenues, we can expect that those default choices are going to change in more aggressive ways to make use of user data.

There are examples of companies that are doing good work in this area. Twitter recently implemented do-not-track options that won plaudits from the Federal Trade Commission in the United States. Google offers its users transparency tools so they can obtain detailed information about what information is collected, some of the ways Google uses it, and how they can modify some of their privacy choices. The company has also been transparent about law enforcement requests for information and copyright takedown demands.

There needs to be continued work on these defaults, as well as initiatives to provide users with greater information and transparency, and steps to ensure that companies live by their privacy commitments.

Third is the issue of lawful access. The introduction of Bill C-30 brought with it an avalanche of public outrage and concern over proposed Internet surveillance legislation. While much of the focus was on mandatory warrantless disclosure of subscriber information by telecom service providers, the potential for social media and big data Internet sites to serve much the same purpose cannot be overlooked.

A recent investigation by the Privacy Commissioner of Canada into Nexopia, a Canadian social network, identified hundreds of law-enforcement requests for customer name and address information, frequently for accounts that should have been deleted months earlier. Social media, as we've heard, generates a treasure trove of personal information that must enjoy full privacy protection and court oversight before disclosure. Indeed, documents that I recently obtained under access to information indicate that Public Safety is thinking about how these rules are applied to social media sites and services. I believe that Bill C-30 needs to go back to the drawing board to effectively account for these privacy concerns.

Fourth is the question of new legal issues, which Professor Scassa has identified a number of. I would argue that while much can be done to use or augment existing rules, social media and Internet sites do raise some unique issues that may require targeted responses. In the interest of time I would like to quickly identify two.

First is the issue of “do not track”. As you may know, cookies can be used to trace the web-browsing habits of users, including when they visit third-party sites. For example, Facebook inserts a cookie on user browsers that traces your activity as you surf the Internet. Any site with nothing more than a Facebook “like” button, as found on Conservative, NDP, and Liberal websites, means that Facebook records a visit to that site and retains that information for months. A growing number of sites, including Yahoo, AOL, and Twitter, respect the functionality found in Firefox browsers that allows users to choose not to be tracked. Google has said it will implement similar technology in its Chrome browser.

However, many sites have been slow to adopt the do not track option, and Facebook has thus far declined to do so. Given the failure of the industry to self-regulate, it is appropriate for government to step in with stronger measures to ensure that this form of user choice is implemented and respected.

Second is the growing problem of social media misuse. For example, in recent months there has been an increasing number of stories of employers requiring employees to provide their Facebook user ID and password as a condition of a job interview. Seeking the same information with direct questions would typically be prohibited, so this is used to circumvent long-standing standards and principles within employment law. In response, the State of Maryland recently passed a law banning employers from requiring employees or job applicants to provide access to their personal digital and social media accounts. Several other states in the United States are working on similar legislation, and I believe that Canada should follow suit.

Thanks very much for your attention.

[Janet Goulding]

I think the question gets back to digital literacy, and I would agree that it's very hard for consumers to sift through the plethora of information that's probably available on various Internet applications. I think the issue of digital literacy is one that will come back over and over again. Placing requirements on organizations to communicate in a way that is clear and understandable to the target audience is key, and again, something that we hope to see brought into force with the passage of Bill C-12.

[Janet Goulding]

Thank you for the question. I do think you raise a very important point. Digital literacy has been an issue that has been raised over and over again in the context of having people understand what their privacy risks are online. I do think digital literacy needs to be a priority. Awareness is an important element. It's important, as the commissioner pointed out, because schoolchildren are coming online sooner and sooner. For them to understand the potential risks they face when they put their information online is key.

Again, I mentioned to you briefly that one of the amendments in Bill C-12 will impose a new obligation, or a clearer obligation, on organizations to target their messaging at their target audience. When you're talking about children, or frankly, the average Internet user, it's important they're aware that there are measures they can take to further protect their privacy online.

[Janet Goulding]

I think the commissioner was pointing to the fact that Canada is one of the few remaining countries that do not have mandatory data breach reporting requirements. Therefore, as I indicated, it is important for Canada to catch up and pass the amendments in Bill C-12 that are currently before the House.

In terms of going forward, the commissioner made reference to the overall compliance powers under the act and suggested that the second parliamentary review would be a good opportunity to take a second look at that. Perhaps that's something parliamentarians would like to do.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Unfortunately, I think we are really lagging behind when it comes to everything Internet-related. I think that a lot of work needs to be done and that it is better to be proactive than wait until there's a disaster.

On that same topic, the commissioner, Ms. Stoddart, said in her testimony, and as you explained in your presentation, that Canada is lagging behind with respect to standards for data breach. Perhaps Bill C-12 doesn't contain enough measures.

Can you please explain why we lag so far behind when it comes to informing users about breaches of their personal information?

[Janet Goulding, Director General, Governance, Policy Coordination and Planning, Department of Industry]

Thank you, Chair.

I'd like to introduce my colleagues who are with me today: Bruce Wallace, director of security and privacy policy, and Jill Paterson, a policy analyst with our digital policy branch.

Your committee has chosen to study a very important and timely issue. The protection of personal information online is a prerequisite for a strong global digital economy. I am here today to provide some background on the federal legislation that protects the privacy of Canadians in commercial transactions, online and elsewhere, the Personal Information Protection and Electronic Documents Act or PIPEDA.

Since it was implemented, PIPEDA has provided a solid foundation for the protection of privacy online. Canada's federal private sector privacy law is regarded around the world as a model for other countries to follow when seeking ways to protect the privacy of individuals. Much of its strength comes from the manner in which PIPEDA addresses privacy in a technologically neutral way, using a flexible, principle-based approach.

PIPEDA deals with two distinct issues. Part 1 sets out the privacy protection obligations under the act. Parts 2 to 5 deal more with electronic documents than with privacy, and as such are not relevant to your current study.

Part 1 of PIPEDA sets the rules for the private sector in protecting personal information used in the course of business. It establishes clear ground rules that govern the collection, use and disclosure of personal information.

The act balances two central considerations: the need to protect the privacy of individuals, and the need of organizations to collect, use, or disclose personal information in the course of commercial activities. Striking this balance is particularly relevant in the online environment, where large amounts of information can be rapidly collected and stored, and financial transactions can be completed in just a few seconds.

There are some key features of the act I'd like to touch on today.

First, the act applies only to personal information that's used for commercial purposes. It applies to personal information in all formats—electronic and non-electronic. The act applies across the economy as a whole, not just to individual sectors.

Second, the law is based on a set of principles taken from the Canadian Standards Association's Model Code for the Protection of Personal Information. The code was developed by the private sector and consumer representatives and was adopted well before the act came into force. The code is a set of 10 core privacy principles, which were incorporated into schedule 1 of the act.

I'd like to draw your attention to the most central principle, which is the need for consent. Privacy legislation in Canada, and in many other countries, is founded on the principle of consent, whether that be expressed or implied, to collect, use, and disclose personal information.

The act also requires that any collection, use, or disclosure of personal information by an organization should be considered by a reasonable person to be appropriate in the circumstances. This is an overarching test that applies to all provisions of the act. This requirement brings a significant degree of flexibility to the legislation, allowing PIPEDA to remain applicable while social norms, behaviours, and expectations change over time and in different situations, both online and offline.

PIPEDA first came into force in 2001, before the onset of online services and activities—such as Twitter, YouTube, Google, and Facebook—which today we take for granted. Yet as the Internet has evolved, and as new services have been introduced, the legislation has proven to be an effective tool. Its flexibility, resulting from its technology-neutral and principles-based approach, has enabled Canada's Privacy Commissioner to address the challenges that have arisen online, including in social media environments. She has enforced privacy provisions on an international scale against some of the world's largest online service providers, including Google and Facebook.

For example, following an investigation by the commissioner, Facebook took corrective action to bring practices in line with obligations under PIPEDA. Facebook agreed to provide information to help users better understand how their personal information will be used so that they can make more informed decisions about how widely to share that information.

Overall, the legislation continues to provide a robust framework on which to find a balance between business practices and protecting the privacy of Canadians. However, technological innovation, combined with continual changes to individuals' online practices, highlight the importance of reviewing PIPEDA to ensure that it can appropriately address emerging challenges.

In particular, the development of applications for individuals to share information about themselves—a key aspect of what is known as "Web 2.0"—is changing online behaviour. Much personal information is volunteered by individuals themselves. And despite being active participants in the flow of personal information, many users may not fully understand the way their information is used, or the associated privacy risks.

Research indicates that social media users may not anticipate how broadly accessible information they post will be. In addition, the use of "cookies" and other online tracking tools is pervasive, and yet largely invisible to the average Internet user. The potential exists for personal information to be aggregated and used in ways which the individual may never have even imagined and with which they may disagree.

There are complex issues involved in the development of policy frameworks to maintain privacy protection in this environment. Canada is one of many jurisdictions currently grappling with this. The OECD, for example, is currently conducting a review of its privacy guidelines, which were the first internationally agreed-upon set of principles and which influenced the development of the CSA model code, upon which PIPEDA is based.

Likewise, a good piece of legislation like PIPEDA can be made even better with regular review to ensure that it keeps pace with advancing technology and evolving business models.

Bill C-12, the Safeguarding Canadians Personal Information Act, will update PIPEDA in a number of important ways. The bill, which is awaiting second reading in the House of Commons, is the result of the first review of the act, which was undertaken by your predecessors on this committee in 2006-2007. At that time the committee concluded that no major changes to the act were needed; however, they did make a number of recommendations aimed at improving some elements, notably the need for mandatory data breach reporting requirements.

Following the committee's report, Industry Canada conducted extensive consultations, leading to the government response, which indicated that several amendments to PIPEDA would be made to address the committee's recommendations. These amendments were first tabled in May 2010, but subsequently died on the order paper. The amendments were later reintroduced as Bill C-12, which was tabled in September of 2011.

Significantly, Bill C-12 will create a powerful tool to protect and empower consumers online. The bill establishes a framework under which businesses must notify customers when their personal information has been lost or stolen. Canada's Privacy Commissioner has long called for a legislative approach to data breach notification. In 2007, her office published voluntary breach notification guidelines, but she has expressed concern that not all businesses are reporting data breaches, nor have all organizations taken appropriate security precautions to protect their holdings of personal information.

Bill C-12 requires organizations to notify individuals in cases where a breach poses a real risk of significant harm, such as identity theft or fraud or damage to reputation. The Privacy Commissioner will also be informed of any material breach, thus allowing her to exercise oversight of compliance with the new requirements. Consistent with her current compliance powers, the Commissioner will be able to publicly name organizations that fail to meet their obligations if she feels this is in the public interest. This is a powerful inducement for organizations to act in good faith. In fact, we have seen this power compel change in the practices of well-known social media companies such as Facebook and Google. Several high-profile data breaches in the past several years, such as those experienced by Sony and the large e-mail marketing firm Epsilon, have underscored the need to pass this bill and its new notification requirements quickly.

The bill also includes enhancements to the consent provisions designed to protect the privacy of minors online. Research shows that children may not have the capacity to understand the consequences of sharing personal information. Not all marketing activity directed at children is inappropriate; however, some online services surreptitiously collect personal information about children in an environment that is often designed to look like playgrounds or educational websites. Therefore, Bill C-12 requires organizations to make a reasonable effort when collecting the personal information of minors to clearly communicate why it is being collected in a way that would be understood by the target audience.

We believe these changes are an important step towards ensuring that our privacy legislation continues to protect Canadians.

Thank you for the opportunity to come before the committee today. My colleagues and I would be happy to take your questions.

[Jennifer Stoddart]

Yes, honourable member. I think the changes that Bill C-12 would bring are very welcome, but I don't think they go far enough. We're now halfway through 2012, and as I mentioned in my presentation, Canadian privacy legislation has lagged behind the reforms in other major countries, and so there isn't much incentive for corporations to invest in the kind of software or personnel training that makes Canadians' data safer. So I think basically the bill could be strengthened.

[Dean Del Mastro, Conservative, Peterborough, ON]

Bill C-29, which was in the former Parliament, made some changes to PIPEDA, and Bill C-12, which was reintroduced on September 29, 2011, had a key amendment that required organizations to report data breaches—referred to in the bill as breaches of security safeguards involving personal information—to the Privacy Commissioner and notify affected individuals when there is real significant harm, such as identity theft or fraud.

I have a lot of folks in my community who are concerned about identity theft. It seems that every once in a while we'll hear about a significant security breach. In fact, your office has reported on some of them. This reporting requirement for security breaches, is it something you would support, these changes that are suggested in Bill C-12?

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you.

Finally, we have two bills before the House that could have huge implications for Canadian privacy rights: the update to the PIPEDA, Bill C-12; and then Bill C-30, Minister Vic Toews' snooping law.

Have you done any analysis of the potential impact on your department in terms of information?

Business of the House

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, on the contrary. It has been suggested in the past when we have had budgets on Thursdays that we were doing that so we could go out and talk to Canadians about it for several days. Clearly, our interest is to tell Canadians about our economic action plan 2012 which is focused on keeping taxes down and creating jobs and economic growth for Canadians. We hope we will be able to speak about it a lot to Canadians. We are confident that they will see that we share their priorities strongly. I thank the opposition House leader for giving me the opportunity to explain that.

We will conclude this hard-working, productive and orderly week in Parliament by continuing debate on Bill C-31, the protecting Canada's immigration system act this afternoon and tomorrow. We will also debate that bill on Monday, March 26.

Next week is a constituency week where we will all be hard at work in our ridings.

The highlight of the week we return to Ottawa will be when the Minister of Finance rises in the House to present Canada's economic action plan 2012. That will be on Thursday, March 29 at 4 p.m. Canadians can look forward to our economic action plan which will include, as I indicated earlier, important measures focused on jobs and economic growth.

I understand that the Standing Committee on Finance agreed to a responsible work plan for its study of the financial system review act, Bill S-5 so that this House can pass the bill before Canada's banking laws expire in mid-April. Canada has the world's soundest banking system. It is important that we keep it this way. That is why I trust we will see a responsible approach to this bill in the House, similar to what we saw at committee. In anticipation of the bill being reported back to the House tomorrow afternoon, I will be giving priority to report stage and third reading of Bill S-5 on Tuesday, March 27 and Wednesday, March 28.

If we have additional time on those days, I hope we can finish second reading debate of Bill S-4, the Safer Railways Act, and then deal with Bill C-12, the Safeguarding Canadians' Personal Information Act, at second reading.

On Thursday, March 29, we will resume debating Bill C-24, the Canada–Panama Economic Growth and Prosperity Act, before question period. After question period, the House will turn to Bill C-15, the Strengthening Military Justice in the Defence of Canada Act.

Friday, March 30, shall be the first full day of debate on the budget.

[Susan Truppe, Conservative, London North Centre, ON]

Thank you.

From all the different witnesses we've heard, as well as the various types of abuse of the elderly, in many ways financial abuse is coming to the forefront.

Apart from funding of the new horizons for seniors program; the ad campaign that's going to come out again; our Speech from the Throne; the pledge for stiffer penalties in Bill C-12, an act to amend PIPEDA, which would allow our financial institutions to be better able to identify and protect seniors from abuse, do you have anything to offer to the committee in terms of the ways that government and the public could better fight financial abuse?

[David Christopherson, NDP, Hamilton Centre, ON]

From a numbers point of view, the government's previous bill—and I'm not trying to drag you into the politics of it, I totally respect the lines; however, the previous government bill had a different resulting increase in seats for the provinces, and it was apparently because it was based on a previous census.

Now they're using updated numbers, and I'm still not quite sure what they mean by “updated numbers”, because it's only a matter of a few months between the change the government ran on Bill C-12 and their coming into power and saying here's a new bill, we've got new numbers.

Just strictly from a numbers point of view, can you explain to me what's new?

[Joe Comartin, NDP, Windsor—Tecumseh, ON]

Exactly. That's the point.

So the formula, that formula, was available when Bill C-12 was introduced.

[Judith A. Wahl, Executive Director, Advocacy Centre for the Elderly]

I too want to thank you for giving me the opportunity to present to you. I apologize for the lack of a written submission. I only got the call last week to present, but I will be providing some other written material for your review.

I want to give you a context for my remarks. I work at the Advocacy Centre for the Elderly. I'm the senior lawyer. I'm a legal practitioner. As you can tell from my grey hair, I'm an old lawyer. I've been a lawyer now for 35 years, and I've been at the Advocacy Centre for the Elderly for 27 years.

The Advocacy Centre for the Elderly is a community legal clinic that provides legal services to low-income seniors across the province of Ontario. All of our practice is focused on legal problems experienced by older adults. Almost all of our litigation is related to various forms of abuse. The majority of our casework and client representation involves advice to and representation of older adults who are victims of abuse, primarily by family or close friends, people they expected to trust but who then took advantage of them. We've dealt with the full range of abuse, primarily financial abuse. But unfortunately, we've dealt with cases of sexual abuse, physical abuse, and emotional abuse, many of which were Criminal Code offences.

We also deal with a lot of abuse in the systems that are meant to assist seniors. We call this systemic abuse, and it's all those services that are supposed to provide the supports but that don't necessarily follow the law. We often call this “good law, bad practice”. We see this, for example, in hospital discharge policies. We actually take the position that almost every hospital in Ontario, and I would say across the country, probably has an illegal discharge policy that ignores seniors' legal rights in respect of choice and their role in decision-making in the health system.

In Ontario there's an effort to try to get seniors to pay high per diems that are outside the OHIP ranges. This is just an example that we see in practice, but we see this across all kinds of practice. The diaper example is a good one. The law in Ontario, and I would say, again, across the country, in each province, is that people are intended to be kept clean and dry at all times; having 75% on the diaper isn't necessarily clean and dry. It victimizes the workers and the seniors involved.

We have had experience with hundreds, if not thousands, of abuse cases, and have had experience seeking remedies for our clients. We also have experience doing public legal education on elder abuse prevention and the various legal issues, such as power of attorney. It is a key tool that in fact is not supportive of seniors but is used to financially abuse seniors, even though doing a power of attorney is often promoted in provincial and federal elder abuse campaigns.

I have actually had a lot of contact with the federal-provincial-territorial committee that has been working on elder abuse issues, and I was very pleased that I was asked to contribute to the review of the pamphlets. The pamphlets were amended to reflect that you have to use caution when using powers of attorney. I think those are important messages that come out through those campaigns.

Our primary focus in the education is to seniors, for knowledge of prevention, but also to service providers of all types--health professionals, police, home care workers, and front-line staff in various service agencies--so that they'll know the law, develop their own policies and practice on elder abuse prevention, give a response that is within a legal framework, and challenge their own misconceptions about aging and abuse. Those misconceptions often contribute to the abuse.

Please note that the law on elder abuse is not only about the Criminal Code or adult protection. Krista James, from the Canadian Centre for Elder Law, is actually a friend of mine, and she shared with me her submissions. She ably outlined all of that kind of legislation. I encourage you to look at the materials she's produced.

I can tell you that in practice, we actually use the law across the board. We use family law, privacy law, health law, law in capacity and decision-making, real estate law, and consumer law, all in providing elder abuse response.

What I'm really pitching to you is to look at the broader scope of elder abuse. That's what we use to help our clients. The federal response to elder abuse also needs to look beyond the Criminal Code and elder abuse awareness in a narrow sense. You need to look at the federal role in health funding, housing, legal aid, and privacy, as a few examples.

Because there's limited time, I'm going to go right to some recommendations. The theme I'm going to give you is about training, tools, and time, not necessarily law reform.

First is criminal law. The Criminal Code itself, in my opinion, works quite well. It's good law, but I think some of the practices in respect of the implementation of the law are the real problem.

The Criminal Code includes various sections that respond well to elder abuse. We don't need a special offence of elder abuse. In fact, if you had a special offence, that actually would divert attention from the theft and physical assault and all the different core crimes and would end up limiting a response and create barriers to prosecution.

The Criminal Code also includes sections to accommodate special needs of older victims of abuse in giving testimony and in giving evidence in advance of a trial to both preserve the evidence and to ensure that the prosecution can continue, even if the older witness is unable by physical or mental disability to testify at the time of trial of the accused. There are provisions in the code for audio and video taping of evidence—they're called “KGB statements”—that can be used as evidence.

The Criminal Code sentencing provisions are also good in the sense that if the victim is an older adult, that is taken into account and could be a factor in considering the sentence.

But as to the challenge in the criminal justice system, I would go, again, training, tools, and time. With respect to the training of police officers, I've been involved in a great deal of training at the Ontario Police College and the Toronto Police College. There's a need for training in dealing with investigation of crimes against the elderly in different settings. The police need to know the law related to long-term care, privacy, capacity, retirement homes, home care, and resources in the community to support older victims, especially to help them address the reluctance of older witnesses to testify, or to even complain.

In the course of the education that we do, I frequently have the officers chant “Talk to the senior”, just to get the message across that they need to focus on the senior. Many times in investigations in the past, some officers have told me that they talked to everybody around the senior, but not the senior. It's more challenging to deal with the senior. There may be a communication challenge, or the person may appear more frail than they are. Although they may be still very capable, very able, people will still talk around them. So it's looking more from the senior's perspective.

The next is tools. I have one simple example of tools that the police need. We have provisions about videotaped evidence. I have been told by a number of police officers that they don't have the videotape equipment so they can't take the evidence. How are you going to use those provisions? That's a very important thing. There was a recent Supreme Court of Canada case, Regina v. Khelawon, that dealt with this particular issue. The evidence was thrown out, I think partly because the officers didn't do the whole gamut of things they were supposed to do in order to preserve the evidence. They may not have been supported; they may not have had the tools.

The next is time. We need time to ensure that the police are given time to do investigations of abuse cases. Some of these crimes are very challenging, I know. I've had a lot of contact with the Ottawa police, who have an elder-abuse unit. I can think of one of the offences that the police investigated. It was a case of multiple offences by a PSW who was financially abusing seniors. They were all small amounts of financial abuse. Cumulatively, she had stolen thousands. To do that investigation on all those small bits, the police don't necessarily get the supports to do that. This unit did. But if you're a police officer in Toronto and other cities, they might not get the supports and the time to do that. They would simply say they don't have the time to do it.

So that's training, tools, and time. I now want to go on to privacy. I'm going to say, respectfully, there's a need to amend Bill C-12. This is a bill that's now on the table to amend the privacy legislation, because the amendment to proposed subsection 7(3) will open the door to increased financial abuse of older adults, not increased protection.

This amendment will permit disclosure by federally regulated financial institutions, such as a bank, to the client's next of kin, or the authorized representative of the client, in the belief by the bank personnel that the senior, who is the client of the bank, is a victim of financial abuse. So it's giving permission to the bank to disclose private information about the senior's account on the assumption that the senior is a victim of abuse. Disclosure is to the family members of the senior. It also says to other governmental organizations.

This amendment, to permit the disclosure to next of kin and authorized representatives of the seniors, I think needs to be changed, because those are the abusers. Almost every single case we've had over the years on financial abuse is abuse by family and friends.

This amendment will permit the banks to tip off the potential abusers, to inform them of the abuse. What can the banks do now? The banks actually can talk to their customers. They can start with the senior. If the senior is incapable, they can then contact the governmental institutions. That amendment is fine.

For example, in Ontario, they would contact the Office of the Public Guardian and Trustee, who could investigate the allegation that the senior is not capable. Then, if the senior is capable, they can help provide supports to that senior through assistance in going to the police or a legal organization to address the abuse. Or they could become their guardian to regularize the situation.

So the reports to the public—

[Michael Deturbide]

I think the issue is not necessarily whether one jurisdiction's way of approaching security is better than another's. Bill C-12, which is on the horizon and I hope will be passed, is certainly going to require businesses to turn their minds to security and security issues. But particularly with respect to small and medium size businesses, that's going to be a problem, I think.

I guess I would follow up with what several people here have said, including Mr. Bergeron, for example, that smaller firms need help in investing in ICT. Part of that would be security. First of all, there has to be an awareness and, secondly, they have to have the infrastructure in place. And that means dollars.

All of the studies I've seen seem to indicate that small and medium size businesses, at least at this stage, are not turning their minds adequately to the security issue. That's going to be to their detriment. Frankly, Canada is a little bit behind the ball here. We do have Bill C-12 on the horizon. Other jurisdictions have passed legislation that, for example, requires businesses to have certain security measures in place and, if they don't, to report security breaches. That is something, I think, that is going to come.

It begs the question, though, what small and medium size businesses can do about that. First of all is the awareness issue, and second of all is the financing to put things in place so that they are able to meet the requirements of the legislation.

[Michael Deturbide, Professor and Associate Dean, Academic, Schulich School of Law, Dalhousie University, As an Individual]

Thank you.

My comments are going to focus on some legal aspects of e-commerce, in particular, privacy and security issues that have been, I think, impediments to both business and online consumers.

My message, in a nutshell, is that business needs to get its act together with respect to privacy and security of data. You don't have to look too far, I think, so see why I say that.

Now, some of what I'm about to say, I know, has already been heard to some extent by Industry Canada in earlier consultations, but I think the message merits reinforcement because the problem still exists and Bill C-12, of course, is not yet law.

Back in September of 2004, a report of the Canadian e-Business Initiative identified privacy and security practices as integral parts of a successful e-business adoption strategy. That report came out at a time when Canada implemented the Personal Information Protection and Electronic Documents Act, otherwise known as PIPEDA, which legislated a model code for the protection of personal information. An element of that code is that personal information must be protected by security safeguards appropriate to the sensitivity of the information gathered.

Seven years later, where are we? Well, we continue to hear about large-scale data breaches, and small and medium size businesses in particular are unsure about what they need to do to comply with the privacy legislation—and I'll briefly mention some studies in relation that—and consumers may be excused for wondering if their personal information is being protected at all, given some of the media reports we hear.

In almost every poll or study taken on the barriers to e-commerce—and I've looked at quite a few of these online over the past few days—the principal concerns raised have been privacy and security of personal information. Consumers want some assurance that their information is going to be protected. Businesses want that assurance as well, and they want to know whether they're meeting adequate standards to protect that information and to protect themselves against possible liability.

Unfortunately, there's not been a shortage of significant data breaches over the past few years. According the Privacy Commissioner of Canada, too many data breaches are occurring because companies have ignored some of the most basic steps to protect personal information, including a failure to implement the most basic security measures. Sometimes breaches are reported; sometimes they're not reported at all; sometimes they're reported only after the business gets an indication that the data may be being used for illegal or unscrupulous purposes. Despite the increased frequency of security breaches, a recent Environics Research Group study of small and medium size businesses indicates that most are complacent about their company's IT safeguards and underestimate the consequences of a security breach.

I just want to share very briefly some of those findings with you, if I may. The small and medium size businesses surveyed were divided about the reasons for their complacency. Most, however, acknowledged that they were not taking adequate security measures or that their existing software protection was not adequate. Many were ignorant of cloud computing. The limited number of SMEs that had adopted cloud computing was driven by their desire to spend less money on IT infrastructure, and they were not confident at all that the provider was ensuring any safety of the information they provided.

Believe it or not, people and organizations still care about privacy and security of information. One estimate is that over 35% of Internet users will not give their credit card information online because of security concerns. That's a large chunk of people who are just not engaging in e-commerce and who could be.

It's also interesting to note that a 2011 study indicated that online consumers, largely thought to be motivated primarily by savings, are often willing to pay a premium for purchases from online vendors who have clear protective privacy and security policies. I think this illustrates a couple of things. First, even in the Facebook era, when personal information is willingly disclosed and when some industry executives have declared privacy to be dead, privacy and security are still identified as major factors in a consumer's decision to do business online. And second, those businesses that do take privacy and security seriously can profit from it.

Our experience shows that sometimes legislative intervention is required to ensure adequate data protection mechanisms are in place, otherwise there may be little incentive to remedy the problem. The downside of that is that any attempt at legislative intervention is sometimes reflexively labelled as costly regulation by some in the business community.

For example, one of the issues to be examined is red tape, which creates barriers to growth. The question is whether regulation is red tape or whether it's actually doing something important.

In the current situation, it's been argued that mandatory disclosure of security breaches may cause unnecessary panic in situations where the chance of the fraudulent use of compromised data is minuscule. If you get too many notifications, that then leads to what one writer calls notification desensitization. What's missing from this rationale is that the aim is to encourage business to have adequate security measures in place so that the frequency of data breaches diminishes. If that happens, there can be no oversensitization, because the event is infrequent. In any case, whatever argument is raised against notification, the priority has to be the giving of notice by the custodian of the information to those affected, so that they can take preventative measures.

I want to turn briefly to Bill C-12, currently before the House of Commons. That bill will require an organization to report to the Privacy Commissioner any material breach of security safeguards involving personal information under its control. Factors related to materiality will include the sensitivity of the information and the number of individuals affected. The organization will also be required to notify an individual of the breach if it's reasonable to believe that the breach creates a real risk of significant harm.

I don't mean to go into any great detail on the mechanics of that legislation, but it seems to me that it at least strikes somewhat of a balance—

[Dr. Michael Geist, Canada Research Chair, Internet and E-commerce Law, University of Ottawa, As an Individual]

Thanks very much.

Good afternoon.

As you heard, my name is Michael Geist. I'm a law professor at the University of Ottawa, where I hold the Canada research chair in Internet and e-commerce law. I appear before the committee today in my personal capacity, representing only my own views.

I want to congratulate the committee for launching the study of e-commerce in Canada. It's a critically important issue, deserving of greater attention.

While the committee has identified some excellent questions, I would boil the issue down to a single one: why have Canadian consumers embraced e-commerce but Canada has failed to produce many significant global e-commerce success stories?

The Canadian consumer success story is well known. We're among the global leaders in Internet use and online video consumption. For several years, Canada was the world's largest per capita user of Facebook. Netflix launched online only, first in Canada, and quickly grew to one million subscribers. And digital music sales have grown faster in Canada than in the United States for each of the past five consecutive years.

Yet despite the growth on the consumption side, we punch well below our weight in creating global online companies, an issue recognized by a McKinsey study prepared for the G-8 meeting in France earlier this year. There are exceptions, of course—Club Penguin, Flickr, AbeBooks, and StumbleUpon, among them—but most are bought out by larger U.S. companies before they have the chance to grow into global players.

Canada does have its share of e-commerce SMEs, but the multinationals that employ thousands and generate billions in revenue have largely eluded us. The question is why. There are no doubt many factors—venture capital, market size, appetite for risk—but as they say, when you're a hammer, everything looks like a nail. When you're a law professor, you see legal and policy failures.

Over a decade ago, Canada established the e-commerce law basics, including enforceability of online contracts, privacy rules, and some online consumer protections. But these were just the price of admission. The success stories often lie in countries that went further. I believe companies like YouTube, Google, and Facebook could have been Canadian, but legal rules made it less likely.

For example, YouTube could have been Canadian. The company would have been called iCraveTV, a Toronto-based online video startup that launched in 1999. It streamed television programming, supported by advertising along the bottom of the screen. It was YouTube years before YouTube was YouTube, and it relied on Canadian law to do it. The U.S. objected, and within months of launch the service was shut down, and Canadian law changed as we caved to the U.S. pressure.

Google could have been Canadian. The company would have been called OpenText. OpenText is, of course, Canada's largest software company, based in Waterloo. Before Google was even a Stanford graduate student project, OpenText was providing the search technologies for companies like Yahoo. U.S. copyright law has a fair use provision that Google later relied upon to index the web and become a multi-billion-dollar company. Canada still has a more restrictive fair-dealing approach, and OpenText opted for managing content in the corporate market, which doesn't raise the same legal issues.

Facebook could have been Canadian. The company would have been called Nexopia, which is now an Edmonton-based social network that is still active. It was founded in 2003, a year before the launch of Facebook, but unlike Facebook and thousands of other U.S. companies, Canada does not have a rule that grants legal immunity to intermediaries for the postings of third parties. In the U.S., the Communications Decency Act, section 230, has been used by all the giants—Facebook, Amazon, Google, and eBay—to limit risk and liability for the postings of their users. In Canada, we don't have the same protections, and the risks faced by anyone operating online are far greater.

I could go on. We could talk about why Skype was unlikely to be Canadian because of the regulatory and competitive environment for telecom companies. We could talk about how Zillow, the online real estate giant, couldn't be Canadian because of restrictive rules over the use of listings data. We could talk about how Amazon couldn't be Canadian because of foreign investment restrictions.

Canada has failed to build the competitive legal and policy e-commerce framework, and we now live with the consequences.

So what comes next? There are numerous policy issues that ought to be put on the table, not all of them a matter for the federal government, as some fall within provincial jurisdiction. I'll quickly highlight four, and perhaps we can discuss more during the question period.

First are the privacy and marketing rules. We should move ahead with the anti-spam rules, not diluted through regulations, as some are calling for. Ensure swift passage of the just introduced privacy measures in Bill C-12. Moreover, the next round of privacy law review is due this year. We need tougher enforcement measures put on the table and retention of the principle of court oversight for mandatory personal information disclosure.

Second is copyright flexibility. Today and tomorrow's e-commerce businesses rely far more on the flexibility of copyright law, not the digital locks that form a cornerstone of the current copyright bill, Bill C-11.

Third, other countries have adopted fair use, and yet more are considering the issue. Canada should do the same. An equivalent of the CDA section 230, which I spoke about earlier, for Internet intermediaries is absolutely crucial. It would, however, require provincial cooperation.

Fourth, and finally, is removal of foreign investment restrictions and other competitive barriers in many sectors that touch on e-commerce. Foster a more competitive Internet environment with a set-aside for new entrants in the forthcoming spectrum auction.

Note that Canada may have been the first with an online-only Netflix, but we also hold the dubious distinction of having had Netflix offer bandwidth-reduced versions of its content due to Internet data caps and high costs. The impact extends well beyond the consumer market, as it directly affects e-commerce businesses as well. Canada may have missed out on a generation of e-commerce leaders. We must not miss out on the next one.

[Helen McDonald, Senior Assistant Deputy Minister, Spectrum, Information Technologies and Telecommunications, Department of Industry]

Thank you very much.

Your committee will be undertaking a study on e-commerce in Canada. I would like to take this opportunity to provide your members with Industry Canada's perspective on e-commerce and related issues.

First, I will briefly explain e-commerce and where Canada ranks in relation to other countries.

Second, I will give you an overview of the main activities underway at Industry Canada to stimulate e-commerce, that are a part of the digital economy strategy.

The OECD's internationally accepted definition of e-commerce states that

An e-commerce transaction is the sale or purchase of goods or services, conducted over computer networks by methods specifically designed for the purpose of receiving or placing of orders. The goods or services are ordered by those methods, but the payment and the ultimate delivery of the goods or services do not have to be conducted online. An e-commerce transaction can be between enterprises, households, individuals, governments, and other public or private organisations.

While this definition is useful for guiding international comparisons and data collection efforts, from a more practical perspective, payments, online banking, and bill payments are often considered key elements of electronic commerce.

In this definition, one thing is clear: the first prerequisite for e-commerce is that it must be online. More and more Canadians are online.

According to the CRTC's Communications Monitoring Report 2011, 96% of Canadian households currently have access to broadband services at a speed of at least 1.5 megabytes per second. It is estimated that that percentage will reach 98% by 2012.

A transmission speed of 1.5 megabytes per second encourages e-commerce by increasing the number of households able to buy and sell goods and services online.

In 2010, 70% of Canadian households subscribed to broadband Internet services. Statistics Canada's 2009 Canadian Internet use survey found that nearly 22 million Canadians, or 80% of people over 16 years of age, used the Internet for personal reasons--from home, the office, or some other setting.

Once online, Canadians used the Internet for a variety of activities, such as electronic banking and bill payment, searching for information, and communicating with Canadian municipal, provincial, and federal governments. They undertake education and training online, and also access information on weather, travel, health, and investments.

Canadians are also increasingly purchasing online. About 39% of Internet users indicated they engaged in e-commerce in 2009, and the total value of these online purchases was $15 billion. To give you a sense of the magnitude, total retail sales by Canadian firms were $415 billion in that year.

From the perspective of Canadian firms selling online, total online sales, both retail and commercial, were almost $63 billion in 2007--and this unfortunately is the last year in which data was collected. Of these sales, 59% were commercial, business-to-business transactions. The remaining 41%, or $25.5 billion, were retail sales, business-to-consumer transactions. And despite the relatively large value of online sales, only 8% of firms reported selling online in 2007.

The difficulty of encouraging more Canadian businesses to make the transition to e-commerce and the low overall take-up rate of digital technologies by Canadian businesses are closely linked. Investment per worker by Canadian businesses in information and communications technologies is 60% of investment per worker by American businesses.

Digital technologies play an important role by supporting innovation and productivity. Digital technologies greatly contribute to online transaction processing, electronic funds transfers, supply chain management, computerized data exchanges and automatic data collection.

Increasing the take-up rate of all digital technologies—not only those that support e-commerce—is critically important to ensure the vitality and competitiveness of the economy.

Last fall Minister Clement articulated the government's vision for a digital economy in his interim report. This is a quote:

By 2020, the Harper government sees a Canada that boasts a globally competitive digital economy, characterized by innovation, enhanced productivity, and enduring prosperity—a nation where businesses, communities and individuals have the skills they need to use digital technologies to their advantage and where a globally competitive ICT sector supplies more markets with more innovative products and more new services.

For greater adoption of digital technologies or for e-commerce to be successful, the legal framework governing it must be clear. Industry and consumers alike must understand what is expected of them and what the rules of engagement are. For consumers to engage in the online marketplace, they need to be confident that it is a safe place to shop, that consumer protections are in place, and that personal information is secure.

Minister Paradis confirmed in his speech this May to the 2011 Canadian Telecom Summit that the government is committed to ensuring there is a robust legal framework to increase confidence in and security of online transactions.

Canada's anti-spam law received royal assent in 2010 and is expected to come into force in early 2012. This law will protect Canadian businesses and consumers from the most damaging and deceptive forms of online threats and will deter spammers from operating in Canada. The anti-spam regulations were published last July, and the official consultation period ended on September 7. The department is currently analyzing the input received.

Bill C-11 the Copyright Modernization Act,An Act to amend the Copyright Act was tabled in Parliament last week. The phenomenal popularity of social media and new technologies, such as tablet computers, mobile devices and e-readers, has dramatically changed the way Canadians create and use copyrighted materials.

Copyright modernization allows creators and rights holders to have the tools they need to protect their work and ensure the growth of their companies, especially as Canadians consume and buy more copyrighted material online.

Furthermore, amendments will be made to the Personal Information Protection and Electronic Documents Act under Bill C-12, also tabled last week. One of the main amendments relates to the notification requirement for data breaches. It is an important tool for increasing the security of online markets.

A second prerequisite for e-commerce is access to high speed networks, that is an affordable connection. In order to participate in e-commerce, you have to be connected to the Internet. Therefore, it is clearly in the government's interest to ensure that consumers have enough choice in accessing different affordable Internet services.

In recent years, thanks to government measures to increase competition in the wireless market, Canadian consumers have seen new companies enter the market and have benefited from lower prices and a greater selection of packages.

Increasingly, wireless networks are offering high-speed Internet access and the benefits of a mobile economy. To help meet the increasing demand of Canadian businesses and consumers for access to mobile broadband, Minister Paradis has confirmed that the government will be auctioning off the 700 megahertz spectrum and the 2,500 megahertz spectrum.

The third prerequisite is to increase private sector adoption of digital technologies. Targeted efforts are needed to raise the awareness of businesses, particularly small and medium-sized businesses, of the benefits of adoption. Industry Canada's small-business internship program provides small and medium-sized enterprises with financial support to hire a post-secondary student intern to assist them in their adoption of e-commerce strategies.

The government has taken two additional steps to promote awareness and adoption. In the spring of 2011, the Business Development Bank of Canada announced an array of new efforts to support ICT adoption among small and medium-sized enterprises. The BDC helps firms with web strategies, sales, customer management, and choosing the technologies best suited to the firms' needs.

Budget 2011 also announced the creation of an $80-million pilot project over three years involving the NRC's industrial research assistance program and Canadian colleges, to promote the take-up of advanced digital technologies among small businesses. More details on the pilot will be available once it has been formally launched.

The growth of e-commerce also requires a workforce with the requisite digital skills. In budget 2011, Human Resources and Skills Development Canada will reallocate $60 million over three years to encourage an increase in the number of students enrolled in key disciplines linked to the digital economy.

Citizenship and Immigration Canada also plays a major role by attracting to Canada foreign workers who have the skills to ensure that digital economy and e-commerce thrive, and by encouraging them to stay in the country.

Granting councils have also played a big role over the years by creating research chairs and by financing centres of excellence to face the brand new issues and opportunities.

Promoting the acquisition of digital skills is a responsibility we share with the provinces and industry, which play a leading role. That is why Industry Canada continues to work closely with all of its partners.

Thank you very much for this opportunity to come before you today. I and my colleagues would be happy to take questions at your leisure.

Safeguarding Canadians' Personal Information Act

[Gordon O'Connor, Conservative, Carleton—Mississippi Mills, ON]

moved for leave to introduce Bill C-12, An Act to amend the Personal Information Protection and Electronic Documents Act.

(Motions deemed adopted, bill read the first time and printed)